search

theforeman / foreman-operations-collection

Ansible collection for management of Foreman servers
GNU General Public License v3.0
10 stars 17 forks source link

Add HTTP proxy support to Cloud Connector role #87

Closed ehelms closed 2 years ago

ehelms commented 2 years ago

Is this a proxy for talking to cloud or to Foreman?

Good question - RHC talking to cloud. However, given this a generic solution that affects net, I can see how this might cause talking to Foreman to route through the proxy too which is not what we want (https://github.com/ShimShtein/yggdrasil-worker-forwarder/blob/main/server.go#L60). @ShimShtein thoughts on if this would be a problem and how we could prevent it?

This way of configuring comes from -- https://github.com/RedHatInsights/yggdrasil/wiki/FAQ#how-do-i-connect-to-a-broker-using-an-httphttps-proxy

ShimShtein commented 2 years ago

@ehelms according to the go docs the net library supports also the no_proxy/NO_PROXY env variable. We can add an exception for the foreman server there. On a deeper thought, it seems that the request would always go to localhost anyway, since the RHCd would be installed on the same machine as Satellite. This makes the no_proxy rule much more stable. I don't suppose there are many cases where you would want to add a proxy to access local machine.

evgeni commented 2 years ago

localhost is not part of the cert and not what we setup as the foreman url (Also, that would break Ansible)

ShimShtein commented 2 years ago

So no localhost shortcut :) We still can add the foreman url to the no_proxy list.

evgeni commented 2 years ago

Yepp, that part sounds reasonable. Just wanted to point out that localhost is a bad idea :)