gorkem-bwl
3b03850a3b
Review found that the proxy path silently dropped ignoreTlsErrors. rejectUnauthorized was passed to the HttpsProxyAgent constructor, where it governs the socket to the proxy rather than the tunnelled handshake with the target. Verified directly: the value lands in connectOpts, while the target handshake reads got's per-request https options, which were unset and so defaulted to strict. The consequence was worse than a no-op. A monitor with ignoreTlsErrors against a self-signed endpoint works today; configuring a proxy would have made it fail verification, flip to down and fire a false incident with notifications. Stating the option per request fixes it, and the agent cache keeps its TLS split so a relaxed agent is never shared with a strict monitor. Also from review: - A fully-invalid PROXY_MONITOR_TYPES disabled proxying entirely, which in a restricted-egress deployment would take every HTTP monitor down at once — the exact failure the parser was meant to prevent. It now falls back to the defaults and warns loudly. "none" remains the way to disable deliberately. - The "none" sentinel only matched when it was the sole entry, so "none,http" half-enabled proxying. It is now honoured wherever it appears. - "unknown" is a real MonitorType but never a deliberate choice, so it is reported as a typo rather than as an unproxyable type. - Dropped the unused warning field from ProxyResolution. - Documented that lowercase proxy variables are honoured and take precedence, which matters on base images that already set them. Adds 10 tests, including the request-level TLS assertions the previous suite lacked. Verified by reverting the fix: both TLS tests fail without it.
56 lines
1.9 KiB
Bash
56 lines
1.9 KiB
Bash
# ==============================================
|
|
# Checkmate Server Configuration
|
|
# ==============================================
|
|
# Copy this file to .env and fill in your values
|
|
|
|
# Server Configuration
|
|
# --------------------
|
|
NODE_ENV=development
|
|
LOG_LEVEL=debug
|
|
|
|
# Database
|
|
# --------
|
|
DB_CONNECTION_STRING=mongodb://localhost:27017/uptime_db
|
|
QUEUE_MODE="primary"
|
|
QUEUE_PRIMARY_PROCESSES="true"
|
|
|
|
# JWT Authentication
|
|
# ------------------
|
|
JWT_SECRET=my_secret
|
|
TOKEN_TTL=99d
|
|
|
|
# Client Configuration
|
|
# --------------------
|
|
CLIENT_HOST=http://localhost:5173
|
|
|
|
# Optional Configuration
|
|
# ----------------------
|
|
ORIGIN=localhost
|
|
|
|
# Feature Flags
|
|
# -------------
|
|
# Set to "false" to disable the selectable theme feature on status pages.
|
|
# When disabled, all status pages render with the default "refined" theme.
|
|
STATUS_PAGE_THEMES_ENABLED=true
|
|
|
|
# Outbound Proxy
|
|
# --------------
|
|
# Route monitor checks through an HTTP proxy, for deployments whose egress is
|
|
# restricted. Credentials may be embedded: http://user:pass@proxy:3128
|
|
# The lowercase forms (http_proxy, https_proxy, no_proxy) are also honoured and
|
|
# take precedence over these, which matters on base images that already set them.
|
|
# HTTP_PROXY=http://proxy.corp.example:3128
|
|
# HTTPS_PROXY=http://proxy.corp.example:3128
|
|
#
|
|
# Hosts that must be reached directly. Supports wildcards and host lists, with
|
|
# the same semantics curl uses.
|
|
# NO_PROXY=localhost,127.0.0.1,*.internal,10.0.0.5
|
|
#
|
|
# Monitor types to route through the proxy, comma-separated. Defaults to
|
|
# "http,pagespeed". Infrastructure ("hardware") monitors are excluded by
|
|
# default because Capture agents normally sit on the internal network — add it
|
|
# here if yours are reachable only through the proxy. Use "none" to disable
|
|
# proxying without unsetting the variables above. Types that open raw sockets
|
|
# (ping, port, docker, grpc, websocket, dns, game) cannot be proxied.
|
|
# PROXY_MONITOR_TYPES=http,pagespeed
|