How filter access (by password or IP list) on WEB GUI (port 8888) ?

[getienne53]

How filter access (by password or IP list) on WEB GUI (port 8888) ?

[lucasvmx]

• Set oxidized to listen only in 127.0.0.1:8888 and make nginx to redirect requests to this port.
• Redirect host port 81 to container port 888

Do something like this on /etc/nginx/nginx.conf:

	server {
		listen 80;
		server_name host.com;

		location / {
			auth_basic "restrict";
			auth_basic_user_file /etc/apache2/.htpasswd; 
			proxy_pass http://127.0.0.1:81;
			proxy_set_header Host $host;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto $scheme;
		}
	}

use apache htpasswd and save password to /etc/apache2/.htpasswd

[getienne53]

Thanks Lucas

I understand your approach which consists of using a reverse proxy like NGinx, HaProxy or Traefik on the front of Puma server.

I'm waiting to see if anyone knows how to integrate an access-list or password directly into Puma.

If it's not the case, I will follow the process you suggest.

Have a good day :-)

[getienne53]

No more information about Puma config...

So I followed Lucas's recommendation with Nginx, and it works well.

In detail, on a Debian 11 distribution, that give :

In the .config/oxidized/config file:
rest:127.0.0.1:8888
apt install nginx apache2-utils
added the following paragraph in /etc/nginx.nginx.conf:

server {
listen 80;
server_name ct-oxid.xxx;

            location / {
                    auth_basic "restrict";
                    auth_basic_user_file /etc/apache2/.htpasswd;
                    proxy_pass http://127.0.0.1:8888;
                    proxy_set_header Host $host;
                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                    proxy_set_header X-Forwarded-Proto $scheme;
            }
    }

htpasswd -c /etc/apache2/.htpasswd user

Bye