swindon 0.7.8

An HTTP edge (frontend) server with smart websockets support 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153

===========
Auth & Auth
===========

Swindon currently supports authorization based on source ip address.
Ldap authorization is in the works.


Authorization Table
===================

.. versionchanged:: v0.7.0

Authorizer are flagged in ``routing`` table as ``@authorizer``.

.. code-block:: yaml

    routing:
      corporate.example.com: site @corporate-network
      corporate.example.com/admin: admin @super-admins

Everything is allowed by default (because it's a web server, it's here
to publish things). But you can override it by setting ``default`` authorizer,
which applies implicitly.

Note that unlike handlers, authorizers are inherited across paths and
subdomains unless overrriden:

.. code-block:: yaml

    routing:
        "*.example.org": site @auth1
        "example.org": main-site
        "example.org/admin": admin @admin
        "example.org/admin/something": something
        "example.org/otherthing": otherthing

Is equivalent to:

.. code-block:: yaml

    routing:
        "*.example.org": site @auth1
        "example.org": main-site @auth1
        "example.org/admin": admin @admin
        "example.org/admin/something": something @admin
        "example.org/otherthing": otherthing @auth1

Also note that exact domain is more specific star domain:

.. code-block:: yaml

    routing:
        "*.example.org": handler
        "example.org": handler @auth

Here the ``auth`` is not applied to ``somethign.example.org``, but in this
case:

.. code-block:: yaml

    routing:
        "*.example.org": handler @auth

The authorization (as well as handler) is applied both for the main site
``example.org`` and all the subdomains.


The routing here is the same as in normal routing table, in particular:
``corporate-network`` limit is not obeyed on ``corporate.example.com/admin``.


Authorizers
===========

Authorizers section contains named authorizers. For example:

.. code-block:: yaml

   authorizers:
     corporate-network: !SourceIp
        allowed-network: corporate-ip-group
        forwarded-ip-header: X-Remote-Ip
        accept-forwarded-headers-from: frontend-servers

Note by default there is a hidden ``default`` authorizer:


.. code-block:: yaml

    authorizers:
      default: !AllowAll

You can override it and it will be used for anything having no authorizer:

.. code-block:: yaml

    authorizers:
      default: !SourceIp
        allowed-network: localhost


AllowAll Authorizer
====================

This authorizer allows everybody access the page. It's here to be used
as default one, but maybe specified explicitly if default is overriden or
just for convenience.

.. index:: pair: !AllowAll; Authorizers

.. code-block:: yaml

     public-data: !AllowAll


Source Ip Authorizer
====================

.. index:: pair: !SourceIp; Authorizers

Source IP authorizer looks like this:

.. code-block:: yaml

     corporate-network: !SourceIp
        allowed-network: corporate-ip-group
        forwarded-ip-header: X-Remote-Ip
        accept-forwarded-headers-from: frontend-servers


Settings:

.. opt:: allowed-network

   (required) Name of the network to allow access from. The network is got
   from ``networks`` section.

.. opt:: accept-forwarded-headers-from

   (optional) Sometimes clients do not connect to this instance of swindon
   directly but are proxied from another instance. This means that real IP
   address where swindon receives a connection from is upstream server rather
   than real client. In this case, real client IP address is transferred in
   header specified by ``forwarded-ip-header``.

   To prevent faking the IP address we accept this header only from allowed
   networks specified in this setting.

.. opt:: forwarded-ip-header

   (optional) Name of the header where to read IP address from if the source
   address is within the ``accept-forwarded-headers-from`` network.