wangjia
7d89ec9d91
- domains.md: 四组域名隔离登记 + 冷备池 ≥5 + 启用流程（不含身份信息） - cdn/terraform: Cloudflare 配置即代码（WAF/bot/速率限制/代理DNS/回源鉴权注入）+ 30min 重放 Runbook - server/internal/originauth: 回源鉴权中间件，非 CDN 网段或鉴权头不符一律 403，支持双值轮换 - tools/endpoint-signer: 离线 Ed25519 签名 CLI（端点 + 公告文档，单调版本防回滚，key_id 双公钥轮换） - tools/publish-mirrors: ≥3 镜像发布 + hash 一致性校验 + 故障转移取回 - CLIENT-CONTRACT.md: schema/验签/防回滚/合并/兜底链/channel 客户端契约 - 出站独立出口要求写入部署文档；私钥/token/身份信息一律不入库 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.1 KiB
Go
28 lines
1.1 KiB
Go
// Package originauth implements origin-hiding enforcement (doc/05 §2 源站隐藏 /
|
|
// 回源鉴权).
|
|
//
|
|
// The API only ever serves traffic through the CDN. The CDN is configured to
|
|
// 1. connect to the origin from a known set of egress IP ranges, and
|
|
// 2. inject a shared secret header (default X-Origin-Auth: <random>) on every
|
|
// origin request.
|
|
//
|
|
// This middleware rejects (403) any request that either does not originate from
|
|
// an allowed CDN egress range, or does not carry a recognised auth value — so a
|
|
// direct hit on the origin IP, bypassing the CDN, is refused.
|
|
//
|
|
// Rotation: the auth value is rotated quarterly (doc/06 §6). To make rotation
|
|
// zero-downtime the middleware accepts a Current value plus an optional Previous
|
|
// value, so both the old and new secret validate during the transition window.
|
|
// Comparison is constant-time.
|
|
//
|
|
// Wiring (not done automatically to keep /healthz reachable for CDN probes):
|
|
//
|
|
// mw, err := originauth.New(originauth.FromEnv())
|
|
// if err == nil {
|
|
// r.Group(func(pr chi.Router) {
|
|
// pr.Use(mw.Handler)
|
|
// // ... protected API routes ...
|
|
// })
|
|
// }
|
|
package originauth
|