Denis Mishin
f67b33484b
add metrics aggregation ( #3452 )
2022-06-30 10:52:45 -04:00
Caleb Doxsey
86625a4ddb
config: support files for shared_secret, client_secret, cookie_secret and signing_key ( #3453 )
2022-06-29 10:44:08 -06:00
Denis Mishin
d1037d784a
allow pomerium to be embedded as a library ( #3415 )
2022-06-15 20:29:19 -04:00
bobby
ebbb6a7ff2
docs: update references, remove docs dir ( #3420 )
...
* docs: update references, remove docs dir
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
* Update README.md
Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
* Update Docs Paths
* precommit
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
* remove spellcheck
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
* spell the check
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
2022-06-13 16:52:52 -07:00
cfanbo
d9097b44ea
replace fmt.Sprintf with net.JoinHostPort ( #3407 )
2022-06-07 13:04:13 -06:00
Caleb Doxsey
fd82cc7870
authenticate: allow changing the authenticate service URL at runtime ( #3378 )
...
* config: better change detection
* wip
* fix middleware
* add middleware before handlers
* use ctx
2022-05-31 13:24:40 -06:00
Caleb Doxsey
1c2aad2de6
postgres: databroker storage backend ( #3370 )
...
* wip
* storage: add filtering to SyncLatest
* don't increment the record version, so intermediate changes are requested
* databroker: add support for query filtering
* fill server and record version
* postgres: databroker storage backend
* wip
* serialize puts
* add test
* skip tests for macos
* add test
* return error from protojson
* set data
* exclude postgres from cover tests
2022-05-25 10:23:58 -06:00
Denis Mishin
51e716ef54
add x-request-id in responses ( #3366 )
2022-05-16 18:22:20 -04:00
Denis Mishin
a15106ebe2
avoid null reproxy handler ( #3345 )
2022-05-11 12:16:59 -04:00
Caleb Doxsey
6b663ba53f
httputil/reproxy: fix policy transport ( #3322 )
2022-05-04 18:32:36 -06:00
Caleb Doxsey
9dbe12fe99
authenticate: save session for bare webauthn redirects, consider external service URL to be a pomerium url ( #3280 )
2022-04-19 16:03:11 -06:00
Caleb Doxsey
9ae5c26f42
envoy: use typed extension protocol options for static bootstrap cluster ( #3268 )
2022-04-12 13:13:32 -06:00
Caleb Doxsey
25a7afd6e6
ppl: support . in object_get paths ( #3263 )
2022-04-11 09:24:39 -06:00
Caleb Doxsey
c5550d28ed
config: fix DefaultTransport so it is still a *http.Transport ( #3257 )
...
* config: fix DefaultTransport so it is still a *http.Transport
* remove printlns
* Update config/http.go
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
* remove unnecessary check
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
2022-04-08 11:07:37 -06:00
Caleb Doxsey
b79f1e379f
config: add support for downstream TLS server name ( #3243 )
...
* config: add support for downstream TLS server name
* fix whitespace
* fix whitespace
* add docs
* add tls_upstream_server_name and tls_downstream_server_name to config
* Update docs/reference/settings.yaml
Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
* Update docs/reference/readme.md
Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
* add deprecation notice
Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
2022-04-06 06:48:45 -07:00
Caleb Doxsey
b435f73e2b
authenticate: fix debug and metrics endpoints ( #3212 )
2022-03-30 09:37:37 -06:00
Caleb Doxsey
d6bd2d06ef
envoy: upgrade to 1.21.1 ( #3186 )
...
* envoy: upgrade to 1.21.1
* envoy: upgrade to 1.21.1
2022-03-24 10:16:07 -06:00
Caleb Doxsey
1342523cda
grpc: remove ptypes references ( #3078 )
2022-02-24 08:37:59 -07:00
Caleb Doxsey
efd609f6ce
config: add idp_client_id and idp_client_secret to protobuf ( #3060 )
2022-02-18 08:55:31 -07:00
Caleb Doxsey
908ea35ed8
config: fix httptest local certificate ( #3056 )
...
* config: fix httptest local certificate
* config: remote unused localCert
2022-02-17 10:44:14 -07:00
Caleb Doxsey
99b9a3ee12
authorize: add support for passing access or id token upstream ( #3047 )
...
* authorize: add support for passing access or id token upstream
* use an enum
2022-02-17 09:28:31 -07:00
Caleb Doxsey
f9b95a276b
authenticate: support for per-route client id and client secret ( #3030 )
...
* implement dynamic provider support
* authenticate: support per-route client id and secret
2022-02-16 12:31:55 -07:00
Caleb Doxsey
fbdbe9c86f
config: fix TLS config when address and grpc_address are the same ( #2975 )
2022-01-27 09:18:07 -07:00
Caleb Doxsey
ace5bbb89a
config: fix policy matching for regular expressions ( #2966 )
...
* config: fix policy matching for regular expressions
* compile regex in validate, add test
* fix test
2022-01-25 08:48:40 -07:00
Caleb Doxsey
95d6d97143
authenticate: support webauthn redirects to non-pomerium domains ( #2936 )
...
* authenticate: support webauthn redirects to non-pomerium domains
* add test
* remove dead code
2022-01-19 15:10:57 -07:00
dependabot[bot]
9916db2ed7
chore(deps): bump github.com/open-policy-agent/opa from 0.35.0 to 0.36.0 ( #2911 )
...
* chore(deps): bump github.com/open-policy-agent/opa from 0.35.0 to 0.36.0
Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa ) from 0.35.0 to 0.36.0.
- [Release notes](https://github.com/open-policy-agent/opa/releases )
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-policy-agent/opa/compare/v0.35.0...v0.36.0 )
---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix tests
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
2022-01-14 12:13:33 -07:00
Caleb Doxsey
49fb00c895
envoy: check certificates for must-staple flag and drop them if they are missing the response ( #2909 )
...
* envoy: check certificates for must-staple flag and drop them if they are missing the response
* Update config/envoyconfig/tls_test.go
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
2022-01-10 10:51:56 -07:00
cfanbo
84dad4c612
remove deprecated ioutil usages ( #2877 )
...
* fix: Fixed return description error
* config/options: Adjust the position of TracingJaegerAgentEndpoint option
* DOCS: Remove duplicate configuration items
Remove duplicate configuration items of route
* remove deprecated ioutil usages
2021-12-30 10:02:12 -08:00
Caleb Doxsey
6b949a5c2e
config: allow specifying auto codec type in all-in-one mode ( #2846 )
...
* config: allow specifying auto codec type in all-in-one mode
* fix test
* fix test
2021-12-22 12:34:58 -07:00
Denis Mishin
6b592afd3e
set default codec type to auto/http1 ( #2839 )
2021-12-21 13:26:07 -05:00
cfanbo
8f62b06425
fix: Fixed return description error ( #2825 )
...
* fix: Fixed return description error
* config/options: Adjust the position of TracingJaegerAgentEndpoint option
2021-12-17 08:57:35 -08:00
Caleb Doxsey
5a858f5d48
config: add internal service URLs ( #2801 )
...
* config: add internal service URLs
* maybe fix integration tests
* add docs
* fix integration tests
* for databroker connect to external name, but listen on internal name
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2021-12-10 14:04:37 -05:00
Caleb Doxsey
d0890d399c
envoyconfig: fix tls_downstream_client_ca for non-standard ports ( #2802 )
2021-12-08 10:48:52 -07:00
Caleb Doxsey
c97dcf7e0f
envoy: add hash policy and routing key for hash-based load balancers ( #2791 )
...
* envoy: add hash policy and routing key for hash-based load balancers
* fix integration test
* fix nginx
2021-12-01 13:42:12 -07:00
Caleb Doxsey
bd0a5389bf
envoy: add support for bind_config bootstrap options ( #2772 )
...
* envoy: add support for bind_config bootstrap options
* only add upstream bind config options to individual policy clusters
* update docs for new Envoy keys
Co-authored-by: alexfornuto <alex@fornuto.com>
2021-12-01 13:02:49 -07:00
Caleb Doxsey
a8b76bd623
authorize: support X-Pomerium-Authorization in addition to Authorization ( #2780 )
...
* authorize: support X-Pomerium-Authorization in addition to Authorization
* tangentental correction
Co-authored-by: alexfornuto <alex@fornuto.com>
2021-11-29 12:19:14 -07:00
Caleb Doxsey
a5034aabae
authenticate: redirect / to /.pomerium/ ( #2770 )
2021-11-18 08:49:23 -07:00
Caleb Doxsey
d90d4caf1a
config: detect changes to the kubernetes service account token file ( #2767 )
2021-11-17 08:19:09 -07:00
Caleb Doxsey
ca48052551
tls: fallback to self-signed certificate ( #2760 )
...
* tls: fallback to self-signed certificate
* remove unknown domain because certs are no longer valid
* update multi-deployment to use service-specific certificates
2021-11-15 14:11:53 -07:00
Herman Slatman
7812c6985d
Add additional ACME options ( #2695 )
...
The `autocert_ca` and `autocert_email` options have been added to be
able to configure CAs that support the ACME protocol as an alternative
to Let's Encrypt.
Fix ProtoBuf definition for additional autocert options
Fix PR comments and add ACME EAB configuration
Add configuration option for trusted CAs when talking ACME
Fix linter issues
copy edits
render updated reference to docs
Add test for autocert manager configuration
Add tests for autocert configuration options
Fix CI build issues
Don't set empty acme.EAB struct if configuration not set
Remove required email when setting custom CA
When using a non-default CA it's no longer required
to specify an email address. I required this before,
because it seemed to cause an issue in which no certificate
was issued. The root cause was something different,
rendering the hard email requirement pointless. It's
still beneficial to specify an email, though. I changed
the text in the docs to explain that.
Update generated docs
Fix failing tests by recreation of a new ACMEManager
The default ACMEManager object was reused in multiple tests,
resulting in unexpected states when tests run in parallel.
By using a new instance for every test, this is no longer
an issue.
2021-11-02 14:44:27 -07:00
Caleb Doxsey
6e48627b4d
ppl: add support for additional data ( #2696 )
...
* ppl: add support for additional data
* remove unused NewCriterionDeviceRule
2021-10-22 12:32:20 -06:00
Denis Mishin
55fec9b51b
add host-rewrite options to config.proto ( #2668 )
2021-10-08 11:50:56 -04:00
bobby
45ce2027b2
config/envoyconfig: better duplicate message ( #2661 )
...
Fixes #2655
2021-10-04 19:37:03 -04:00
Caleb Doxsey
efffe57bf0
ppl: pass contextual information through policy ( #2612 )
...
* ppl: pass contextual information through policy
* maybe fix nginx
* fix nginx
* pr comments
* go mod tidy
2021-09-20 16:02:26 -06:00
Caleb Doxsey
eca2fc62d8
ppl: use session.user_id instead of user.id for user criterion ( #2562 )
...
* ppl: use session.user_id instead of user.id for user criterion
* fix test
2021-09-03 07:53:00 -06:00
Caleb Doxsey
33f5190572
config: remove signature_key_algorithm ( #2557 )
...
* config: remove signature_key_algorithm
* typo
* add more tests
2021-09-02 11:36:43 -06:00
Denis Mishin
951d20ad52
fix: allow pomerium to start without certs ( #2555 )
2021-08-31 11:06:48 -04:00
Caleb Doxsey
1cbcb8335d
config: remove headers ( #2522 )
...
* config: remove headers
* Update docs/docs/upgrading.md
Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
Co-authored-by: Alex Fornuto <afornuto@pomerium.com>
2021-08-25 09:20:17 -06:00
Caleb Doxsey
db43014d78
envoy: remove deprecated access_log_path ( #2523 )
2021-08-25 09:19:35 -06:00
Caleb Doxsey
bbec2cae9f
grpc: send client traffic through envoy ( #2469 )
...
* wip
* wip
* handle wildcards in override name
* remove wait for ready, add comment about sync, force initial sync complete in test
* address comments
2021-08-16 16:12:22 -06:00
