mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
immich: remove sol-auth
foto.scoutingmbg.nl goes straight to immich since the switch to Scouts Online, so the Apache with mod_auth_openid (OpenID 2) in front of it has no traffic left.
This commit is contained in:
Ruben Hensen committed
1 parent
6c6f473f63
commit
c3505bc8e3
5 files changed
+3
-201
No files matched your search
@@ -1,8 +1,8 @@
|
||||
# Retry a request when the backend drops a kept-alive connection just as
|
||||
# Envoy sends a request over it. Envoy answers that with a 503 (flag UC) and
|
||||
# does not retry by default; ingress-nginx did. It happens most behind the
|
||||
# Apache of sol-auth (immich), which recycles its processes after 30
|
||||
# connections, and broke immich's page loads.
|
||||
# does not retry by default; ingress-nginx did. It broke immich's page loads
|
||||
# behind the Apache of sol-auth (since removed), which recycled its
|
||||
# processes after 30 connections, and shows up less often elsewhere.
|
||||
apiVersion: gateway.envoyproxy.io/v1alpha1
|
||||
kind: BackendTrafficPolicy
|
||||
metadata:
|
||||
|
||||
@@ -1,132 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: httpd-conf
|
||||
data:
|
||||
httpd.conf: |
|
||||
ServerRoot "/usr/local/apache2"
|
||||
Listen 8002
|
||||
LoadModule mpm_event_module modules/mod_mpm_event.so
|
||||
LoadModule authn_core_module modules/mod_authn_core.so
|
||||
LoadModule authz_core_module modules/mod_authz_core.so
|
||||
LoadModule xml2enc_module modules/mod_xml2enc.so
|
||||
LoadModule proxy_html_module modules/mod_proxy_html.so
|
||||
LoadModule log_config_module modules/mod_log_config.so
|
||||
LoadModule headers_module modules/mod_headers.so
|
||||
LoadModule proxy_module modules/mod_proxy.so
|
||||
LoadModule proxy_http_module modules/mod_proxy_http.so
|
||||
LoadModule http2_module modules/mod_http2.so
|
||||
LoadModule proxy_http2_module modules/mod_proxy_http2.so
|
||||
LoadModule unixd_module modules/mod_unixd.so
|
||||
LoadModule authopenid_module /usr/lib/apache2/modules/mod_auth_openid.so
|
||||
LoadModule dir_module modules/mod_dir.so
|
||||
LoadModule alias_module modules/mod_alias.so
|
||||
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
|
||||
LoadModule rewrite_module modules/mod_rewrite.so
|
||||
|
||||
MaxConnectionsPerChild 30
|
||||
|
||||
<IfModule unixd_module>
|
||||
User www-data
|
||||
Group www-data
|
||||
</IfModule>
|
||||
|
||||
ServerAdmin webmaster@scoutingmbg.nl
|
||||
ServerName foto.scoutingmbg.nl
|
||||
|
||||
<Directory />
|
||||
AllowOverride none
|
||||
Require all denied
|
||||
</Directory>
|
||||
|
||||
DocumentRoot "/usr/local/apache2/htdocs"
|
||||
|
||||
<Directory "/usr/local/apache2/htdocs">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride None
|
||||
</Directory>
|
||||
|
||||
<Location />
|
||||
AuthType OpenID
|
||||
require valid-user
|
||||
|
||||
AuthOpenIDDBLocation /tmp/mod_auth_openid.db
|
||||
AuthOpenIDTrusted ^https://login.scouting.nl/.*$ ^https://login.scouting.nl/user/$
|
||||
AuthOpenIDUseCookie On
|
||||
AuthOpenIDCookieName open_id_session_id
|
||||
AuthOpenIDCookieLifespan 31536000
|
||||
AuthOpenIDServerName https://foto.scoutingmbg.nl
|
||||
AuthOpenIDSingleIdP https://login.scouting.nl/user/
|
||||
AuthOpenIDSecureCookie On
|
||||
</Location>
|
||||
|
||||
<Location "/_app">
|
||||
AuthType None
|
||||
Require all granted
|
||||
</Location>
|
||||
|
||||
AllowEncodedSlashes NoDecode
|
||||
ProxyPreserveHost Off
|
||||
|
||||
RewriteEngine on
|
||||
RewriteRule ^/?photos/?$ /sharing [R=301,L]
|
||||
|
||||
ProxyPass / http://helm-immich-server:2283/
|
||||
ProxyPassReverse / http://helm-immich-server:2283/
|
||||
RewriteEngine on
|
||||
RewriteCond %{HTTP:Upgrade} websocket [NC]
|
||||
RewriteCond %{HTTP:Connection} upgrade [NC]
|
||||
RewriteRule ^/?(.*) "ws://helm-immich-server:2283/$1" [P,L]
|
||||
|
||||
|
||||
# must be bigger than pingInterval (25s by default) + pingTimeout (20s by default)
|
||||
ProxyTimeout 60
|
||||
ProxyRequests off
|
||||
|
||||
Header always set Access-Control-Allow-Origin "*"
|
||||
Header always set Access-Control-Max-Age "1000"
|
||||
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
|
||||
|
||||
<IfModule dir_module>
|
||||
DirectoryIndex index.html
|
||||
</IfModule>
|
||||
|
||||
<Files ".ht*">
|
||||
Require all denied
|
||||
</Files>
|
||||
|
||||
ErrorLog /proc/self/fd/2
|
||||
LogLevel warn
|
||||
|
||||
<IfModule log_config_module>
|
||||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
|
||||
LogFormat "%h %l %u %t \"%r\" %>s %b" common
|
||||
<IfModule logio_module>
|
||||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
|
||||
</IfModule>
|
||||
CustomLog /proc/self/fd/1 common
|
||||
</IfModule>
|
||||
|
||||
<IfModule alias_module>
|
||||
ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
|
||||
</IfModule>
|
||||
<Directory "/usr/local/apache2/cgi-bin">
|
||||
AllowOverride None
|
||||
Options None
|
||||
Require all granted
|
||||
</Directory>
|
||||
<IfModule headers_module>
|
||||
RequestHeader unset Proxy early
|
||||
</IfModule>
|
||||
<IfModule mime_module>
|
||||
TypesConfig conf/mime.types
|
||||
AddType application/x-compress .Z
|
||||
AddType application/x-gzip .gz .tgz
|
||||
</IfModule>
|
||||
<IfModule proxy_html_module>
|
||||
Include conf/extra/proxy-html.conf
|
||||
</IfModule>
|
||||
<IfModule ssl_module>
|
||||
SSLRandomSeed startup builtin
|
||||
SSLRandomSeed connect builtin
|
||||
</IfModule>
|
||||
@@ -1,40 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sol-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sol-auth
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: sol-auth
|
||||
spec:
|
||||
# securityContext:
|
||||
# runAsUser: 1000
|
||||
# runAsGroup: 1000
|
||||
# fsGroup: 1000
|
||||
containers:
|
||||
- image: hebury/sol-auth:2.3
|
||||
name: sol-auth
|
||||
resources:
|
||||
requests:
|
||||
memory: "50Mi"
|
||||
limits:
|
||||
memory: "500Mi"
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8002
|
||||
hostPort: 8002
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: config-volume
|
||||
mountPath: /config/
|
||||
volumes:
|
||||
- name: config-volume
|
||||
configMap:
|
||||
name: httpd-conf
|
||||
restartPolicy: Always
|
||||
terminationGracePeriodSeconds: 5
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: sol-auth-svc
|
||||
spec:
|
||||
ports:
|
||||
- name: http-svc
|
||||
port: 8002
|
||||
targetPort: 8002
|
||||
selector:
|
||||
app: sol-auth
|
||||
status:
|
||||
loadBalancer: {}
|
||||
@@ -1,13 +0,0 @@
|
||||
FROM httpd:2.4-bullseye
|
||||
RUN apt-get update && \
|
||||
apt-get install --no-install-recommends -y \
|
||||
ca-certificates libapache2-mod-auth-openid
|
||||
RUN touch /tmp/mod_auth_openid.db && chown www-data /tmp/mod_auth_openid.db
|
||||
RUN mkdir /config
|
||||
RUN touch /config/httpd.conf
|
||||
RUN rm /usr/local/apache2/conf/httpd.conf
|
||||
RUN ln -s /config/httpd.conf /usr/local/apache2/conf/httpd.conf
|
||||
|
||||
# how to build: docker build . -t hebury/sol-auth:2.3
|
||||
# how to push: docker push hebury/sol-auth:2.3
|
||||
# do not remember how to build for arm atm.
|
||||
Reference in new issue
Block a user