mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
d37aa42392
The xterm console never connected: socketiod expected a different token format, its worker had no compute credentials, one global console was shared by every client and its output broadcast to all of them, and the Docker image did not run socketiod at all. - console/tokens.py: one authorize() for noVNC and socketiod; the signed token is the only credential, checked at connect time. - socketiod: one pty worker per client (consolecallback with the instance id), one session per VM, a session cap, input and resize checked; the parent never opens libvirt. The engine.io same-origin check is on. - consolecallback: opens the console with the compute's credentials and exits with a message when it cannot. - Docker runs socketiod as a runit service; nginx proxies /socket.io/ with Host and the scheme for the origin check. Supervisor and systemd start it as well; WEBVIRTCLOUD_SERIAL_CONSOLE=1 enables it. - Tests: token and session unit tests, socketiod as a process, and a live test that reads SeaBIOS from a wvc-test VM on the TCP and SSH hosts.
65 lines
2.1 KiB
Text
65 lines
2.1 KiB
Text
# "https" from a TLS-terminating proxy in front of this nginx is kept; otherwise
|
|
# the scheme of this server is used. A client claiming https over plain HTTP
|
|
# only changes how its own request is handled (no redirect, secure cookies).
|
|
map $http_x_forwarded_proto $wvc_forwarded_proto {
|
|
default $scheme;
|
|
https https;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
|
|
#server_name webvirtcloud.example.com;
|
|
#access_log /var/log/nginx/webvirtcloud-access_log;
|
|
|
|
location /static/ {
|
|
alias /srv/webvirtcloud/staticfiles/;
|
|
# URLs carry no version: browsers revalidate (304 if unchanged), so an
|
|
# update or a theme change shows on the next load
|
|
expires -1;
|
|
}
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8000;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-Proto $wvc_forwarded_proto;
|
|
proxy_connect_timeout 1800;
|
|
proxy_read_timeout 1800;
|
|
proxy_send_timeout 1800;
|
|
client_max_body_size 1024M;
|
|
}
|
|
|
|
location /novncd/ {
|
|
proxy_pass http://wsnovncd;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
# Serial console (socketiod); it refuses connections while
|
|
# SERIAL_CONSOLE_ENABLED is off. Host and the scheme go on for its
|
|
# same-origin check.
|
|
location /socket.io/ {
|
|
proxy_pass http://wssocketiod;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-Proto $wvc_forwarded_proto;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 1h;
|
|
}
|
|
location /websockify {
|
|
proxy_pass http://wsnovncd;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
}
|
|
|
|
upstream wsnovncd {
|
|
server 127.0.0.1:6080;
|
|
}
|
|
upstream wssocketiod {
|
|
server 127.0.0.1:6081;
|
|
}
|