starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-09-26 09:20:54 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(proxy): prevent automatic Traefik self-exposure

Browse Source
This commit is contained in:
Andras Bacsai
2026-09-21 15:06:01 +02:00
parent 360b30fd61
commit b8f630be6b
2 changed files with 50 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap/helpers/proxy.php
+1 -4
View File
@@ -359,10 +359,7 @@ function generateDefaultProxyConfiguration(Server $server, array $custom_command
});
if ($proxy_type === ProxyTypes::TRAEFIK->value) {
$labels = [
'traefik.enable=true',
'traefik.http.routers.traefik.entrypoints=http',
'traefik.http.routers.traefik.service=api@internal',
'traefik.http.services.traefik.loadbalancer.server.port=8080',
'traefik.enable=false',
'coolify.managed=true',
'coolify.proxy=true',
];
tests/Feature/TrafficAnalytics/TraefikLogrotateSidecarTest.php
+49
View File
@@ -31,6 +31,55 @@ it('uses the latest stable traefik branch for new proxy configurations', functio
expect($config['services']['traefik']['image'])->toBe('traefik:v3.7');
});
it('does not expose the proxy container through its own docker provider', function () {
$server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
$server->proxy->set('type', 'TRAEFIK');
$server->save();
$config = Yaml::parse(generateDefaultProxyConfiguration($server->fresh()));
$labels = $config['services']['traefik']['labels'];
expect($labels)->toContain('traefik.enable=false')
->not->toContain('traefik.enable=true')
->and(collect($labels)->contains(fn (string $label): bool => str_starts_with($label, 'traefik.http.routers.traefik.')))->toBeFalse();
});
it('preserves intentional self-router labels when updating an existing proxy configuration', function () {
$server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
$server->proxy->set('type', 'TRAEFIK');
$server->save();
$configuration = applyTrafficAnalyticsToProxyConfiguration($server->fresh(), <<<'YAML'
services:
traefik:
command: []
labels:
- traefik.enable=true
- traefik.http.routers.traefik.entrypoints=http
- traefik.http.routers.traefik.service=api@internal
- traefik.http.services.traefik.loadbalancer.server.port=8080
- coolify.managed=true
deploy:
labels:
- traefik.enable=true
- traefik.http.routers.traefik.entrypoints=http
- traefik.http.routers.traefik.service=api@internal
- traefik.http.services.traefik.loadbalancer.server.port=8080
- coolify.proxy=true
YAML);
$traefik = Yaml::parse($configuration)['services']['traefik'];
expect($traefik['labels'])->toContain(
'traefik.enable=true',
'traefik.http.routers.traefik.service=api@internal',
'coolify.managed=true',
)->and($traefik['deploy']['labels'])->toContain(
'traefik.enable=true',
'traefik.http.routers.traefik.service=api@internal',
'coolify.proxy=true',
);
});
it('does not add a traefik-logrotate sidecar when traffic analytics is disabled', function () {
$server = Server::factory()->create(['team_id' => $this->team->id, 'private_key_id' => $this->privateKey->id]);
$server->proxy->set('type', 'TRAEFIK');