Better reverse proxy support

[szechyjs]

The webserver(s) shouldn't be so opinionated as it negatively affects running behind a reverse proxy. Ideas...

• allow disabling HTTPS server, and only serve HTTP and allow the proxy to do the SSL termination.
• allow configuring the public vs private ports. for example all the oscp urls are forced to have a 1024+ port number, however the configured reverse proxy is serving on port 80 and others on 443 (for https).
• UCM_TRUSTED_PROXIES should allow a CIDR instead of single IPs. When running in a k8s cluster the proxy IPs can change, so it would be preferablt to set something like 10.42.0.0/16.

The FAQs specify a proxy as the preferred configuration, however many of the above configuration choice seem to conflict with that, and seem focused on running as a standalone non-containerized host.

[Hemsby]

There is a Helm chart at charts/ucm/ with an ingress backend-protocol: HTTPS example and an optional second ingress (ingress.protocolHttp) for a cleartext CDP/OCSP host, so the containerised path is considered. That said, a couple of your points are fair. Going through them:

Public vs private ports. The advertised CDP/OCSP/AIA URL is {host}:{http_protocol_port}. The host and scheme come from the Protocol Base URL setting, and a non-default port there is honoured (http://pki.example.com:9000 works). But a bare http://pki.example.com gets http_protocol_port appended, an explicit :80 is normalised away and then replaced by http_protocol_port again, and the Settings field refuses a port below 1024. So there is currently no way to listen on 8080 and advertise port 80. A clean fix would be to let protocol_base_url carry the public port independently of the listen port, or to stop overriding an explicit :80.

UCM_TRUSTED_PROXIES accepting CIDR is the clearest ask and I am happy to do it. The check is an exact string match on the immediate peer, with * as the only wildcard. Accepting 10.42.0.0/16 matched as a network is small and self-contained, and it is worse in k8s specifically: the chart only templates UCM_FQDN so this goes through extraEnv, and ingress controller pod IPs rotate. UCM_BEHIND_PROXY=1 also has to be set before X-Forwarded-* is honoured, and the chart does not wire that either. @NeySlim if you are up for it I will open a PR for the CIDR parsing and can wire both into the chart.

Disabling the HTTPS server entirely. The CDP/OCSP/AIA endpoints already have the plain-HTTP listener; SCEP, EST, ACME and the admin UI and API stay HTTPS. For a proxy in front, the usual answer is to have it skip upstream cert verification (nginx.ingress.kubernetes.io/backend-protocol: "HTTPS", which ingress-nginx does not verify by default; proxy_ssl_verify off on plain nginx; insecureSkipVerify in Traefik) or bind a real internal cert to UCM. A full HTTP-only mode for the admin and API side would be a larger change with a security tradeoff, so I would leave that call to @NeySlim.

[NeySlim]

Thanks for the detailed write-up, and @Hemsby for the analysis, which matches the code. Point by point:

CIDR in UCM_TRUSTED_PROXIES. Yes, please go ahead with the PR, and wiring UCM_BEHIND_PROXY / UCM_TRUSTED_PROXIES into the chart values is welcome. Two things to keep in mind: peers can show up as IPv4-mapped IPv6 addresses (::ffff:10.42.0.5) when UCM listens dual-stack, so match those against IPv4 networks too; and an entry that does not parse must be ignored with a log line, never widen the trust. The FAQ already tells people to put an IP/CIDR in UCM_TRUSTED_PROXIES, so your PR makes the doc true.

Public vs private ports. Fixed on dev, in the next release. An explicitly typed port in the Base URL or the Protocol Base URL is now kept as typed and honoured, :80 and :443 included, so http://pki.example.com:80 advertises http://pki.example.com/cdp/... while UCM keeps listening on 8080. A URL without a port keeps taking the listen port, as before. The HTTP protocol port setting stays the listen port and keeps its 1024 floor, since it is what the service binds.

HTTP-only admin and API. Not planned. TLS termination at UCM is what mTLS client-certificate authentication, the proxy-header gating and the SCEP, EST and ACME paths rely on, and an admin listener in cleartext exposed by mistake is not a risk I want to ship as an option. The CDP, OCSP and AIA endpoints already have their plain HTTP listener for the parts that must be HTTP. In front of a proxy the two working setups are re-encryption without upstream verification (backend-protocol: "HTTPS" on ingress-nginx, proxy_ssl_verify off on nginx, insecureSkipVerify on Traefik) or binding an internal certificate to UCM from the HTTPS settings so the proxy can verify it.

[NeySlim]

v2.224 (https://github.com/NeySlim/ultimate-ca-manager/releases/tag/v2.224) ships the CIDR support for UCM_TRUSTED_PROXIES with the Helm chart proxy values (#339), the public port fix for the advertised admin and protocol URLs, and, as a follow-up, X-Forwarded-* headers honoured only from peers listed in UCM_TRUSTED_PROXIES once proxy support is on. The HTTP-only admin listener stays out, as discussed above. Closing as resolved.