DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
1.6 KiB
Bash
Executable File
43 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Measure what the nginx -> Traefik chain actually delivers to the application.
|
|
#
|
|
# docs/reverse-proxy-headers.md documents a single-hop nginx contract. The lab
|
|
# runs two hops, so the forwarded headers are measured rather than assumed.
|
|
# Run from anywhere that can resolve the lab hostnames.
|
|
#
|
|
# ./deploy/lab/scripts/measure-proxy-headers.sh
|
|
set -euo pipefail
|
|
|
|
HOST="${HOST:-app1.hyeonworks.com}"
|
|
URL="https://${HOST}/api/echo"
|
|
|
|
jqf() {
|
|
if command -v jq >/dev/null 2>&1; then jq "$@"; else python3 -m json.tool; fi
|
|
}
|
|
|
|
echo "=== 1. baseline: what the app sees for a normal request ==="
|
|
curl -s "$URL" | jqf '{
|
|
scheme, secure, serverName, serverPort, requestUrl, remoteAddr,
|
|
forwarded: .headers | with_entries(select(.key | startswith("x-forwarded") or . == "x-real-ip" or . == "forwarded"))
|
|
}' 2>/dev/null || curl -s "$URL"
|
|
|
|
echo
|
|
echo "=== 2. spoof test: client sends its own X-Forwarded-* ==="
|
|
echo " a trusted boundary must overwrite these, not append to them"
|
|
curl -s "$URL" \
|
|
-H 'X-Forwarded-For: 1.2.3.4' \
|
|
-H 'X-Forwarded-Proto: http' \
|
|
-H 'X-Forwarded-Host: evil.example.com' \
|
|
-H 'X-Real-IP: 1.2.3.4' \
|
|
| jqf '.headers | with_entries(select(.key | startswith("x-forwarded") or . == "x-real-ip"))' 2>/dev/null
|
|
|
|
echo
|
|
echo "=== 3. which pod answered (host nginx upstream distribution) ==="
|
|
for _ in 1 2 3 4; do
|
|
curl -s "$URL" | jqf -r '.headers["x-forwarded-server"] // "n/a"' 2>/dev/null
|
|
done
|
|
|
|
echo
|
|
echo "=== 4. plain HTTP is redirected, not proxied ==="
|
|
curl -s -o /dev/null -w ' http -> %{http_code} %{redirect_url}\n' "http://${HOST}/api/echo"
|