Don't convert the host name specified with --api=/dns4/<domain>/ into an IP address (thus making life easy for reverse proxy) #10232
Labels
effort/hours
Estimated to take one or several hours
help wanted
Seeking public contribution on this issue
kind/enhancement
A net-new feature or improvement to an existing feature
P2
Medium: Good to have, but can wait until someone steps up
topic/rpc-api
Issues related to Kubo RPC API at /api/v0
Comments
softwareplumber
added
the
kind/enhancement
lidel
added
help wanted
|
I have submitted PR #10233 so far it
looks like a one-line fix. I am using this fix in-house to connect
between the cli and back-end via an nginx reverse proxy.
The fly in the ointment is that a fix on go-ipfs-cmds is also necessary
to support https on the client. Aware that actually *serving* the API
directly on https is a whole can of worms, but supporting https as an
option on the cli (e.g. by specifying
--api=/dns4/<hostname>/tcp/443/tls) would at least allow a secure
connection to the reverse proxy. Hope to submit a PR for this
eventually, but it makes sense to do the kubo part first.
Regards
Jon
…------ Original Message ------
From "Marcin Rataj" ***@***.***>
To "ipfs/kubo" ***@***.***>
Cc "softwareplumber" ***@***.***>; "Author"
***@***.***>
Date 11/27/2023 9:52:23 AM
Subject Re: [ipfs/kubo] Don't convert the host name specified with
--api=/dns4/<domain>/ into an IP address (thus making life easy for
reverse proxy) (Issue #10232)
Triage notes:
makes sense to fix this
needs analysis, could be easy fix, or it could require deeper refactor
of RPC CLI client/commands to move resolve from
https://github.com/ipfs/kubo/blob/3ae04c536e65954db9e6465346108f97d285c244/cmd/ipfs/main.go#L294
deeper down the stack
—
Reply to this email directly, view it on GitHub
<#10232 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AGAPFY6NTI2OXB4CPB3D4ULYGSSKPAVCNFSM6AAAAAA72FYPGOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMRXHE4DONRZGU>.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Checklist
Description
In kubo/cmd/ipfs/main.go, the multiaddr specified using the --api is resolved:
apiAddr, err = resolveAddr(req.Context, apiAddr)Unfortunately this erases information about the host name. Almost anyone trying to run kubo behind a reverse proxy will hate this, since it means the HTTP requests go out with the IP address rather than the host name in the header, thus breaking any hostname based rules in the reverse proxy. This caused a couple of days of head-scratching on my part, since API calls handcrafted via CURL worked just fine for me, but I couldn't persuade the kubo cli to work.
Removing this line fixed that problem for me (OK, there are other problems related to https support, but at least the CLI works over http).
Is there any reason we actually need resolve the hostname here rather than letting the executor do it? Or is it just a check? (in which case simply ignoring the address returned by resolve would be perfect)
The text was updated successfully, but these errors were encountered: