diff --git a/.env.example b/.env.example index 08c0845..bf4b662 100644 --- a/.env.example +++ b/.env.example @@ -1,4 +1,5 @@ CLOUDFLARE_ACCOUNT_ID="" CLOUDFLARE_API_KEY="" CLOUDFLARE_EMAIL="" -ENV="" \ No newline at end of file +ENV="" +MGMT_PORT="5003" \ No newline at end of file diff --git a/cftunnels-service/Dockerfile b/cftunnels-service/Dockerfile index e6820da..8a64519 100644 --- a/cftunnels-service/Dockerfile +++ b/cftunnels-service/Dockerfile @@ -9,4 +9,5 @@ RUN ./gradlew :cftunnels-service:bootJar FROM openjdk:17-jdk-slim COPY --from=build /app/cftunnels-service/build/libs/*.jar app.jar +EXPOSE 8080 8081 ENTRYPOINT ["java", "-jar", "/app.jar"] diff --git a/cftunnels-service/build.gradle b/cftunnels-service/build.gradle index a17855f..89b8e60 100644 --- a/cftunnels-service/build.gradle +++ b/cftunnels-service/build.gradle @@ -7,6 +7,7 @@ dependencies { implementation 'org.springframework.boot:spring-boot-starter-oauth2-client' implementation 'org.springframework.boot:spring-boot-starter-data-jpa' implementation 'org.springframework.boot:spring-boot-starter-security' + implementation 'org.springframework.boot:spring-boot-starter-actuator' implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.5' implementation 'org.hibernate.validator:hibernate-validator' diff --git a/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/ActuatorSecurityConfig.java b/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/ActuatorSecurityConfig.java new file mode 100644 index 0000000..727d819 --- /dev/null +++ b/cftunnels-service/src/main/java/com/hithomelabs/cftunnels/Config/Security/ActuatorSecurityConfig.java @@ -0,0 +1,32 @@ +package com.hithomelabs.cftunnels.Config.Security; + +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.core.annotation.Order; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.web.SecurityFilterChain; + +/** + * Security configuration for Spring Boot Actuator endpoints. + * + * This configuration permits unauthenticated access to /actuator/health and /actuator/info + * endpoints, enabling health monitoring by Uptime Kuma without requiring OIDC authentication. + * All other actuator endpoints remain protected and require authentication. + */ +@Configuration +public class ActuatorSecurityConfig { + + @Bean + @Order(1) + public SecurityFilterChain actuatorSecurityChain(HttpSecurity http) throws Exception { + http + .securityMatcher("/actuator/**") + .authorizeHttpRequests(auth -> auth + .requestMatchers("/actuator/health", "/actuator/info").permitAll() + .anyRequest().authenticated() + ) + .csrf(csrf -> csrf.disable()); + + return http.build(); + } +} diff --git a/cftunnels-service/src/main/resources/application-ci.properties b/cftunnels-service/src/main/resources/application-ci.properties index 9d7d1f0..6bc5811 100644 --- a/cftunnels-service/src/main/resources/application-ci.properties +++ b/cftunnels-service/src/main/resources/application-ci.properties @@ -4,4 +4,8 @@ spring.datasource.url=jdbc:h2:mem:testdb spring.datasource.driver-class-name=org.h2.Driver spring.datasource.username=sa spring.datasource.password= -spring.jpa.hibernate.ddl-auto=none \ No newline at end of file +spring.jpa.hibernate.ddl-auto=none + +# Actuator configuration for CI +management.endpoints.web.exposure.include=health,info +management.endpoint.health.show-details=never \ No newline at end of file diff --git a/cftunnels-service/src/main/resources/application-local.properties b/cftunnels-service/src/main/resources/application-local.properties index 60ec5d5..a30006c 100644 --- a/cftunnels-service/src/main/resources/application-local.properties +++ b/cftunnels-service/src/main/resources/application-local.properties @@ -1,8 +1,10 @@ api.baseUrl=http://localhost:8080 -management.health.db.enabled=true -management.endpoints.web.exposure.include=health +# Actuator configuration for local development +management.server.port=8081 +management.endpoints.web.exposure.include=health,info management.endpoint.health.show-details=always +management.health.db.enabled=true logging.level.org.hibernate.SQL=DEBUG debug=true diff --git a/cftunnels-service/src/main/resources/application-prod.properties b/cftunnels-service/src/main/resources/application-prod.properties index 7522890..041fee2 100644 --- a/cftunnels-service/src/main/resources/application-prod.properties +++ b/cftunnels-service/src/main/resources/application-prod.properties @@ -9,4 +9,8 @@ spring.datasource.driver-class-name=org.postgresql.Driver # JPA Configuration spring.jpa.hibernate.ddl-auto=create-drop spring.jpa.show-sql=false -spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect \ No newline at end of file +spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect + +# Actuator configuration +management.endpoints.web.exposure.include=health,info +management.endpoint.health.show-details=when-authorized \ No newline at end of file diff --git a/cftunnels-service/src/main/resources/application-test.properties b/cftunnels-service/src/main/resources/application-test.properties index b257503..bd8b6b6 100644 --- a/cftunnels-service/src/main/resources/application-test.properties +++ b/cftunnels-service/src/main/resources/application-test.properties @@ -10,3 +10,7 @@ spring.datasource.driver-class-name=org.postgresql.Driver spring.jpa.hibernate.ddl-auto=update spring.jpa.show-sql=true spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect + +# Actuator configuration +management.endpoints.web.exposure.include=health,info +management.endpoint.health.show-details=when-authorized diff --git a/cftunnels-service/src/main/resources/application.properties b/cftunnels-service/src/main/resources/application.properties index eb4ab8b..a9c4948 100644 --- a/cftunnels-service/src/main/resources/application.properties +++ b/cftunnels-service/src/main/resources/application.properties @@ -35,4 +35,9 @@ spring.jpa.hibernate.ddl-auto=update spring.jpa.show-sql=true spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect -spring.jpa.open-in-view=false \ No newline at end of file +spring.jpa.open-in-view=false + +# Actuator configuration - management port and exposed endpoints +management.server.port=8081 +management.endpoints.web.exposure.include=health,info +management.endpoint.health.show-details=when-authorized \ No newline at end of file diff --git a/docker-compose.yaml b/docker-compose.yaml index 41ddd87..7300575 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -4,6 +4,7 @@ services: container_name: cftunnels_${ENV} ports: - ${HOST_PORT}:8080 + - ${MGMT_PORT:-5003}:8081 environment: - CLOUDFLARE_ACCOUNT_ID=${CLOUDFLARE_ACCOUNT_ID} - CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY}