Skip to content

Commit 4e2759a

Browse files
jfrochejfroche
committed
WIP: envoy configuration
1 parent 4151a9e commit 4e2759a

File tree

11 files changed

+1883
-26
lines changed

11 files changed

+1883
-26
lines changed

‎nix/systemConfigs.nix

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,14 @@
11
{ self, inputs, ... }:
22
let
33
mkModules = system: [
4+
self.systemModules.envoy
45
({
56
services.nginx.enable = true;
67
nixpkgs.hostPlatform = system;
8+
+ supabase.services.envoy = {
9+
+ enable = true;
10+
+ enableTLS = true;
11+
+ };
712
})
813
];
914

‎nix/systemModules/default.nix

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
imports = [ ./tests ];
66
flake = {
77
systemModules = {
8-
envoy = ./envoy.nix;
8+
envoy = ./envoy;
99
};
1010
};
1111
}

‎nix/systemModules/envoy.nix

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎nix/systemModules/envoy/access_log.nix

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[
2+
{
3+
name = "envoy.access_loggers.stdout";
4+
filter = {
5+
status_code_filter = {
6+
comparison = {
7+
op = "GE";
8+
value = {
9+
default_value = 400;
10+
runtime_key = "unused";
11+
};
12+
};
13+
};
14+
};
15+
typed_config = {
16+
"@type" = "type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog";
17+
};
18+
}
19+
]

‎nix/systemModules/envoy/admin_api.nix

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
{
2+
config = {
3+
name = "admin_api";
4+
load_assignment = {
5+
cluster_name = "admin_api";
6+
endpoints = [
7+
{
8+
lb_endpoints = [
9+
{
10+
endpoint = {
11+
address = {
12+
socket_address = {
13+
address = "127.0.0.1";
14+
port_value = 8085;
15+
};
16+
};
17+
};
18+
}
19+
];
20+
}
21+
];
22+
};
23+
circuit_breakers = {
24+
thresholds = [
25+
{
26+
priority = "DEFAULT";
27+
max_connections = 10000;
28+
max_pending_requests = 10000;
29+
max_requests = 10000;
30+
retry_budget = {
31+
budget_percent = {
32+
value = 100;
33+
};
34+
min_retry_concurrency = 100;
35+
};
36+
}
37+
];
38+
};
39+
};
40+
routes = [
41+
{
42+
match = {
43+
prefix = "/admin/v1/";
44+
};
45+
request_headers_to_remove = [ "sb-opk" ];
46+
route = {
47+
cluster = "admin_api";
48+
prefix_rewrite = "/";
49+
timeout = "600s";
50+
};
51+
}
52+
{
53+
match = {
54+
prefix = "/customer/v1/privileged/";
55+
};
56+
request_headers_to_remove = [ "sb-opk" ];
57+
route = {
58+
cluster = "admin_api";
59+
prefix_rewrite = "/privileged/";
60+
};
61+
typed_per_filter_config = {
62+
"envoy.filters.http.rbac" = {
63+
"@type" = "type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute";
64+
rbac = {
65+
rules = {
66+
action = "DENY";
67+
policies = {
68+
basic_auth = {
69+
permissions = [ { any = true; } ];
70+
principals = [
71+
{
72+
header = {
73+
name = "authorization";
74+
invert_match = true;
75+
string_match = {
76+
exact = "Basic c2VydmljZV9yb2xlOnNlcnZpY2Vfa2V5";
77+
};
78+
treat_missing_header_as_empty = true;
79+
};
80+
}
81+
];
82+
};
83+
};
84+
};
85+
};
86+
};
87+
};
88+
}
89+
{
90+
match = {
91+
prefix = "/metrics/aggregated";
92+
};
93+
request_headers_to_remove = [ "sb-opk" ];
94+
route = {
95+
cluster = "admin_api";
96+
prefix_rewrite = "/supabase-internal/metrics";
97+
};
98+
typed_per_filter_config = {
99+
"envoy.filters.http.rbac" = {
100+
"@type" = "type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute";
101+
rbac = {
102+
rules = {
103+
action = "DENY";
104+
policies = {
105+
not_private_ip = {
106+
permissions = [ { any = true; } ];
107+
principals = [
108+
{
109+
not_id = {
110+
direct_remote_ip = {
111+
address_prefix = "10.0.0.0";
112+
prefix_len = 8;
113+
};
114+
};
115+
}
116+
];
117+
};
118+
};
119+
};
120+
};
121+
};
122+
};
123+
}
124+
];
125+
}

‎nix/systemModules/envoy/default.nix

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
{
2+
lib,
3+
nixosModulesPath,
4+
self,
5+
system,
6+
config,
7+
...
8+
}:
9+
let
10+
cfg = config.supabase.services.envoy;
11+
services = [ (import ./admin_api.nix) ];
12+
mkFilters = services: [
13+
{
14+
name = "envoy.filters.network.http_connection_manager";
15+
typed_config = {
16+
"@type" =
17+
"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager";
18+
access_log = import ./access_log.nix;
19+
generate_request_id = false;
20+
http_filters = import ./http_filters.nix;
21+
local_reply_config = import ./local_reply_config.nix;
22+
merge_slashes = true;
23+
route_config = import ./route_config.nix {
24+
inherit services;
25+
};
26+
stat_prefix = "ingress_http";
27+
};
28+
}
29+
];
30+
filters = mkFilters services;
31+
in
32+
{
33+
imports = map (path: nixosModulesPath + path) [
34+
"/services/networking/envoy.nix"
35+
];
36+
37+
options = {
38+
supabase.services.envoy = {
39+
enable = lib.mkEnableOption "Envoy proxy";
40+
enableTLS = lib.mkOption {
41+
type = lib.types.bool;
42+
default = true;
43+
description = ''
44+
Whether to enable TLS support in Envoy.
45+
If enabled, you must provide the TLS certificate and key files.
46+
'';
47+
};
48+
};
49+
};
50+
51+
config = lib.mkIf cfg.enable {
52+
services.envoy = {
53+
enable = true;
54+
package = self.packages.${system}.envoy-bin;
55+
# We don't validate the config at build time if TLS is enabled,
56+
# because it requires the TLS certificate and key files to be present.
57+
requireValidConfig = !cfg.enableTLS;
58+
settings = {
59+
node = {
60+
cluster = "cluster_0";
61+
id = "node_0";
62+
};
63+
stats_config = {
64+
stats_matcher = {
65+
reject_all = true;
66+
};
67+
};
68+
static_resources = {
69+
clusters = map (cluster: cluster.config) services;
70+
listeners = [
71+
{
72+
name = "http_listener";
73+
address = {
74+
socket_address = {
75+
address = "::";
76+
port_value = 80;
77+
ipv4_compat = true;
78+
};
79+
};
80+
filter_chains = {
81+
inherit filters;
82+
};
83+
}
84+
(lib.mkIf cfg.enableTLS {
85+
name = "https_listener";
86+
address = {
87+
socket_address = {
88+
address = "::";
89+
port_value = 443;
90+
ipv4_compat = true;
91+
};
92+
};
93+
filter_chains = {
94+
inherit filters;
95+
transport_socket = {
96+
name = "envoy.transport_sockets.tls";
97+
typed_config = {
98+
"@type" = "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext";
99+
common_tls_context = {
100+
tls_certificates = [
101+
{
102+
certificate_chain = {
103+
filename = "/etc/envoy/fullChain.pem";
104+
};
105+
private_key = {
106+
filename = "/etc/envoy/privKey.pem";
107+
};
108+
}
109+
];
110+
};
111+
};
112+
};
113+
};
114+
})
115+
];
116+
};
117+
};
118+
};
119+
systemd.services.envoy = {
120+
wantedBy = lib.mkForce [
121+
"system-manager.target"
122+
];
123+
};
124+
};
125+
}

0 commit comments

Comments
 (0)