Skip to content

Commit

Permalink
Dedicated reverse proxy documentation (#159)
Browse files Browse the repository at this point in the history
* Dedicated reverse proxy documentation

Related to navidrome/navidrome#2558

* Move security stuff back to the security page

The security considerations are already centralized in a single page, it should
not be changed for just one aspect of Navidrome.

I also changed the HPP vulnerability section to make it less scary, as this is
a pretty normal concern for reverse proxy authentication, and hopefully
navidrome already plays nice with this. It is also not very usefull to mention
hardening by stripping other credential sources without listing the sources
(and I don't get exactly how all of them work yet).

* Move subsonic for the navidrome webapp to its own section

* Add traefik example

* Add Caddy example with subsonic response rewriting

* Rephrasing, moving info around

* Add links in the main options page

* Clarifications for the Navidrome Web App

* Update documentation for explicit socket auth config

Related to navidrome/navidrome#3046 and navidrome/navidrome#3062.

* Fix words in the wrong order

* Clarify use-case for ReverseProxyWhitelist option

I have seen several people on reddit using this option with a
non-authenticating proxy setup, mostly when the proxy is only used to route
traffic or handle SSL termination, which can easily lead to an insecure setup
(e.g. the proxy might not remove by default the user header set by a malicious
client).

The option's name is a bit unfortunate, as it suggests that it should be used
for all proxy setups, while it is actually usefull only for authenticating
proxies.

---------

Co-authored-by: Deluan <[email protected]>
  • Loading branch information
crazygolem and deluan authored Dec 21, 2024
1 parent 4b66645 commit c39ed94
Show file tree
Hide file tree
Showing 3 changed files with 269 additions and 99 deletions.
Loading

0 comments on commit c39ed94

Please sign in to comment.