Add private Docker UI relay for Nginx Proxy Manager

cmd/ui-proxy/main.go

@@ -0,0 +1,46 @@
+// ui-proxy exposes the read-only loopback viewer to the private Docker gateway.
+package main
+
+import (
+	"flag"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"
+)
+
+func handler(target *url.URL) http.Handler {
+	proxy := httputil.NewSingleHostReverseProxy(target)
+	original := proxy.Director
+	proxy.Director = func(r *http.Request) {
+		original(r)
+		r.Host = target.Host
+		// The viewer is read-only behind NPM; do not forward the public browser origin
+		// into the loopback-only origin guard. Mutating methods are rejected below.
+		r.Header.Del("Origin")
+	}
+	proxy.FlushInterval = -1 // stream SSE immediately
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet && r.Method != http.MethodHead {
+			w.Header().Set("Allow", "GET, HEAD")
+			http.Error(w, "read-only viewer", http.StatusMethodNotAllowed)
+			return
+		}
+		proxy.ServeHTTP(w, r)
+	})
+}
+
+func main() {
+	address := flag.String("listen", "172.20.0.1:18082", "Private Docker gateway listener")
+	flag.Parse()
+	host, _, err := net.SplitHostPort(*address)
+	ip := net.ParseIP(host)
+	if err != nil || ip == nil || !ip.IsPrivate() {
+		log.Fatal("listen must use an explicit private IP and port")
+	}
+	target, _ := url.Parse("http://127.0.0.1:18080")
+	server := &http.Server{Addr: *address, Handler: handler(target), ReadHeaderTimeout: 5 * time.Second, IdleTimeout: 60 * time.Second, MaxHeaderBytes: 8 << 10}
+	log.Fatal(server.ListenAndServe())
+}

cmd/ui-proxy/main_test.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+)
+
+func TestRejectWrites(t *testing.T) {
+	for _, method := range []string{"POST", "PUT", "DELETE"} {
+		w := httptest.NewRecorder()
+		target, _ := url.Parse("http://127.0.0.1:18080")
+		handler(target).ServeHTTP(w, httptest.NewRequest(method, "http://shop.my-mm.ir/api/snapshot", nil))
+		if w.Code != http.StatusMethodNotAllowed {
+			t.Fatal("write method forwarded")
+		}
+	}
+}
+
+func TestForwardPublicHostOriginAndStream(t *testing.T) {
+	release := make(chan struct{})
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Host == "shop.my-mm.ir" || r.Header.Get("Origin") != "" {
+			t.Error("public host/origin leaked into local guard")
+		}
+		w.Header().Set("Content-Type", "text/event-stream")
+		w.Write([]byte("data: test\n\n"))
+		w.(http.Flusher).Flush()
+		select {
+		case <-release:
+		case <-r.Context().Done():
+		}
+	}))
+	defer upstream.Close()
+	target, _ := url.Parse(upstream.URL)
+	relay := httptest.NewServer(handler(target))
+	defer relay.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	req, _ := http.NewRequestWithContext(ctx, "GET", relay.URL+"/api/events", nil)
+	req.Host = "shop.my-mm.ir"
+	req.Header.Set("Origin", "https://shop.my-mm.ir")
+	response, err := http.DefaultClient.Do(req)
+	if err != nil {
+		close(release)
+		t.Fatal(err)
+	}
+	defer response.Body.Close()
+	line, err := bufio.NewReader(response.Body).ReadString('\n')
+	close(release)
+	if err != nil || line != "data: test\n" {
+		t.Fatal("stream buffered or missing")
+	}
+}