Skip to content

fix(caddy): stop 503 page HTML comment from re-leaking the stack identity #313

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Cre-eD wants to merge 1 commit into from
Closed

fix(caddy): stop 503 page HTML comment from re-leaking the stack identity #313

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pkg/clouds/pulumi/kubernetes/caddy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,14 @@ func DeployCaddyService(ctx *sdk.Context, caddy CaddyDeployment, input api.Resou
// - Operators can override the 503 body by mounting a different ConfigMap
// at /etc/caddy/pages/503.html without touching SC api code.
//
// Keep pages/503.html generic — it answers every unknown Host for
// unauthenticated clients, which cannot be distinguished from operators.
// No stack identifiers, internal paths, or remediation runbooks in the
// body OR in HTML comments (comments ship in the response too — that was
// the bug behind this very page once leaking the caddyfile-entry runbook).
// The operator runbook for "no backend route for this Host" is this
// comment block plus the generate-caddyfile init-container logs.
//
// Wrapped in `handle { ... }` so the directives below apply only to the
// 503 path and nothing else can short-circuit (e.g. `import hsts` redir
// firing before the response). We also intentionally do NOT `import hsts`
Expand Down
10 changes: 1 addition & 9 deletions pkg/clouds/pulumi/kubernetes/embed/caddy/pages/503.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,7 @@
article { display: block; text-align: left; width: 650px; margin: 0 auto; }
</style>

<!--
Public-facing body only. Do NOT add operator runbooks, stack
identifiers (simple-container.com / Caddy / k8s annotations), or
remediation hints here: this catch-all answers every unknown Host for
unauthenticated clients and cannot distinguish an operator from an
attacker. The runbook for "no backend route for this Host" lives in
pkg/clouds/pulumi/kubernetes/caddy.go (default 503 block rationale)
and in the generate-caddyfile init-container logs.
-->
<!-- Served to unauthenticated clients on any unknown host. Keep generic: no internal, infrastructure, or diagnostic detail (this comment ships in the response). -->
<article>
<h1>503 Service Unavailable</h1>
<p>This service is temporarily unavailable. Please try again in a few moments.</p>
Expand Down
Loading