vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nh3-svos): strip Tailscale-User-* and X-Forwarded-* as whole families at the SVOS front door

Browse Source 
svos-dev review: the Caddyfile deleted named headers only. Prefix deletes cover the families; the named strays (Tailscale-Headers-Info, X-Real-IP, Forwarded, X-SVOS-Peer) stay. Wildcard semantics checked on a scratch Caddy (case-insensitive; look-alikes outside the family survive). Deployed, validated via systemd-run with EnvironmentFile, reloaded; deny tests re-run (403). README: safe validate recipe, pending acceptance list.
This commit is contained in:
vh
2026-10-05 19:35:10 -07:00
parent ce398685c0
commit 454b689a54
2 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/svos-front/Caddyfile
+4 -6
View File
@@ -21,13 +21,11 @@ https://svos.phasefinal.com:443 {
resolvers 1.1.1.1 8.8.8.8
}
route {
request_header -Tailscale-User-Login
request_header -Tailscale-User-Name
request_header -Tailscale-User-Profile-Pic
# Whole families by prefix (Caddy header-delete wildcard; tested 2026-10-05: case-insensitive, and
# X-Forwardedness / Tailscale-Other survive), plus the named strays outside them.
request_header -Tailscale-User-*
request_header -X-Forwarded-*
request_header -Tailscale-Headers-Info
request_header -X-Forwarded-For
request_header -X-Forwarded-Proto
request_header -X-Forwarded-Host
request_header -X-Real-IP
request_header -Forwarded
request_header -X-SVOS-Peer