frank/opentsdb-auth-proxy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
9 commits 3 branches 3 tags 100 KiB
Rust 92.5%
Dockerfile 7.5%
Find a file
Frank Villaro-Dixon 2c55f5eb54
All checks were successful
ci / docker-build (push) Successful in 5m25s
Details
main: add some logging 
Signed-off-by: Frank Villaro-Dixon <frank@villaro-dixon.eu>
2024-05-25 00:07:15 +02:00
.forgejo/workflows build dockerfile 2024-05-24 23:03:29 +02:00
src main: add some logging 2024-05-25 00:07:15 +02:00
.dockerignore build dockerfile 2024-05-24 23:03:29 +02:00
.gitignore first commit 2024-05-24 21:34:23 +02:00
Cargo.lock main: add some logging 2024-05-25 00:07:15 +02:00
Cargo.toml main: add some logging 2024-05-25 00:07:15 +02:00
Dockerfile build dockerfile 2024-05-24 23:03:29 +02:00
example-cfg.yml example.yml: add trailing slash 2024-05-24 23:53:42 +02:00
README.md readme: fix img name 2024-05-24 23:32:12 +02:00

README.md

OpenTSDB Auth Proxy

This is a simple proxy for the OpenTSDB time series database. It handles authentication and authorization.

This proxy can be publicly exposed. When sending data to opentsdb, set the endpoint to this proxy instead. Each client will send the data alongside an authentication token.

If the token matches the host and the metric matches the list of allowed metrics, then the request is forwarded to the opentsdb server.

Images

You can find the images on:

Configuration

Take a look at the provided sample configuration

Authentication tokens

Right now, two authentication tokens are supported:

  • sha256
  • plain (not recommended)

Sha256

To generate a sha256 token for a specific producer, do the following:

# Generate a token
TOKEN=$(openssl rand -hex 20)
SHA=$(echo -n $TOKEN | sha256sum - | awk '{print $1}')

echo "Token for the device is $TOKEN . Sha256 is $SHA"
# Token for the device is 7a5becc5b5bb581522fd0bb8891bb99a70275620 . Sha256 is ac790471b321143716e7773d589af923236ebdd435ba17c671df3558becc5154

The producer will need to send its token on query string:

curl -X POST https://my-proxy/api/put?token=7a5....

You then need to specify the hash in the config file. This file is then "safe" if the token is reasonably random.

Plain

To be implemented; but don't do it.

Environment variables

The following env variables are supported:

  • CONFIG_FILE : the location of the config file
  • OPENTSDB_URL (in this case, don't set it in the config file)

Notes about exposing OpenTSDB

Currently, OpenTSDB does not support authentication. If you run opentsdb in a k8s cluster, protect its ingress too. Either via a different ingress class, or with specific per-ingress-ctrl anotations.