rocky/OSGAccountServer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden admin deployment and local acceptance

Browse Source 
Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.
This commit is contained in:
Rocky
2026-08-17 15:20:46 +08:00
parent 1a9c518f96
commit 405a2cfc0f
17 changed files with 1480 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/openresty-account.conf
+52 -2
View File
@@ -31,6 +31,14 @@ server {
ssl_protocols TLSv1.2 TLSv1.3;
ssl_session_timeout 1d;
ssl_session_cache shared:account_tls:10m;
# Request client certificates at the shared TLS edge without requiring them
# for mobile APIs. Only the dedicated admin CA is trusted for verification.
ssl_client_certificate /www/server/openresty/conf/mtls/admin-client-ca.pem;
ssl_verify_client optional;
ssl_verify_depth 2;
# An invalid certificate is rejected before location processing; normalize
# that TLS verification failure so it does not reveal the protected surface.
error_page 495 =404 @client_certificate_not_found;
client_max_body_size 21m;
server_tokens off;
@@ -39,8 +47,48 @@ server {
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;
# Never publish operational or administrative paths through this vhost.
location ~ ^/(?:admin|internal|v1/admin)(?:/|$) {
# Internal-only endpoints remain unavailable through this public vhost.
location ~ ^/internal(?:/|$) {
return 404;
}
# Administrative endpoints are indistinguishable from missing routes unless
# OpenResty verified a certificate issued by the dedicated admin client CA.
location ~ ^/(?:admin|v1/admin)(?:/|$) {
if ($ssl_client_verify != SUCCESS) {
return 404;
}
client_max_body_size 32k;
limit_req zone=account_api burst=40 nodelay;
# Defining a location-level header disables inheritance from the server
# block, so repeat the security headers explicitly.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;
add_header Content-Security-Policy "default-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; object-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'" always;
add_header Cache-Control "no-store" always;
proxy_pass http://osg_account_server;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Request-ID $request_id;
# Overwrite any client-supplied value; Ktor must trust only this header.
proxy_set_header X-OSG-mTLS-Verified "SUCCESS";
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_hide_header Server;
proxy_request_buffering off;
proxy_buffering off;
proxy_cache off;
proxy_read_timeout 360s;
proxy_send_timeout 360s;
}
location @client_certificate_not_found {
return 404;
}
@@ -53,6 +101,8 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Request-ID $request_id;
# Suppress spoofed trust signals on every non-admin request.
proxy_set_header X-OSG-mTLS-Verified "";
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_hide_header Server;