From 7dffff17c75019639751c6dbfac30320b6b61dc5 Mon Sep 17 00:00:00 2001 From: JiriUhlir <149317995+JiriUhlir@users.noreply.github.com> Date: Mon, 8 Jun 2026 11:38:57 +0200 Subject: [PATCH] =?UTF-8?q?Odstranil=20jsem=20hardcoded=20IP=20fallbacky?= =?UTF-8?q?=20z=20port=C3=A1lov=C3=A9ho=20Python=20k=C3=B3du:=20DEFAULT=5F?= =?UTF-8?q?APPFACTORY=5FHOST=20=3D=20"192.168.66.130"=20je=20pry=C4=8D=20z?= =?UTF-8?q?=20config.py=20(line=2010).=20DEFAULT=5FGITEA=5FURL=20=3D=20"ht?= =?UTF-8?q?tp://192.168.66.130:3000"=20je=20pry=C4=8D=20z=20auth.py=20(lin?= =?UTF-8?q?e=2024).=20Dopln=C4=9Bn=C3=A9=20chov=C3=A1n=C3=AD:=20APPFACTORY?= =?UTF-8?q?=5FHOST=20se=20odvozuje=20p=C5=99es=20helper:=20env=20APPFACTOR?= =?UTF-8?q?Y=5FHOST,=20potom=20APPFACTORY=5FPORTAL=5FPUBLIC=5FURL,=20potom?= =?UTF-8?q?=20request=20host.=20Gitea=20browser=20redirect=20pou=C5=BE?= =?UTF-8?q?=C3=ADv=C3=A1=20jen=20explicitn=C3=AD=20ve=C5=99ejnou=20URL=20z?= =?UTF-8?q?=20GITEA=5FURL=20nebo=20GITEA=5FROOT=5FURL.=20Server-side=20Git?= =?UTF-8?q?ea=20token/userinfo=20requesty=20pou=C5=BE=C3=ADvaj=C3=AD=20GIT?= =?UTF-8?q?EA=5FURL,=20potom=20GITEA=5FROOT=5FURL,=20jinak=20intern=C3=AD?= =?UTF-8?q?=20Docker=20URL=20http://appfactory-gitea:3000.=20Gitea=20login?= =?UTF-8?q?=20tla=C4=8D=C3=ADtko=20se=20zobraz=C3=AD=20jen=20p=C5=99i=20ko?= =?UTF-8?q?mpletn=C3=AD=20konfiguraci:=20public=20URL,=20client=20id,=20cl?= =?UTF-8?q?ient=20secret=20a=20redirect=20URI.=20P=C5=99=C3=ADm=C3=BD=20Gi?= =?UTF-8?q?tea=20login=20bez=20kompletn=C3=AD=20konfigurace=20vrac=C3=AD?= =?UTF-8?q?=20=C4=8Ditelnou=20chybu.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/config.py | 43 ++++++++++++++++++++++++++++++++++++++++++- app/routes/apps.py | 13 +++++++------ app/routes/auth.py | 38 +++++++++++++++++++++++++------------- 3 files changed, 74 insertions(+), 20 deletions(-) diff --git a/app/config.py b/app/config.py index e93bd6b..d5b2a85 100644 --- a/app/config.py +++ b/app/config.py @@ -8,7 +8,7 @@ APPFACTORY_ENV = "/opt/appfactory/config/appfactory.env" DEFAULT_BACKUP_DIR = "/opt/appfactory/backups" DEFAULT_GITEA_ORG = "appfactory" -DEFAULT_APPFACTORY_HOST = "192.168.66.130" +INTERNAL_GITEA_URL = "http://appfactory-gitea:3000" PORTAL_PREFIX = "/portal" @@ -58,6 +58,47 @@ def get_google_redirect_uri() -> str: return "" +def get_gitea_public_url() -> str: + return (read_env_value("GITEA_URL", "") or read_env_value("GITEA_ROOT_URL", "")).rstrip("/") + + +def get_gitea_server_url() -> str: + return get_gitea_public_url() or INTERNAL_GITEA_URL + + +def get_gitea_redirect_uri() -> str: + redirect_uri = read_env_value("GITEA_OAUTH_REDIRECT_URI", "").strip() + if redirect_uri: + return redirect_uri + + public_url = get_portal_public_url() + if public_url: + return f"{public_url}/auth/gitea/callback" + + return "" + + +def is_gitea_oauth_button_enabled() -> bool: + return bool( + get_gitea_public_url() + and read_env_value("GITEA_OAUTH_CLIENT_ID", "") + and read_env_value("GITEA_OAUTH_CLIENT_SECRET", "") + and get_gitea_redirect_uri() + ) + + +def get_appfactory_host(request_host: str = "") -> str: + configured_host = read_env_value("APPFACTORY_HOST", "").strip() + if configured_host: + return configured_host + + public_url = get_portal_public_url() + if public_url: + return public_url.split("://", 1)[-1].split("/", 1)[0].split(":", 1)[0] + + return (request_host or "").split(":", 1)[0] + + def get_auth_domain_readiness() -> dict[str, bool]: google_enabled = read_env_bool("GOOGLE_OAUTH_ENABLED") google_client_id = read_env_value("GOOGLE_CLIENT_ID", "") diff --git a/app/routes/apps.py b/app/routes/apps.py index 58f8be5..35d2dc8 100644 --- a/app/routes/apps.py +++ b/app/routes/apps.py @@ -7,11 +7,12 @@ from fastapi.responses import HTMLResponse, RedirectResponse from ..auth import require_user from ..config import ( - DEFAULT_APPFACTORY_HOST, DEFAULT_GITEA_ORG, DELETE_APP_SCRIPT, DEPLOY_SCRIPT, GENERATE_COMPOSE_SCRIPT, + get_appfactory_host, + get_gitea_public_url, read_env_value, ) from ..db.apps import ( @@ -206,9 +207,9 @@ def apps_page( offset = (page_number - 1) * DEFAULT_PAGE_SIZE apps = apps[offset : offset + DEFAULT_PAGE_SIZE] - gitea_url = read_env_value("GITEA_URL", "") + gitea_url = get_gitea_public_url() gitea_org = read_env_value("GITEA_ORG", DEFAULT_GITEA_ORG) - host = read_env_value("APPFACTORY_HOST", DEFAULT_APPFACTORY_HOST) + host = get_appfactory_host(request.url.hostname or "") rows = "" @@ -226,8 +227,8 @@ def apps_page( memory_label = memory or "výchozí" cpus_label = cpus or "výchozí" - http_clone = html.escape(f"git clone {gitea_url}/{gitea_org}/{app_id}.git") - ssh_clone = html.escape(f"git clone ssh://git@{host}:2222/{gitea_org}/{app_id}.git") + http_clone = html.escape(f"git clone {gitea_url}/{gitea_org}/{app_id}.git") if gitea_url else "" + ssh_clone = html.escape(f"git clone ssh://git@{host}:2222/{gitea_org}/{app_id}.git") if host else "" rows += f""" @@ -970,7 +971,7 @@ def create_app( user=user, ) - gitea_url = read_env_value("GITEA_URL", "").rstrip("/") + gitea_url = get_gitea_public_url() gitea_org = read_env_value("GITEA_ORG", DEFAULT_GITEA_ORG) repository_url = f"{gitea_url}/{gitea_org}/{app_id}.git" if gitea_url else None owner_value = clean_optional(owner) or user.get("display_name") or user.get("username") or None diff --git a/app/routes/auth.py b/app/routes/auth.py index b318a0c..b903108 100644 --- a/app/routes/auth.py +++ b/app/routes/auth.py @@ -10,12 +10,19 @@ from fastapi import APIRouter, Form, Request from fastapi.responses import HTMLResponse, RedirectResponse from app.auth import authenticate_user, current_user, find_or_create_oauth_user -from app.config import get_google_redirect_uri, is_google_oauth_button_enabled, read_env_value +from app.config import ( + get_gitea_public_url, + get_gitea_redirect_uri, + get_gitea_server_url, + get_google_redirect_uri, + is_gitea_oauth_button_enabled, + is_google_oauth_button_enabled, + read_env_value, +) from app.db.audit import log_audit_event from app.templates.layout import page router = APIRouter() -DEFAULT_GITEA_URL = "http://192.168.66.130:3000" GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth" GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token" GOOGLE_USERINFO_URL = "https://openidconnect.googleapis.com/v1/userinfo" @@ -54,12 +61,13 @@ def gitea_login(request: Request): if current_user(request): return RedirectResponse(url="/portal/operations", status_code=303) - gitea_url = read_env_value("GITEA_URL", DEFAULT_GITEA_URL).rstrip("/") + gitea_url = get_gitea_public_url() client_id = read_env_value("GITEA_OAUTH_CLIENT_ID", "") - redirect_uri = read_env_value("GITEA_OAUTH_REDIRECT_URI", "") - if not client_id or not redirect_uri: + client_secret = read_env_value("GITEA_OAUTH_CLIENT_SECRET", "") + redirect_uri = get_gitea_redirect_uri() + if not gitea_url or not client_id or not client_secret or not redirect_uri: _log_gitea_failure("missing_oauth_config") - return _render_login("Přihlášení přes Gitea není správně nastavené.") + return _render_login("Gitea login is not fully configured.") state = secrets.token_urlsafe(32) request.session["gitea_oauth_state"] = state @@ -227,10 +235,10 @@ def logout(request: Request): def _exchange_gitea_code(code: str) -> str: - gitea_url = read_env_value("GITEA_URL", DEFAULT_GITEA_URL).rstrip("/") + gitea_url = get_gitea_server_url() client_id = read_env_value("GITEA_OAUTH_CLIENT_ID", "") client_secret = read_env_value("GITEA_OAUTH_CLIENT_SECRET", "") - redirect_uri = read_env_value("GITEA_OAUTH_REDIRECT_URI", "") + redirect_uri = get_gitea_redirect_uri() if not client_id or not client_secret or not redirect_uri: raise RuntimeError("Missing Gitea OAuth configuration") @@ -260,7 +268,7 @@ def _exchange_gitea_code(code: str) -> str: def _fetch_gitea_user(access_token: str) -> dict: - gitea_url = read_env_value("GITEA_URL", DEFAULT_GITEA_URL).rstrip("/") + gitea_url = get_gitea_server_url() request = UrlRequest( f"{gitea_url}/api/v1/user", headers={ @@ -350,6 +358,13 @@ def _render_login(error: str | None = None) -> str: error_html = "" if error: error_html = f'

{html.escape(error)}

' + gitea_login_html = "" + if is_gitea_oauth_button_enabled(): + gitea_login_html = """ +

+ Sign in with Gitea +

+ """ google_login_html = "" if is_google_oauth_button_enabled(): google_login_html = """ @@ -365,10 +380,7 @@ def _render_login(error: str | None = None) -> str:

CSBot Services Portal

Doporučené přihlášení je přes Gitea. Lokální účet slouží pouze jako nouzový administrátorský přístup.

{error_html} - -

- Přihlásit přes Gitea -

+ {gitea_login_html} {google_login_html}