agw/overleaf-cep
1
0
Fork 0
mirror of https://github.com/yu-i-i/overleaf-cep.git synced 2026-11-12 13:13:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Git-bridge: nginx: only expose git-bridge project endpoints under /git/ (#260)

Browse Source 
The /git/ location proxied every path to git-bridge, which made its
internal routes reachable from the internet: /status, /health_check,
/metrics, /diags, /api/<project>/<key>/postback and the unauthenticated
DELETE /api/projects/<project id> used by web on project expiry.

Forward only /git/<24 hex project id>[.git]/... (the git smart-HTTP
endpoints, which git-bridge protects with Oauth2Filter) and return 404
for everything else under /git/. Web talks to git-bridge directly
(GIT_BRIDGE_HOST:GIT_BRIDGE_PORT), not through nginx, so it is not
affected.
This commit is contained in:
Tobias Hallmen
2026-11-04 14:10:09 +01:00
committed by GitHub
parent f1b9809f35
commit a683019198
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server-ce/nginx/overleaf.conf.template
+8 -1
View File
@@ -21,7 +21,14 @@ server {
proxy_send_timeout 10m; proxy_send_timeout 10m;
} }
location ^~ /git/ { # Only the git smart-HTTP endpoints of a project (/git/<project id>[.git]/...) are
# public. git-bridge's other routes (/status, /health_check, /metrics, /diags,
# /api/...) are meant for the internal network only and must not be reachable.
location /git/ {
return 404;
}
location ~ "^/git/[0-9a-f]{24}(\.git)?(/|$)" {
resolver_timeout 2s; resolver_timeout 2s;
resolver 127.0.0.11 valid=10s; resolver 127.0.0.11 valid=10s;
set $git_upstream http://${GIT_BRIDGE_HOST}:${GIT_BRIDGE_PORT}; set $git_upstream http://${GIT_BRIDGE_HOST}:${GIT_BRIDGE_PORT};