diff options
| author | Eric Eastwood <erice@element.io> | 2023-07-05 18:53:55 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-07-05 18:53:55 -0500 |
| commit | b07b14b494ae1dd564b4c44f844c9a9545b3d08a (patch) | |
| tree | 3fadaf825910c72bb9fc1b4610610bbe6721eb1f /synapse/app | |
| parent | Remove support for Python 3.7 (#15851) (diff) | |
| download | synapse-b07b14b494ae1dd564b4c44f844c9a9545b3d08a.tar.xz | |
Federation outbound proxy (#15773)
Allow configuring the set of workers to proxy outbound federation traffic through (`outbound_federation_restricted_to`). This is useful when you have a worker setup with `federation_sender` instances responsible for sending outbound federation requests and want to make sure *all* outbound federation traffic goes through those instances. Before this change, the generic workers would still contact federation themselves for things like profile lookups, backfill, etc. This PR allows you to set more strict access controls/firewall for all workers and only allow the `federation_sender`'s to contact the outside world. The original code is from @erikjohnston's branches which I've gotten in-shape to merge.
Diffstat (limited to 'synapse/app')
| -rw-r--r-- | synapse/app/_base.py | 2 | ||||
| -rw-r--r-- | synapse/app/generic_worker.py | 1 | ||||
| -rw-r--r-- | synapse/app/homeserver.py | 1 |
3 files changed, 4 insertions, 0 deletions
diff --git a/synapse/app/_base.py b/synapse/app/_base.py index 936b1b0430..938ab40f27 100644 --- a/synapse/app/_base.py +++ b/synapse/app/_base.py @@ -386,6 +386,7 @@ def listen_unix( def listen_http( + hs: "HomeServer", listener_config: ListenerConfig, root_resource: Resource, version_string: str, @@ -406,6 +407,7 @@ def listen_http( version_string, max_request_body_size=max_request_body_size, reactor=reactor, + federation_agent=hs.get_federation_http_client().agent, ) if isinstance(listener_config, TCPListenerConfig): diff --git a/synapse/app/generic_worker.py b/synapse/app/generic_worker.py index 7406c3948c..dc79efcc14 100644 --- a/synapse/app/generic_worker.py +++ b/synapse/app/generic_worker.py @@ -221,6 +221,7 @@ class GenericWorkerServer(HomeServer): root_resource = create_resource_tree(resources, OptionsResource()) _base.listen_http( + self, listener_config, root_resource, self.version_string, diff --git a/synapse/app/homeserver.py b/synapse/app/homeserver.py index 84236ac299..f188c7265a 100644 --- a/synapse/app/homeserver.py +++ b/synapse/app/homeserver.py @@ -139,6 +139,7 @@ class SynapseHomeServer(HomeServer): root_resource = OptionsResource() ports = listen_http( + self, listener_config, create_resource_tree(resources, root_resource), self.version_string, |