Add static HTTP file server for /.well-known/ endpoint #25892

alex19srv · 2023-07-14T16:29:21Z

First commit to implement /.well-known/security.txt endpoint (as discussed in #21942)

denyskon · 2023-07-14T22:16:20Z

Could we have a test for it?

alex19srv · 2023-07-14T23:17:16Z

Could we have a test for it?

I want to add tests, when I will add /.well-known/security.txt. Currently I can only test, if https://gitea/.well-known/ will return 404 status code (do not make directory list).

Or which tests do You want to see? I thought and did not found which tests to implement an this stage.

lunny · 2023-07-16T04:14:33Z

routers/web/web.go

@@ -349,6 +349,12 @@ func registerRoutes(m *web.Route) {
 		m.Get("/change-password", func(ctx *context.Context) {
 			ctx.Redirect(setting.AppSubURL + "/user/settings/account")
 		})
+		wellKnownDir := wellKnownWebDir()
+		m.Get("/*", func(ctx *context.Context) {


I don't think this is right. Why not use m.Get("/.well-know/*",

This code inside group m.Group("/.well-known", func() { and my code works (I checked). All endpoints related to "/.well-known" is inside that group.

Moved m.Get("/.well-known/*", func(ctx *context.Context) { out of Group.

wxiaoguang · 2023-07-16T05:48:50Z

Some thoughts:

makeDirExist seems strange, I do not think the app needs to create the directories automatically.
- Or, if it is necessary, should Gitea provide a default "security.txt"?
After reading more code, I find there are some other files like "robots.txt" which need to be customized.
- At the moment, the "robots.txt" is hard-coded as "CustomPath/robots.txt", it's impossible to add more files in the root directory.
- Ideally, Gitea could support various static files in the web root or web well-known directory.
- Maybe a more general approach could be like this:
  - Serve files in CustomPath/web-root-static/... to http://gitea-domain/....
  - For files in the root
    - CustomPath/web-root-static/robots.txt
    - CustomPath/web-root-static/the-domain-verification.txt
  - For files in the well-known
    - CustomPath/web-root-static/.well-known/security.txt
    - CustomPath/web-root-static/.well-known/the-domain-verification.txt

wxiaoguang · 2023-07-16T13:25:22Z

This feature is useful IMO, eg: https://discourse.gitea.io/t/well-known-path-serving-custom-files-behind-proxy/5445

I will try to propose a new PR for it.

The first step: Move public asset files to the proper directory #25907

Move `public/*` to `public/assets/*` Some old PRs (like #15219) introduced inconsistent directory system. For example: why the local directory "public" is accessed by `http://site/assets`? How to serve the ".well-known" files properly in the public directory? For convention rules, the "public" directory is widely used for the website's root directory. It shouldn't be an exception for Gitea. So, this PR makes the things consistent: * `http://site/assets/foo` means `{CustomPath}/public/assets/foo`. * `{CustomPath}/public/.well-known` and `{CustomPath}/public/robots.txt` can be used in the future. This PR is also a prerequisite for a clear solution for: * #21942 * #25892 * discourse.gitea.io: [.well-known path serving custom files behind proxy?](https://discourse.gitea.io/t/well-known-path-serving-custom-files-behind-proxy/5445/1) This PR is breaking for users who have custom "public" files (CSS/JS). After getting approvals, I will update the documents. ---- ## ⚠️ BREAKING ⚠️ If you have files in your "custom/public/" folder, please move them to "custom/public/assets/". --------- Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Giteabot <teabot@gitea.io>

wxiaoguang · 2023-07-19T05:06:49Z

-> Add "security.txt" support, add CORS header for ".well-known" #25974

…der for ".well-known" (#25974) Replace #25892 Close #21942 Close #25464 Major changes: 1. Serve "robots.txt" and ".well-known/security.txt" in the "public" custom path * All files in "public/.well-known" can be served, just like "public/assets" 3. Add a test for ".well-known/security.txt" 4. Simplify the "FileHandlerFunc" logic, now the paths are consistent so the code can be simpler 5. Add CORS header for ".well-known" endpoints 6. Add logs to tell users they should move some of their legacy custom public files ``` 2023/07/19 13:00:37 cmd/web.go:178:serveInstalled() [E] Found legacy public asset "img" in CustomPath. Please move it to /work/gitea/custom/public/assets/img 2023/07/19 13:00:37 cmd/web.go:182:serveInstalled() [E] Found legacy public asset "robots.txt" in CustomPath. Please move it to /work/gitea/custom/public/robots.txt ``` This PR is not breaking. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io>

n0toose · 2023-07-23T15:42:23Z

This is meta, but you should seriously start providing some sort of method for people that are intending to contribute seriously and want to discuss design ideas and plans in a way that isn't a real-time platform. There are indeed too many issues but some sort of an explicitly defined "lifeline" to a contributor has to somehow continue existing.

jolheiser · 2023-07-23T15:48:48Z

This is meta, but you should seriously start providing some sort of method for people that are intending to contribute seriously and want to discuss design ideas and plans in a way that isn't a real-time platform. There are indeed too many issues but some sort of an explicitly defined "lifeline" to a contributor has to somehow continue existing.

I'm not sure what this means? Anyone is welcome to discuss ideas in an issue, Discord, Matrix, Discourse, etc.

wxiaoguang · 2023-07-23T15:50:45Z

Some people just don't want to discuss. There is a discord channel develop.

And some tasks are too difficult for new contributors. I have done my best to help them (many discussions were done by discord develop channel or private message)

n0toose · 2023-07-23T16:07:03Z

Some people just don't want to discuss.

Issues are big and messy and there is an implicit expectation from the perspective of a new contributor that doesn't want to bother: Developers can't be possibly monitoring a thousand issues (which are arguably a very good place for drive-by contributors), even if notifications exist.

And some tasks are too difficult for new contributors. I have done my best to help them (many discussions were done by discord develop channel or private message)

I'm not accusing you of not trying to help and not trying to help onboard new users (I apologize if I gave off that impression), I'm saying that it would be best to bridge the gap between wanting to work on an issue and reaching out to people. If you are reachable in an issue tracker, it might be best to not let that be an unwritten rule.

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jul 14, 2023

pull-request-size bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 14, 2023

alex19srv changed the title ~~add static HTTP file server for /.well-known/ endpoint~~ Add static HTTP file server for /.well-known/ endpoint Jul 14, 2023

denyskon added the type/feature Completely new functionality. Can only be merged if feature freeze is not active. label Jul 14, 2023

lunny reviewed Jul 16, 2023

View reviewed changes

Add static HTTP file server for /.well-known/ endpoint

b633f2f

alex19srv closed this by deleting the head repository Jul 16, 2023

wxiaoguang mentioned this pull request Jul 16, 2023

Move public asset files to the proper directory #25907

Merged

wxiaoguang mentioned this pull request Jul 19, 2023

Serve pre-defined files in "public", add "security.txt", add CORS header for ".well-known" #25974

Merged

go-gitea locked as resolved and limited conversation to collaborators Oct 14, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add static HTTP file server for /.well-known/ endpoint #25892

Add static HTTP file server for /.well-known/ endpoint #25892

alex19srv commented Jul 14, 2023

denyskon commented Jul 14, 2023

alex19srv commented Jul 14, 2023

lunny Jul 16, 2023

alex19srv Jul 16, 2023

alex19srv Jul 16, 2023

wxiaoguang commented Jul 16, 2023

wxiaoguang commented Jul 16, 2023 •

edited

wxiaoguang commented Jul 19, 2023

n0toose commented Jul 23, 2023 •

edited

jolheiser commented Jul 23, 2023

wxiaoguang commented Jul 23, 2023

n0toose commented Jul 23, 2023

Add static HTTP file server for /.well-known/ endpoint #25892

Add static HTTP file server for /.well-known/ endpoint #25892

Conversation

alex19srv commented Jul 14, 2023

denyskon commented Jul 14, 2023

alex19srv commented Jul 14, 2023

lunny Jul 16, 2023

Choose a reason for hiding this comment

alex19srv Jul 16, 2023

Choose a reason for hiding this comment

alex19srv Jul 16, 2023

Choose a reason for hiding this comment

wxiaoguang commented Jul 16, 2023

wxiaoguang commented Jul 16, 2023 • edited

wxiaoguang commented Jul 19, 2023

n0toose commented Jul 23, 2023 • edited

jolheiser commented Jul 23, 2023

wxiaoguang commented Jul 23, 2023

n0toose commented Jul 23, 2023

wxiaoguang commented Jul 16, 2023 •

edited

n0toose commented Jul 23, 2023 •

edited