feat: new configuration option cloneAccessAddresses to control port publishing for clone containers; restrict to 127.0.0.1 by default (#528)

Author: agneum

engine/configs/config.example.logical_generic.yml

@@ -143,6 +143,12 @@ provision:
   # existing users to log in with old passwords.
   keepUserPasswords: false
 
+  # IP addresses that can be used to access clones.
+  # By default, using a loop-back to accept only local connections.
+  # The empty string means "all available addresses".
+  # The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
+  cloneAccessAddresses: "127.0.0.1"
+
 # Data retrieval flow. This section defines both initial retrieval, and rules
 # to keep the data directory in a synchronized state with the source. Both are optional:
 # you may already have the data directory, so neither initial retrieval nor

engine/configs/config.example.logical_rds_iam.yml

@@ -142,6 +142,12 @@ provision:
   # existing users to log in with old passwords.
   keepUserPasswords: false
 
+  # IP addresses that can be used to access clones.
+  # By default, using a loop-back to accept only local connections.
+  # The empty string means "all available addresses".
+  # The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
+  cloneAccessAddresses: "127.0.0.1"
+
 # Data retrieval flow. This section defines both initial retrieval, and rules
 # to keep the data directory in a synchronized state with the source. Both are optional:
 # you may already have the data directory, so neither initial retrieval nor

engine/configs/config.example.physical_generic.yml

@@ -140,6 +140,12 @@ provision:
   # existing users to log in with old passwords.
   keepUserPasswords: false
 
+  # IP addresses that can be used to access clones.
+  # By default, using a loop-back to accept only local connections.
+  # The empty string means "all available addresses".
+  # The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
+  cloneAccessAddresses: "127.0.0.1"
+
 # Data retrieval flow. This section defines both initial retrieval, and rules
 # to keep the data directory in a synchronized state with the source. Both are optional:
 # you may already have the data directory, so neither initial retrieval nor

engine/configs/config.example.physical_pgbackrest.yml

@@ -140,6 +140,12 @@ provision:
   # existing users to log in with old passwords.
   keepUserPasswords: false
 
+  # IP addresses that can be used to access clones.
+  # By default, using a loop-back to accept only local connections.
+  # The empty string means "all available addresses".
+  # The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
+  cloneAccessAddresses: "127.0.0.1"
+
 # Data retrieval flow. This section defines both initial retrieval, and rules
 # to keep the data directory in a synchronized state with the source. Both are optional:
 # you may already have the data directory, so neither initial retrieval nor

engine/configs/config.example.physical_walg.yml

@@ -140,6 +140,12 @@ provision:
   # existing users to log in with old passwords.
   keepUserPasswords: false
 
+  # IP addresses that can be used to access clones.
+  # By default, using a loop-back to accept only local connections.
+  # The empty string means "all available addresses".
+  # The option supports multiple IPs (using comma-separated format) and IPv6 addresses (for example, [::1])
+  cloneAccessAddresses: "127.0.0.1"
+
 # Data retrieval flow. This section defines both initial retrieval, and rules
 # to keep the data directory in a synchronized state with the source. Both are optional:
 # you may already have the data directory, so neither initial retrieval nor

engine/internal/provision/docker/docker.go

@@ -78,7 +78,7 @@ func RunContainer(r runners.Runner, c *resources.AppConfig) error {
 		"docker run",
 		"--name", c.CloneName,
 		"--detach",
-		"--publish", fmt.Sprintf("%[1]s:%[1]s", instancePort),
+		publishPorts(c.ProvisionHosts, instancePort),
 		"--env", "PGDATA=" + c.DataDir(),
 		"--env", "PG_UNIX_SOCKET_DIR=" + unixSocketCloneDir,
 		"--env", "PG_SERVER_PORT=" + instancePort,
@@ -101,6 +101,20 @@ func RunContainer(r runners.Runner, c *resources.AppConfig) error {
 	return nil
 }
 
+func publishPorts(provisionHosts string, instancePort string) string {
+	if provisionHosts == "" {
+		return fmt.Sprintf("--publish %[1]s:%[1]s", instancePort)
+	}
+
+	pub := []string{}
+
+	for _, s := range strings.Split(provisionHosts, ",") {
+		pub = append(pub, "--publish", fmt.Sprintf("%[1]s:%[2]s:%[2]s", s, instancePort))
+	}
+
+	return strings.Join(pub, " ")
+}
+
 func createDefaultVolumes(c *resources.AppConfig) (string, []string) {
 	unixSocketCloneDir := c.Pool.SocketCloneDir(c.CloneName)
 

engine/internal/provision/docker/docker_test.go

@@ -94,3 +94,20 @@ func TestDefaultVolumes(t *testing.T) {
 		"--volume /tmp/test/default:/tmp/test/default",
 		"--volume /tmp/test/default/socket:/tmp/test/default/socket"}, volumes)
 }
+
+func TestPublishPorts(t *testing.T) {
+	testCases := []struct {
+		provisionHosts string
+		instancePort   string
+		expectedResult string
+	}{
+		{provisionHosts: "", instancePort: "6000", expectedResult: "--publish 6000:6000"},
+		{provisionHosts: "127.0.0.1", instancePort: "6000", expectedResult: "--publish 127.0.0.1:6000:6000"},
+		{provisionHosts: "127.0.0.1,172.0.0.1", instancePort: "6000", expectedResult: "--publish 127.0.0.1:6000:6000 --publish 172.0.0.1:6000:6000"},
+		{provisionHosts: "[::1]", instancePort: "6000", expectedResult: "--publish [::1]:6000:6000"},
+	}
+
+	for _, tc := range testCases {
+		assert.Equal(t, publishPorts(tc.provisionHosts, tc.instancePort), tc.expectedResult)
+	}
+}

engine/internal/provision/mode_local.go

@@ -51,11 +51,12 @@ type PortPool struct {
 
 // Config defines configuration for provisioning.
 type Config struct {
-	PortPool          PortPool          `yaml:"portPool"`
-	DockerImage       string            `yaml:"dockerImage"`
-	UseSudo           bool              `yaml:"useSudo"`
-	KeepUserPasswords bool              `yaml:"keepUserPasswords"`
-	ContainerConfig   map[string]string `yaml:"containerConfig"`
+	PortPool             PortPool          `yaml:"portPool"`
+	DockerImage          string            `yaml:"dockerImage"`
+	UseSudo              bool              `yaml:"useSudo"`
+	KeepUserPasswords    bool              `yaml:"keepUserPasswords"`
+	ContainerConfig      map[string]string `yaml:"containerConfig"`
+	CloneAccessAddresses string            `yaml:"cloneAccessAddresses"`
 }
 
 // Provisioner describes a struct for ports and clones management.
@@ -598,14 +599,15 @@ func (p *Provisioner) stopPoolSessions(fsm pool.FSManager, exceptClones map[stri
 
 func (p *Provisioner) getAppConfig(pool *resources.Pool, name string, port uint) *resources.AppConfig {
 	appConfig := &resources.AppConfig{
-		CloneName:     name,
-		DockerImage:   p.config.DockerImage,
-		Host:          pool.SocketCloneDir(name),
-		Port:          port,
-		DB:            p.dbCfg,
-		Pool:          pool,
-		ContainerConf: p.config.ContainerConfig,
-		NetworkID:     p.networkID,
+		CloneName:      name,
+		DockerImage:    p.config.DockerImage,
+		Host:           pool.SocketCloneDir(name),
+		Port:           port,
+		DB:             p.dbCfg,
+		Pool:           pool,
+		ContainerConf:  p.config.ContainerConfig,
+		NetworkID:      p.networkID,
+		ProvisionHosts: p.config.CloneAccessAddresses,
 	}
 
 	return appConfig

engine/internal/provision/resources/appconfig.go

@@ -10,13 +10,14 @@ import (
 
 // AppConfig currently stores Postgres configuration (other application in the future too).
 type AppConfig struct {
-	CloneName   string
-	DockerImage string
-	Pool        *Pool
-	Host        string
-	Port        uint
-	DB          *DB
-	NetworkID   string
+	CloneName      string
+	DockerImage    string
+	Pool           *Pool
+	Host           string
+	Port           uint
+	DB             *DB
+	NetworkID      string
+	ProvisionHosts string
 
 	ContainerConf map[string]string
 	pgExtraConf   map[string]string