feat: add experimental HTTP template server #109
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add experimental HTTP template server feature that allows users to render ban and captcha templates via HTTP endpoint instead of using Lua scripts. Key features: - HTTP server with configurable listen address/port and TLS support - Template rendering using Go's native text/template package - Host configuration lookup using Host header from HAProxy - Support for ban and captcha remediation types - Catch-all route for simplified HAProxy configuration - HEAD requests return 403 for ban/captcha remediations Changes: - Add HTTPTemplateServerConfig to bouncer configuration - Implement HTTP template server in pkg/httptemplate - Add Go template renderer in pkg/template - Create .tmpl template files for ban and captcha - Add GetProviderInfo helper in captcha package - Update Dockerfile to create log directory and copy templates - Add HAProxy configuration example for HTTP template server - Update all config files to use canonical header names (X-Crowdsec-*) This is an experimental feature and must be explicitly enabled via http_template_server.enabled in the configuration.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Remove full header map from log entry to prevent exposure of sensitive data such as cookies, authorization tokens, etc. Log only the essential message that remediation header was not found.
Contributor
There was a problem hiding this comment.
Pull Request Overview
This pull request adds an experimental HTTP template server feature that enables HAProxy to render ban and captcha pages through HTTP endpoints instead of Lua scripts. The server leverages Go's native text/template package for rendering and provides a RESTful alternative to the existing Lua-based approach.
Key Changes:
- Implements HTTP template server with configurable listen address/port and optional TLS support
- Adds Go template renderer and
.tmpltemplate files for ban and captcha pages - Updates all HAProxy configuration files to use canonical header naming convention (X-Crowdsec-*)
Reviewed Changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 16 comments.
Show a summary per file
| File | Description |
|---|---|
| templates/captcha.tmpl | New Go template for captcha page with dark mode support and retry logic |
| templates/ban.tmpl | New Go template for ban page with dark mode support |
| pkg/template/renderer.go | Template rendering wrapper using Go's text/template package |
| pkg/httptemplate/server.go | HTTP server implementation handling ban/captcha rendering and host configuration lookup |
| pkg/cfg/config.go | Configuration structures for HTTP template server including TLS settings |
| internal/remediation/captcha/providers.go | Added GetProviderInfo helper to retrieve provider-specific frontend configuration |
| cmd/root.go | Integration of HTTP template server into main application lifecycle |
| Dockerfile | Updated to copy new .tmpl templates and standardize directory paths |
| debian/rules | Added installation of .tmpl template files |
| rpm/SPECS/crowdsec-haproxy-spoa-bouncer.spec | Added .tmpl template files to package |
| config/haproxy-httptemplate.cfg | New HAProxy configuration example demonstrating HTTP template server usage |
| config/haproxy.cfg | Updated header names to canonical format (X-Crowdsec-*) |
| config/haproxy-upstreamproxy.cfg | Updated header names to canonical format (X-Crowdsec-*) |
| config/crowdsec-spoa-bouncer.yaml | Added HTTP template server configuration section |
| docker-compose.yaml | Updated volume paths to match standardized directory structure |
| docker-compose.proxy-test.yaml | Updated volume paths to match standardized directory structure |
| docker-compose.httptemplate-test.yaml | New Docker Compose configuration for testing HTTP template server |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Member
Author
|
link #107 |
Return 403 Forbidden for HEAD requests and favicon (.ico) file requests instead of rendering templates. This prevents unnecessary template rendering for these request types and provides a cleaner response.
- Fix duplicate class attributes in ban.tmpl and captcha.tmpl - Update meta charset to HTML5 syntax in both templates - Fix indentation inconsistencies in templates and haproxy config - Move HTTP template server startup after hosts are loaded - Remove redundant error check in httptemplate server - Fix comment typo: X-CrowdSec -> X-Crowdsec - Add template name parameter to NewRenderer for better error messages - Remove unnecessary template volume mount from docker-compose
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 13 out of 13 changed files in this pull request and generated 12 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Shutdown SPOA and HTTP template server in parallel - Both services share a single 5-second timeout context - Maximum total shutdown time is 5 seconds (not 10) - Simplified logging to avoid duplicate messages
Security fixes: - Switch from text/template to html/template for XSS protection - Add host header validation (length and invalid character checks) - Add TLS certificate/key file existence validation - Buffer template rendering before WriteHeader to handle errors properly Code quality improvements: - Remove unnecessary Array.from() in JavaScript (NodeList is iterable) - Update meta charset to HTML5 syntax in all templates - Fix duplicate class attributes in SVG elements - Improve comment clarity and accuracy - Update HAProxy config comment for clarity Template consistency: - Apply all fixes to both .tmpl and .html template files - Ensure Lua-based and HTTP template server use consistent templates
Member
Author
|
untagging |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add experimental HTTP template server feature that allows users to render ban and captcha templates via HTTP endpoint instead of using Lua scripts.
Key features:
Changes:
This is an experimental feature and must be explicitly enabled via http_template_server.enabled in the configuration.