Repository navigation
fix(compose): serve TLS ingest via dfe-proxy and mount file input - #401
Merged
Merged
Conversation
An external pusher could not verify a deployment CA against the receiver on Docker because /ingest answers plain http only. A `sources.file` source had no files to read because dfe-fetcher mounts only its spool and cursor volumes. `DFE_RECEIVER_HTTPS_PORT` publishes a TLS listener on dfe-proxy (container port 8443). It serves the console's certificate with the console's TLS settings. It forwards to dfe-receiver:8080 on the compose network. The listener exists only under `DFE_PROXY_TLS=true`. It binds `DFE_INGRESS_BIND_HOST`. With TLS off, `make` refuses `DFE_RECEIVER_HTTPS_PORT`. In-network callers keep posting plain http. `DFE_FETCHER_INPUT_DIR` mounts a host directory read only at `/mnt/input` in dfe-fetcher. A missing path stops startup. With neither key set the stack renders as before.
The receiver sees dfe-proxy as the TCP peer on the HTTPS ingest port. Its `ip_filter` cannot tell pushers apart there. `server.trusted_proxies` has no environment variable name when the receiver runs from a config file. The docs explain that fetcher dump sources use `paths`. Tail sources use `include`. The directory must be readable by uid 1000. An unreadable directory causes a failure when the source runs. The route timeout comment in envoy.tls.yaml describes only what the timeout limits.
The receiver runs from a config file on Docker, so it reads only a fixed set of flat env keys. `DFE_RECEIVER_FLOW_ENABLED` is one of them. The documented `DFE_RECEIVER_SYSLOG__ENABLED` and `DFE_RECEIVER_GRPC__ENABLED` keys have no effect. The docs now say to change the engine config and run `make apply` for syslog and the Vector gRPC listener. `make demo` turns syslog on this way. The docs still explain why syslog needs `accept_unauthenticated`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docker installs could not take TLS ingest from external pushers. File sources had no input mount.
DFE_RECEIVER_HTTPS_PORTpublishes a TLS listener on dfe-proxy (container port 8443) that forwards to dfe-receiver:8080.makerejectsDFE_RECEIVER_HTTPS_PORTwithoutDFE_PROXY_TLS=true.DFE_FETCHER_INPUT_DIRmounts a host directory read only at/mnt/inputin dfe-fetcher.Done when a pusher that trusts
ca.crtcan POST to the published port and asources.filesource can read from/mnt/input.On the pinned Envoy, a 7.9 MB TLS POST reached a stand-in receiver. Plain http to the port got no reply.