Changed syncthing access and auth scheme

k8s/apps/syncthing/asset-router.yaml

@@ -0,0 +1,85 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-router-config
+  namespace: syncthing
+data:
+  default.conf: |
+    server {
+        listen 80;
+        server_name _;
+
+        # Route assets based on cookie or referer
+        location / {
+            # Check cookie first
+            if ($cookie_syncthing_instance = "nas") {
+                proxy_pass http://syncthing-nas:8384;
+            }
+            if ($cookie_syncthing_instance = "master") {
+                proxy_pass http://syncthing-master:8384;
+            }
+            if ($cookie_syncthing_instance = "iris") {
+                proxy_pass http://syncthing-khv:8384;
+            }
+
+            # Check referer as fallback
+            if ($http_referer ~ "/nas") {
+                proxy_pass http://syncthing-nas:8384;
+            }
+            if ($http_referer ~ "/master") {
+                proxy_pass http://syncthing-master:8384;
+            }
+            if ($http_referer ~ "/iris") {
+                proxy_pass http://syncthing-khv:8384;
+            }
+
+            # Default to nas if no match
+            proxy_pass http://syncthing-nas:8384;
+            
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: syncthing-router
+  namespace: syncthing
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: syncthing-router
+  template:
+    metadata:
+      labels:
+        app: syncthing-router
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+        ports:
+        - containerPort: 80
+        volumeMounts:
+        - name: config
+          mountPath: /etc/nginx/conf.d
+      volumes:
+      - name: config
+        configMap:
+          name: nginx-router-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: syncthing-router
+  namespace: syncthing
+spec:
+  selector:
+    app: syncthing-router
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80

k8s/apps/syncthing/ingress-route.yaml

@@ -7,7 +7,8 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`ss.hexor.cy`)
+    # Landing page
+    - match: Host(`ss.hexor.cy`) && Path(`/`)
       kind: Rule
       services:
         - name: syncthing-landing
@@ -15,35 +16,70 @@ spec:
       middlewares:
         - name: authentik-forward-auth
           namespace: syncthing
+    
+    # NAS instance and its assets
     - match: Host(`ss.hexor.cy`) && PathPrefix(`/nas`)
       kind: Rule
+      priority: 100
       services:
         - name: syncthing-nas
           port: 8384
       middlewares:
         - name: authentik-forward-auth
           namespace: syncthing
+        - name: syncthing-headers-nas
+          namespace: syncthing
+        - name: set-cookie-nas
+          namespace: syncthing
         - name: strip-prefix-nas
           namespace: syncthing
+    
+    # Master instance and its assets
     - match: Host(`ss.hexor.cy`) && PathPrefix(`/master`)
       kind: Rule
+      priority: 100
       services:
         - name: syncthing-master
           port: 8384
       middlewares:
         - name: authentik-forward-auth
           namespace: syncthing
+        - name: syncthing-headers-master
+          namespace: syncthing
+        - name: set-cookie-master
+          namespace: syncthing
         - name: strip-prefix-master
           namespace: syncthing
+    
+    # Iris instance and its assets
     - match: Host(`ss.hexor.cy`) && PathPrefix(`/iris`)
       kind: Rule
+      priority: 100
       services:
         - name: syncthing-khv
           port: 8384
       middlewares:
         - name: authentik-forward-auth
           namespace: syncthing
+        - name: syncthing-headers-iris
+          namespace: syncthing
+        - name: set-cookie-iris
+          namespace: syncthing
         - name: strip-prefix-iris
           namespace: syncthing
+    
+    # Catch all static assets and route based on referer header
+    - match: Host(`ss.hexor.cy`) && (PathPrefix(`/vendor`) || PathPrefix(`/theme-assets`) || PathPrefix(`/meta`) || PathPrefix(`/syncthing`))
+      kind: Rule
+      priority: 50
+      services:
+        - name: syncthing-router
+          namespace: syncthing
+          port: 80
+      middlewares:
+        - name: authentik-forward-auth
+          namespace: syncthing
+        - name: asset-router
+          namespace: syncthing
   tls:
     secretName: syncthing-tls

k8s/apps/syncthing/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - ingress-route.yaml
   - middleware.yaml
   - landing-page.yaml
+  - asset-router.yaml
 
 helmCharts:
   - name: syncthing

k8s/apps/syncthing/middleware.yaml

@@ -24,6 +24,7 @@ spec:
   stripPrefix:
     prefixes:
       - /nas
+    forceSlash: false
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
@@ -34,6 +35,7 @@ spec:
   stripPrefix:
     prefixes:
       - /master
+    forceSlash: false
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
@@ -43,4 +45,81 @@ metadata:
 spec:
   stripPrefix:
     prefixes:
-      - /iris
+      - /iris
+    forceSlash: false
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: syncthing-headers-nas
+  namespace: syncthing
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Prefix: "/nas"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: syncthing-headers-master
+  namespace: syncthing
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Prefix: "/master"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: syncthing-headers-iris
+  namespace: syncthing
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Prefix: "/iris"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: set-cookie-nas
+  namespace: syncthing
+spec:
+  headers:
+    customResponseHeaders:
+      Set-Cookie: "syncthing_instance=nas; Path=/; HttpOnly"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: set-cookie-master
+  namespace: syncthing
+spec:
+  headers:
+    customResponseHeaders:
+      Set-Cookie: "syncthing_instance=master; Path=/; HttpOnly"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: set-cookie-iris
+  namespace: syncthing
+spec:
+  headers:
+    customResponseHeaders:
+      Set-Cookie: "syncthing_instance=iris; Path=/; HttpOnly"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: asset-router
+  namespace: syncthing
+spec:
+  plugin:
+    simplerouter:
+      routes:
+        - match: Header(`Referer`, `.*\/nas.*`)
+          service: syncthing-nas
+        - match: Header(`Referer`, `.*\/master.*`)
+          service: syncthing-master
+        - match: Header(`Referer`, `.*\/iris.*`)
+          service: syncthing-khv