Only allow localhost access, temporarily (#7)

uwcirg · Oct 17, 2024 · b33e861 · b33e861
1 parent b772989
commit b33e861
Show file tree

Hide file tree

Showing 6 changed files with 37 additions and 0 deletions.
diff --git a/dev/alive/docker-compose.yaml b/dev/alive/docker-compose.yaml
@@ -24,6 +24,9 @@ services:
       - traefik.http.routers.alive-coreapi-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.alive-coreapi-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.alive-coreapi-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
   node:
     labels:
       - traefik.enable=true
@@ -32,5 +35,8 @@ services:
       - traefik.http.routers.alive-node-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.alive-node-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.alive-node-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
 volumes:
   leaf-alive-mssql:
diff --git a/dev/gateway/docker-compose.yaml b/dev/gateway/docker-compose.yaml
@@ -24,6 +24,9 @@ services:
       - traefik.http.routers.gateway-coreapi-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.gateway-coreapi-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.gateway-coreapi-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
   node:
     extends:
       file: ../common-services.yaml
@@ -35,6 +38,9 @@ services:
       - traefik.http.routers.gateway-node-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.gateway-node-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.gateway-node-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
   clin-db:
     extends:
       file: ../common-services.yaml

diff --git a/dev/hymtruth/docker-compose.yaml b/dev/hymtruth/docker-compose.yaml
@@ -24,6 +24,9 @@ services:
       - traefik.http.routers.hymtruth-coreapi-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.hymtruth-coreapi-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.hymtruth-coreapi-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
   node:
     labels:
       - traefik.enable=true
@@ -32,5 +35,8 @@ services:
       - traefik.http.routers.hymtruth-node-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.hymtruth-node-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.hymtruth-node-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
 volumes:
   leaf-hymtruth-mssql:
diff --git a/dev/mash/docker-compose.yaml b/dev/mash/docker-compose.yaml
@@ -24,6 +24,9 @@ services:
       - traefik.http.routers.mash-coreapi-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.mash-coreapi-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.mash-coreapi-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
   node:
     labels:
       - traefik.enable=true
@@ -32,5 +35,8 @@ services:
       - traefik.http.routers.mash-node-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.mash-node-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.mash-node-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
 volumes:
   leaf-mash-mssql:
diff --git a/dev/mstudy/docker-compose.yaml b/dev/mstudy/docker-compose.yaml
@@ -24,6 +24,9 @@ services:
       - traefik.http.routers.mstudy-coreapi-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.mstudy-coreapi-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.mstudy-coreapi-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
   node:
     labels:
       - traefik.enable=true
@@ -32,5 +35,8 @@ services:
       - traefik.http.routers.mstudy-node-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.mstudy-node-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.mstudy-node-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
 volumes:
   leaf-mstudy-mssql:
diff --git a/dev/radar/docker-compose.yaml b/dev/radar/docker-compose.yaml
@@ -24,6 +24,9 @@ services:
       - traefik.http.routers.radar-coreapi-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.radar-coreapi-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.radar-coreapi-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
   node:
     labels:
       - traefik.enable=true
@@ -32,5 +35,9 @@ services:
       - traefik.http.routers.radar-node-${COMPOSE_PROJECT_NAME}.tls=true
       - traefik.http.routers.radar-node-${COMPOSE_PROJECT_NAME}.tls.certresolver=letsencrypt
 
+      # TODO remove after auth implemented via oauth2-proxy
+      # only allow access from localhost and CIRG IP ranges
+      - traefik.http.routers.radar-node-${COMPOSE_PROJECT_NAME}.middlewares=limit-access-to-cirg-dc-cidr
+
 volumes:
   leaf-radar-mssql: