Support multiple hostnames in the allowfrom instead of a single one.

[ildyria]

Hi, thank you for your work on socket-proxy.

Is your feature request related to a problem? Please describe.

Since version 1.1.0, not only IP networks but also hostnames can be configured. So it is now possible to explicitly allow only one specific client to connect to the proxy, for example, -allowfrom=traefik

Using the hostname is an easy-to-configure way to have more security. Access to the socket proxy will not even be permitted from the host system.

Would it be possible to support multiple hostnames instead of a single one?

Describe the solution you'd like

Allow a comma-separated list in allowfrom, it is possible to do -allowfrom=traefik,dozzle,watchtower

Disclaimer

One solution would be to deploy a socket-proxy per instance, but with my little knowledge I have not be able to make this work.

[wollomatic]

Hi @ildyria,

thank You very much for Your contribution. I merged it into the develop branch and changed a detail about the DNS lookup. You can find a test image on docker hub: wollomatic/socket-proxy:testing

[ildyria]

Thank you, tested with the following docker compose, seems to be working like a charm. :)

Details

# Inspired from https://github.com/wollomatic/traefik-hardened 
services:

  # Step 1
  # Setup the Docker proxy.
  # This is to harden communications and avoid that if traefik is compromised the full host is compromised.
  dockerproxy:
    image: wollomatic/socket-proxy:testing
    container_name: private-docker-proxy
    command:
      # with this configuration socket-proxy acts similar to the tecnativa proxy.
      # For additional hardening please refer to the documentation of the wollomatic/socket-proxy image
      - '-loglevel=info' # set to debug for far more logging
      - '-allowfrom=reverse-proxy,dozzle'
      # - '-allowfrom=0.0.0.0/0'
      - '-listenip=0.0.0.0'
      - '-allowGET=/v1\..{1,2}/(version|containers/.*|events.*)' # this regexp allows readonly access only for requests that traefik needs
      - '-shutdowngracetime=5'
      - '-watchdoginterval=600'
      - '-stoponwatchdog'
    restart: unless-stopped
    read_only: true
    mem_limit: 64M
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges
    user: 65534:994 # replace <<docker-gid>> (994) with the docker gid on your host system.
                    # $ getent group docker
                    # docker:x:994:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - docker-proxynet

  # Step 2
  # Setup Traefik
  reverse-proxy:
    image: traefik:v3.0
    container_name: traefik
    read_only: true
    ports:
      - 80:80 # The HTTP port
      - 443:443 # The HTTPS port
      # The Web UI port (enabled by --api.insecure=true)
      # - 48080:8080
    depends_on:
      - dockerproxy
    security_opt:
      - no-new-privileges:true
    # user: 2000:2000 # user traefik has to be created on the host system
                      # sudo useradd -u 2000 -M -s /usr/sbin/nologin traefik
    networks:
      - docker-proxynet
      - traefik-servicenet
    volumes:
      # So that traefik can listen to docker events
      # - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - ./letsencrypt:/letsencrypt
      - ./logs/:/var/log/
      # Configuration
      - ./traefik.yml:/etc/traefik/traefik.yml
      - ./authusers.txt:/etc/traefik/authusers.txt:ro  # userfile for basic auth
    labels:
      - "traefik.enable=true"
      # expose traefik dashboard with TLS and basic auth
      # 1. create router
      - "traefik.http.routers.traefik.entrypoints=websecure"
      - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN_NAME1}`)"
      - "traefik.http.routers.traefik.service=api@internal"
      # - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=myresolver"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      # 2. create basic auth middleware
      - "traefik.http.middlewares.traefik-auth.basicauth.removeheader=true"
      - "traefik.http.middlewares.traefik-auth.basicauth.usersfile=/etc/traefik/authusers.txt"

  # Step 3
  # Convert certificates from acme.json to proper usable format (pem).
  traefik-certs-dumper:
    image: ldez/traefik-certs-dumper:v2.8.1
    depends_on:
      - reverse-proxy
    container_name: traefik-certs-dumper
    entrypoint: sh -c '
      apk add jq
      ; while ! [ -e /data/acme.json ]
      || ! [ `jq ".[] | .Certificates | length" /data/acme.json` != 0 ]; do
      sleep 1
      ; done
      && traefik-certs-dumper file --version v2 --watch
        --source /data/acme.json --dest /data/certs
        --post-hook "sh /hook.sh"'
    labels:
      - "traefik.enable=false"
    volumes:
      - ./letsencrypt:/data
      - ./hook.sh:/hook.sh

  # Step 4
  dozzle:
    image: amir20/dozzle:v5.4.2 # make sure you use the most recent version
    container_name: dozzle
    user: 65534:65534
    read_only: true
    mem_limit: 256M
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges
    depends_on:
      - dockerproxy
    environment:
      DOZZLE_NO_ANALYTICS: true
      DOZZLE_REMOTE_HOST: tcp://dockerproxy:2375
    networks:
      - docker-proxynet
      - traefik-servicenet
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dozzle.rule=Host(`dozzle.${DOMAIN_NAME1}`)"
      - "traefik.http.routers.dozzle.entrypoints=websecure"
      - "traefik.http.routers.dozzle.tls.certresolver=myresolver"
      - "traefik.http.routers.dozzle.middlewares=dozzle-auth"
      - "traefik.http.middlewares.dozzle-auth.basicauth.removeheader=true"
      - "traefik.http.middlewares.dozzle-auth.basicauth.usersfile=/etc/traefik/authusers.txt"

networks:
  traefik-servicenet:
    # external: true           # this network has to be created once before starting:
    name: traefik-servicenet # docker network create traefik-servicenet
  docker-proxynet:
    driver: bridge
    internal: true

[wollomatic]

Hi @ildyria,

thanks for the feedback. I'll update the documentation, and then release version 1.3.0 tomorrow.

[wollomatic]

Thanks again for the improvement. 1.3.0 ist now available on docker hub.