gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(casan): establish assurance kernel and harden control plane

Browse Source
This commit is contained in:
thanhnv
2026-08-02 23:24:51 +07:00
parent 8b477f3800
commit 5745519126
51 changed files with 4076 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx/control-panel.conf
+12 -4
View File
@@ -43,6 +43,7 @@ server {
auth_request /oauth2/auth;
auth_request_set $auth_user $upstream_http_x_auth_request_user;
auth_request_set $auth_groups $upstream_http_x_auth_request_groups;
auth_request_set $auth_access_token $upstream_http_x_auth_request_access_token;
proxy_pass http://control-panel-api:3010/api/v1/;
proxy_http_version 1.1;
@@ -55,16 +56,23 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
# Overwrite browser-supplied identity headers. The API maps these IdP
# group claims through rbac-check.py map-claim.
proxy_set_header X-CASAN-Actor $auth_user;
proxy_set_header X-CASAN-Groups $auth_groups;
# Remove every caller-supplied identity assertion. The API derives
# actor/role/scope only after cryptographic JWT verification.
proxy_set_header X-CASAN-Actor "";
proxy_set_header X-CASAN-Groups "";
proxy_set_header X-CASAN-Role "";
proxy_set_header X-CASAN-Project "";
proxy_set_header X-CASAN-Tenant "";
proxy_set_header X-Forwarded-User "";
proxy_set_header X-Forwarded-Groups "";
proxy_set_header Authorization "Bearer $auth_access_token";
}
location = /healthz {
auth_request /oauth2/auth;
auth_request_set $auth_access_token $upstream_http_x_auth_request_access_token;
proxy_pass http://control-panel-api:3010/healthz;
proxy_set_header Authorization "Bearer $auth_access_token";
}
location / {