Skip to content

Export the service proxy address to proxied service jobs - #466

Draft
mkitti wants to merge 1 commit into
JaneliaSciComp:mainfrom
mkitti:service-proxy-address
Draft

mkitti wants to merge 1 commit into
JaneliaSciComp:mainfrom
mkitti:service-proxy-address

Conversation

@mkitti

@mkitti mkitti commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

Summary

  • New setting apps.service_proxy_address: the address the reverse proxy connects from, as the compute nodes see it (IP, CIDR network, or comma-separated list).
  • When the service proxy is in use for a job, the job gets it as FG_SERVICE_PROXY_ADDRESS, so a service can accept connections from the proxy only.
  • Only exported when service_proxy_domain is set, service_proxy_address is non-empty, and the entry point has not set service_proxy: false. Otherwise it is unset.
  • Docs: new "Restricting a service to the proxy" section in docs/ServiceProxy.md (with a manifest example), the service_proxy manifest field description, and docs/config.yaml.template.

Notes

  • Fileglancer cannot discover the proxy's source address itself, hence the new setting.
  • This narrows who can connect; it does not replace FG_SERVICE_TOKEN.

Testing

  • Added parametrized test_service_proxy_address_export (enabled, no domain, no address, opted out).
  • Full suite: 1070 passed; 3 failures in tests/test_endpoints.py (test_root_endpoint, test_spa_routing, test_bucket_root_does_not_enumerate_sharing_keys) also fail on clean main.

🤖 Generated with Claude Code

Add apps.service_proxy_address, the address the reverse proxy connects
from as seen by the compute nodes. When the service proxy is in use for
a job (service_proxy_domain set, entry point not opted out), the job
gets it as FG_SERVICE_PROXY_ADDRESS so a service can accept connections
from the proxy only. Unset otherwise.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant