rock/homelab-frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: initial commit of Go API gateway
CI / Test (push) Canceled after 0s
Details
CI / Vet (push) Canceled after 0s
Details
CI / Build (push) Canceled after 0s
Details
CI / Security (govulncheck) (push) Canceled after 0s
Details

Browse Source 
Baseline for the Kong replacement on api.riotpiao.com. Brings the working
tree under version control for the first time: gateway source, the task
board that drives the agent runs, test fixtures, and K8s manifests.

Anchor the gateway ignore rule to the repo root. Unanchored, "gateway"
also matched the cmd/gateway/ source directory, so the program entrypoint
was excluded from every commit.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
Story Crater Bot
2026-08-19 20:54:34 -07:00
co-authored by Claude Opus 5
commit 058f11cf2b
109 changed files with 8992 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tasks/1.5-header-hygiene.md
+27
View File
@@ -0,0 +1,27 @@
# 1.5 — Header hygiene (GREEN)
Phase: 1 — Proxy core
Stage: GREEN
Depends on: [1.1](1.1-reverse-proxy.md)
- [ ] Hop-by-hop headers are stripped from both the upstream request and the client response
- [ ] Headers named in a request's `Connection` header are also stripped, not just the fixed hop-by-hop list
- [ ] `X-Forwarded-For` appends the immediate peer to the nginx-supplied value rather than replacing or fabricating it
- [ ] `X-Forwarded-Proto` and `X-Forwarded-Host` are taken from the nginx-supplied values when present
- [ ] Client-supplied `X-Forwarded-*` values are not trusted when the request did not arrive from the trusted ingress peer
- [ ] End-to-end headers, including `Content-Type`, `Authorization` where the route requires it, and upstream response headers, pass through unchanged
- [ ] A test asserts the exact header set the stub upstream receives
ingress-nginx owns TLS and the edge, so it is the only source of truth for the
original scheme, host and client address. The gateway fabricating these would make
every upstream's view of the caller wrong, and would let a client spoof its own
source address by sending the header itself.
## Verify
```bash
go test ./internal/proxy/... -run TestHeaderHygiene -v
# expected: passes — stub upstream sees no Connection/Keep-Alive/TE/Upgrade/
# Proxy-Authorization headers, sees X-Forwarded-For ending in the nginx-supplied value
# plus the peer, and a spoofed X-Forwarded-Proto from an untrusted peer is discarded
```