knso/Webklar-Kundenbereich
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Runner: Proxy härten (R13 Listen-Adressen, Hop-by-hop, Upgrade-Race, Touch, Timeout)

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
ClaudeandClaude Sonnet 5.5 committed 2026-09-30 21:53:41 +00:00
1 parent 4afe7eb5cd
commit e358514240
6 files changed
+173 -15
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

runner/src/index.js
+8 -6
View File
@@ -4,6 +4,8 @@ import { createDocker } from './docker.js';
import { createJobs } from './jobs.js';
import { createDev } from './dev.js';
import { createProxy } from './proxy.js';
import os from 'node:os';
import { listenAddresses } from './listen.js';
const config = loadConfig(process.env);
const docker = createDocker();
@@ -16,9 +18,9 @@ const dev = createDev({ config, docker, jobs: realJobs });
dev.cleanupOrphans().catch((e) => console.error('cleanupOrphans', e));
setInterval(() => dev.sweep().catch((e) => console.error('sweep', e)), 60e3).unref();
createApiServer({ config, jobs, dev }).listen(config.apiPort, () => {
console.log(`Preview-Runner API auf Port ${config.apiPort}`);
});
createProxy({ config, dev }).listen(config.proxyPort, () => {
console.log(`Preview-Runner Proxy auf Port ${config.proxyPort}`);
});
// R13: nur auf Adressen außerhalb des Sandbox-Netzes lauschen (kein Zugriff aus Dev-Containern am Traefik-Auth vorbei).
const addrs = listenAddresses(os.networkInterfaces(), config.sandboxSubnet);
for (const addr of addrs) {
createApiServer({ config, jobs, dev }).listen(config.apiPort, addr, () => console.log(`Preview-Runner API auf ${addr}:${config.apiPort}`));
createProxy({ config, dev }).listen(config.proxyPort, addr, () => console.log(`Preview-Runner Proxy auf ${addr}:${config.proxyPort}`));
}