Kwandon ba ya isa API na VPN kawai? Yi proxy a kan uwar gida

Sabis ɗin Compose ɗinka yana ƙarewa da lokaci a kan API wanda burauza a wannan na’urar yake buɗewa ba tare da wata ƙorafi ba. Wannan bambancin shine alamar: buƙatar da ke aiki tana fitowa daga uwar gida mai tunel ɗin VPN, kuma buƙatar da ke rataye tana fitowa daga kwando mai nasa tarin hanyar sadarwa. Babu abin da ke cikin kwandon da ya san hanyoyin tunel ɗin, don haka wurin sirri ya kasance ba za a iya isa ba ko yaya aka rubuta sunan. Maganin shine tsalle da gangan ta uwar gida, ba ingantaccen teburin hanya ba.

Fara da dalilin da yasa hanyoyin biyu suka bambanta, sannan ka yanke shawara inda tunel ɗin zai zauna.

Dalilin da yasa uwar gida ke aiki amma kwandon a’a

Ɗaga tunel ɗin yana ba uwar gida mahada, jerin hanyoyi kuma yawanci rubutun resolver da VPN ke bayarwa. Kwando ba ya gado kome daga ciki: yana farawa da mahada ɗaya a kan gadar injin da tsohuwar hanya da ke nuni ga wannan gada. Hanyoyin da aka sanya a uwar gida ba a ganinsu ga duk abin da ke gudana cikin wannan filin suna.

Shi yasa alamun suna kama da rashin daidaituwa maimakon karye kawai. Uwar gida tana warware sunan sirri kuma tana haɗawa, domin duka sunan da hanyar suna can. Kwandon yana aika fakitinsa zuwa adireshin sirri wanda babu abin da ke kan hanyar gada zai iya isa, kuma buƙatar tana ƙarewa da lokaci. Ƙara sunan cikin fayil ɗin hosts na kwandon ba ya canza kome, domin adireshin da kansa ba za a iya isa ba daga inda kwandon yake.

Isa uwar gida daga cikin kwandon

Tsari a cikin kwandon da ke buga localhost yana buga kwandon. Docker Desktop yana buga host.docker.internal a matsayin sunan da ke nuni zuwa na’urar da ke tafiyar da injin; injunan Linux suna barin shi ba a bayyana ba sai sabis ɗin ya nemi haka, kuma abin da taswirar da ke ƙasa take yi ke nan. Da haka aikace-aikacen yana nufin suna da tashar jiragen ruwa maimakon adireshin sirri.

services:
  app:
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      INTERNAL_API_HOST: "host.docker.internal:8666"

Tunel ɗin yana tsayawa a gefen uwar gida na tsallen, kuma tashar da ke cikin wannan ma’aunin ita ce da proxy zai saurara. Kwandon da ya rasa tunel ɗin yanzu yana gazawa a tsalle ɗaya sananne maimakon ƙoƙarin hanya da bai taɓa samu ba.

Zaɓi inda tunel ɗin yake zaune

Siffofi uku suna yiwuwa ga sabis ɗin Compose da ke buƙatar API na sirri, kuma suna bambanta a wace tsari ke mallakar tunel ɗin. Abokin ciniki na VPN zai iya gudana cikin hoton kwandon, wanda ke buƙatar fallasa na’urar tunel da ba da ikon sarrafa hanyar sadarwa da ke tare da shi. Aikace-aikacen zai iya raba filin sunan hanyar sadarwa na wani kwandon tunel daban, don haka duka tsare-tsaren biyu suna ganin tarin ɗaya da teburin hanya ɗaya. Ko kuma tunel ɗin zai iya zama a uwar gida, da ɗan gajeren mai turawa daga uwar gida zuwa cikin kwandon.

Biyu na farko suna jawo fayilolin bayanin martaba, halin sake haɗawa da manufar resolver cikin aikin, kuma suna sa kowane sabis a cikin fayil ɗin ya dogara da lafiyar tunel ɗin. Wannan haɗi ne mai yawa ga kira ɗaya na API. Ga tarin ci gaba da ke karanta wuri ɗaya na ciki, mai turawa na gefen uwar gida shine mafi ƙarancin canji wanda har yanzu yana ajiye takardun shaidar inda ƙungiyar dandali ke sarrafa su.

Buga hanya ɗaya ƙunci a uwar gida

Fara daga abin da mai turawa ke gado: gudanar da shi a ƙarƙashin asusun da ke mallakar tunel ɗin kuma soket ɗinsa na fita suna karɓar hanyoyin uwar gida da resolver na uwar gida. Ɗaya location block na nginx yana rufe hanya ɗaya.

server {
    listen 8666;
    location /search/ {
        proxy_pass http://10.20.30.40:8090/;
        proxy_set_header Host internal-api.example;
        proxy_read_timeout 60s;
    }
}

Ɗauki adireshin da tashar a matsayin maye gurbi kuma saka biyun da API ke saurara a kai da gaske. Kowane ƙarin upstream yana samun nasa location block, kuma kowane block ya kamata ya ba da izini kawai hanyoyin da wannan sabis ɗin ke kira, don proxy ya zama babbar ƙofa cikin hanyar sadarwar sirri ba. Daure mai sauraro ga adireshin gada ga abokan ciniki da ke zuwa ta host-gateway, ga loopback kawai lokacin da abokin ciniki ke raba filin sunan hanyar sadarwar uwar gida, kuma kada ka taɓa ga 0.0.0.0. Zaɓi kuma tashar da har yanzu ba a amfani da ita: lambar da aka riga aka ɗauka tana barin proxy ba ya saurara yayin da kwandon ke ci gaba da ƙarewa da lokaci, wanda ba za a iya bambanta shi da matsalar hanyar sadarwar da ka fara da ita ba.

Tashoshi, sunaye da shawarar TLS

Warware suna yana rabuwa kamar yadda turawa take. Binciken jama’a na kwandon yana ratsa resolver na injin, don haka sunan sirri da ke warwarewa a uwar gida ba zai warware cikin kwandon ba. Proxy shine ɓangaren da ke warware sunan sirri, domin yana gado resolver na uwar gida.

TLS ita ce shawarar da ake jinkirtawa sannan ta bayyana gazawar gaba. Idan proxy yana tura bytes ba tare da an taɓa su ba, kwandon yana ganin takardar shaidar API ɗin kansa kuma yana buƙatar CA na ciki a cikin ajiyar amincewarsa. Idan proxy yana ƙarasa TLS, wannan amincewar tana ƙaura zuwa uwar gida kuma aikace-aikacen ya fara gina hanyoyin haɗi daga kan host ɗin da ya karɓa. Zaɓi tsari ɗaya kuma ka yi amfani da shi ga kowane hanya, domin turawa da ɗayan ya bayar tana nuni ga sunan uwar gida da kwandon ba zai iya warwarewa ba.

Tabbatar daga cikin sabis ɗin

Aika buƙatar daga kwandon, ba daga uwar gida ba: curl mai sauƙi a kan hanyar proxy, sannan gwajin lafiyar aikace-aikacen kansa. Lokacin da proxy ya amsa amma aikace-aikacen har yanzu ya kasa, kwatanta abubuwa uku: tushen URL ɗin da yake ginawa, duk wani ma’aunin proxy a cikin muhallinsa, da CA ɗin da yake amincewa da shi. Duk suna cikin muhalli da rajistan ayyukan kwandon, kuma gyara ɗaya daga cikinsu yana barin VPN ɗin lafiya.

Rubuta tsarin da aka zaɓa cikin README na aikin tun yana sabo. In ba haka ba, mutumin da zai fara cin karo da wannan ƙarshen lokaci zai shafe wannan yammacin yana sake gano cewa tunel ɗin yana zaune a uwar gida.