particle-os/debian-forge-composer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

worker/api: add domain allowlist

Browse source 
There's need for control which certificates to accept. This commit introduces
the domain allowlist. The basic idea is that composer accepts only
certificates issued to domain names specified in osbuild-composer config file.
It allows multiple domains to be specified.

To accept just w1.osbuild.org and w2.osbuild.org, use:
domain_allowlist = [ "w1.osbuild.org", "w2.osbuild.org" ]
This commit is contained in:
Ondřej Budai 2020-09-21 09:26:24 +02:00 • committed by Tom Gundersen
parent 03768e5f18
commit 9a26d077db
2 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
test/image-tests/osbuild-composer.toml
View file

@ -1,3 +1,6 @@
[koji.localhost.kerberos]
principal = "osbuild-krb@LOCAL"
keytab = "/etc/osbuild-composer/client.keytab"
[worker]
allowed_domains = [ "localhost", "*.osbuild.org" ]