package application import ( "context" "crypto/tls" "net/http" "net/http/httputil" "net/url" "time" "github.com/prometheus/client_golang/prometheus" "goauthentik.io/internal/outpost/ak" "goauthentik.io/internal/outpost/proxyv2/metrics" "goauthentik.io/internal/outpost/proxyv2/templates" "goauthentik.io/internal/utils/web" ) func (a *Application) getUpstreamTransport() http.RoundTripper { return &http.Transport{ TLSClientConfig: &tls.Config{InsecureSkipVerify: !*a.proxyConfig.InternalHostSslValidation}, } } func (a *Application) configureProxy() error { // Reverse proxy to the application server u, err := url.Parse(*a.proxyConfig.InternalHost) if err != nil { return err } rp := &httputil.ReverseProxy{Director: a.proxyModifyRequest(u)} rp.Transport = ak.NewTracingTransport(context.TODO(), a.getUpstreamTransport()) rp.ErrorHandler = NewProxyErrorHandler(templates.GetTemplates()) rp.ModifyResponse = a.proxyModifyResponse a.mux.PathPrefix("/").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { claims, err := a.getClaims(r) if claims == nil && a.IsAllowlisted(r) { a.log.Trace("path can be accessed without authentication") } else if claims == nil && err != nil { a.redirectToStart(rw, r) return } else { a.addHeaders(r, claims) } before := time.Now() rp.ServeHTTP(rw, r) after := time.Since(before) user := "" if claims != nil { user = claims.Email } metrics.UpstreamTiming.With(prometheus.Labels{ "outpost_name": a.outpostName, "upstream_host": u.String(), "scheme": r.URL.Scheme, "method": r.Method, "path": r.URL.Path, "host": web.GetHost(r), "user": user, }).Observe(float64(after)) }) return nil } func (a *Application) proxyModifyRequest(u *url.URL) func(req *http.Request) { return func(req *http.Request) { req.URL.Scheme = u.Scheme req.URL.Host = u.Host } } func (a *Application) proxyModifyResponse(res *http.Response) error { return nil }