Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enhance Mithril relay configuration #1089

Merged
merged 3 commits into from
Jul 26, 2023
Merged

Enhance Mithril relay configuration #1089

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
529d36c
Update relay configuration
jpraynaud Jul 25, 2023
bdc319f
Update relay configuration in infra
jpraynaud Jul 25, 2023
3b1bc8f
Update infra version
jpraynaud Jul 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions docs/root/manual/getting-started/run-signer-node.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -370,6 +370,35 @@ acl SSL_port port 443
# Allowed traffic
http_access allow relay_internal_ip aggregator_domain SSL_port
# Do not disclose block producer internal IP
forwarded_for delete
# Turn off via header
via off
# Deny request for original source of a request
follow_x_forwarded_for deny all
# Anonymize request headers
request_header_access Authorization allow all
request_header_access Proxy-Authorization allow all
request_header_access Cache-Control allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Connection allow all
request_header_access All deny all
# Disable cache
cache deny all
# Deny everything else
http_access deny all
EOF'
Expand All @@ -379,6 +408,7 @@ With this configuration, the proxy will:
- accept incoming traffic originating from the internal IP of the block-producing machine
- accept incoming traffic directed to the listening port of the proxy
- accept incoming HTTPS traffic proxied to `mithril.network` domain hosts
- anonymize completely the traffic and avoid disclosing any information about the block-producing machine
- deny all other traffic

Restart the service:
Expand Down
30 changes: 30 additions & 0 deletions docs/versioned_docs/version-maintained/manual/getting-started/run-signer-node.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -370,6 +370,35 @@ acl SSL_port port 443
# Allowed traffic
http_access allow relay_internal_ip aggregator_domain SSL_port
# Do not disclose block producer internal IP
forwarded_for delete
# Turn off via header
via off
# Deny request for original source of a request
follow_x_forwarded_for deny all
# Anonymize request headers
request_header_access Authorization allow all
request_header_access Proxy-Authorization allow all
request_header_access Cache-Control allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Connection allow all
request_header_access All deny all
# Disable cache
cache deny all
# Deny everything else
http_access deny all
EOF'
Expand All @@ -379,6 +408,7 @@ With this configuration, the proxy will:
- accept incoming traffic originating from the internal IP of the block-producing machine
- accept incoming traffic directed to the listening port of the proxy
- accept incoming HTTPS traffic proxied to `mithril.network` domain hosts
- anonymize completely the traffic and avoid disclosing any information about the block-producing machine
- deny all other traffic

Restart the service:
Expand Down
29 changes: 29 additions & 0 deletions mithril-infra/assets/docker/squid/squid.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,34 @@
# Listening port (port 3128 is recommended)
http_port 3128

# Do not disclose block producer internal IP
forwarded_for delete

# Turn off via header
via off

# Deny request for original source of a request
follow_x_forwarded_for deny all

# Anonymize request headers
request_header_access Authorization allow all
request_header_access Proxy-Authorization allow all
request_header_access Cache-Control allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Connection allow all
request_header_access All deny all

# Disable cache
cache deny all

# Allowed traffic
http_access allow all
2 changes: 1 addition & 1 deletion mithril-infra/assets/infra.version
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
0.1.7
0.1.8
Loading