Sergei Poljanski
0dc31fbafe
S3 module wraps aws-sdk-s3 against MinIO. Two clients on purpose: - The bytes-mover client points at S3_ENDPOINT (internal minio:9000 over the storage Docker network). - The presign-only client points at S3_PUBLIC_ENDPOINT (https://s3.asxp.io via Traefik) so the URLs it mints resolve from a browser. force_path_style on both because subdomain-style URLs would require wildcard DNS under s3.asxp.io. AdminAuth is a tiny Rack middleware that 401s any request under /admin unless HTTP Basic credentials match ADMIN_USER / ADMIN_PASSWORD from env. Fails closed if either env var is missing.
24 lines
719 B
Ruby
24 lines
719 B
Ruby
require 'rack/auth/basic'
|
|
|
|
# Rack middleware that gates everything under /admin/* behind HTTP Basic.
|
|
# Credentials come from ENV at boot; missing vars fail closed (401 always).
|
|
class AdminAuth
|
|
def initialize(app)
|
|
@app = app
|
|
@user = ENV['ADMIN_USER']
|
|
@pass = ENV['ADMIN_PASSWORD']
|
|
end
|
|
|
|
def call(env)
|
|
return @app.call(env) unless env['PATH_INFO'].to_s.start_with?('/admin')
|
|
|
|
auth = Rack::Auth::Basic::Request.new(env)
|
|
if @user && @pass && auth.provided? && auth.basic? && auth.credentials == [@user, @pass]
|
|
@app.call(env)
|
|
else
|
|
[401,
|
|
{ 'content-type' => 'text/plain', 'www-authenticate' => 'Basic realm="asxp.io admin"' },
|
|
["Unauthorized\n"]]
|
|
end
|
|
end
|
|
end
|