gateway: open up CORS to everything (allow-origin *)

[ghost]

• needs testing on a gateway node.

[harlantwood]

Awesome! So the ipfs.io gateway will use this?

[jbenet]

we should only change this for the Gateway, not the API -- actually, this should NOT have the public gateways, and only have the default parameters.

now it relies on one level of isolation: docker not rebinding the port. if it rebinds the port, then the api is usable outside. if port gets exposed to outer host -- docker firewall stopping?

[ghost]

sorry for the delay here --

we should only change this for the Gateway, not the API

The API headers rules apply to :8080/api, which is a bit inconvenient here -- maybe we should just change that in go-ipfs?

if port gets exposed to outer host -- docker firewall stopping?

No firewalling, I made docker and nginx expose :5001 and :8080 only to 127.0.0.1 and the cjdns VPN

[jbenet]

Ooof this api/gateway duality in go-ipfs needs reworking.
On Fri, Nov 20, 2015 at 18:22 Lars Gierth notifications@github.com wrote:

In solarnet/roles/ipfs/templates/config.j2
#109 (comment):

   ]
 }

},
"API": {
"HTTPHeaders": {
"Access-Control-Allow-Origin": [

•    "https://gateway.ipfs.io",
  

•    "https://ipfs.io",
  

•    "http://gateway.ipfs.io",
  

•    "http://ipfs.io",
  

•    "http://h.ipfs.io",
  

•    "http://localhost",
  

•    "http://localhost:8080",
  

•    "http://127.0.0.1",
  

•    "http://127.0.0.1:8080"
  

sorry for the delay here --

we should only change this for the Gateway, not the API

The API headers rules apply to :8080/api, which is a bit inconvenient
here -- maybe we should just change that in go-ipfs?

if port gets exposed to outer host -- docker firewall stopping?

No firewalling, I made docker and nginx expose :5001 and :8080 only to
127.0.0.1 and the cjdns VPN

—
Reply to this email directly or view it on GitHub
https://github.com/ipfs/infrastructure/pull/109/files#r45539900.

[ghost]

Wild guess: ipfs/kubo#2021 might fix this

[ghost]

@harlantwood could you point me to something that should now work, i.e. with Allow-Origin: *

[harlantwood]

Hm, nothing I have up right now... But look forward to using this!

[harlantwood]

@lgierth looking good:

https://ipfs.io/ipfs/QmV8e64oRKabaPxgZBN8ojpQRovtbQ4E2LgUvGXhFkSqWf :

[ghost]

cool!