ac/ac-deploy
1
0
Fork 0
mirror of git://f0xx.org/ac/ac-deploy synced 2026-08-12 18:12:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

Monitor: Grafana auth proxy session fix and nginx login bypass.

Browse Source 
Use ac_crash_sess shared session, allow password reset without auth_request,
update grafana.ini template and alert rules.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Anton Afanasyeu
2026-08-07 22:16:03 +02:00
parent 9307e3d47c
commit 12545813ab
6 changed files with 84 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
sim/cluster0/lab-seeds/backend/public/api/grafana-auth-check.php Normal file
View File

@@ -0,0 +1,35 @@
<?php
declare(strict_types=1);
/**
* Grafana / Alertmanager / broadcast auth_request endpoint.
*
* nginx `internal;` blocks direct browser access. Returns 200 + X-WEBAUTH-USER when
* the shared Android Cast PHP session (ac_crash_sess) is valid, 401 otherwise.
*
* Deploy: /var/www/ac/composed/backend/public/api/grafana-auth-check.php
*/
require_once dirname(__DIR__, 4) . '/platform/shared_session.php';
platform_start_session('ac_crash_sess', '/app/androidcast_project');
$user = $_SESSION['user'] ?? null;
if (empty($user['id'])) {
http_response_code(401);
exit;
}
if (!empty($user['pending_2fa'])) {
http_response_code(401);
exit;
}
$username = (string) ($user['username'] ?? $user['email'] ?? 'user_' . $user['id']);
$grafanaUser = preg_replace('/[^a-zA-Z0-9._@-]/', '_', $username);
http_response_code(200);
header('X-WEBAUTH-USER: ' . $grafanaUser);
header('Content-Type: text/plain');
echo 'ok';

24
sim/cluster0/nginx/apps-port80.conf
View File

@@ -193,6 +193,14 @@ server {
alias /var/www/ac/workspace/ac-be-builder/public/assets/;
}
location ~ ^/app/androidcast_project/build/api/(.+\.php)$ {
include fastcgi_params;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param SCRIPT_FILENAME /var/www/ac/workspace/ac-be-builder/public/api/$1;
fastcgi_param SCRIPT_NAME /app/androidcast_project/build/api/$1;
fastcgi_param REQUEST_URI $request_uri;
}
location ^~ /app/androidcast_project/build/ {
include fastcgi_params;
fastcgi_pass 127.0.0.1:9000;
@@ -222,16 +230,28 @@ server {
location = /app/androidcast_project/monitor {
return 301 $public_scheme://$http_host/app/androidcast_project/monitor/;
}
# Login + password reset must work without PHP session (Grafana local auth).
location ~ ^/app/androidcast_project/monitor/(login|user/password|api/user/password) {
proxy_pass http://10.7.16.239:3000;
proxy_redirect off;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $public_scheme;
proxy_http_version 1.1;
}
location /app/androidcast_project/monitor/ {
auth_request /app/androidcast_project/api/grafana-auth-check.php;
auth_request_set $grafana_user $upstream_http_x_webauth_user;
error_page 401 = @monitor_login_redirect;
proxy_pass http://10.7.16.239:3000/;
proxy_pass http://10.7.16.239:3000;
proxy_redirect off;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Proto $public_scheme;
proxy_set_header X-WEBAUTH-USER $grafana_user;
proxy_set_header Authorization "";
proxy_http_version 1.1;
proxy_read_timeout 300;
proxy_send_timeout 300;