mirror of
https://github.com/hanzo-fi/gateway.git
synced 2026-10-30 20:34:40 +00:00
e1a9e6aa83
* feat: migrate audit log format to v2 with enhanced actor metadata BREAKING CHANGE: Audit log format has been upgraded from v1 to v2 Changes: - Add Actor object with identity, organization_id, stack_id, and ip_address - Extract organization_id and stack_id from STACK env var (format: "ORG-STACK") - Extract IP address with fallback chain: X-Forwarded-For > X-Real-IP > RemoteAddr - Extract trace_id from OpenTelemetry context - Restructure payload: move request/response into HTTP object - Add utility functions: parseStackEnv(), extractIPAddress(), extractTraceID() The new format provides better traceability and context for audit events: - Actor information centralized in dedicated object - OpenTelemetry integration for distributed tracing - Client IP tracking for security analysis - Organization and stack identification from environment Modified files: - internal/audit/messages/audit.go: New types, utility functions, updated payload structure - pkg/plugins/audit.go: Pass context and request to NewAuditMessagePayload() * fix: pre-commit * feat: Upgrade to go-libs/v3 * feat: Enhance audit plugin with authentication metadata and JWT verification * fix: update go-jose dependency to v4.0.5 and adjust indirect requirement to v3.0.4 * fix: set HTTP client timeout to 30 seconds in initKeySet function * chore: make auth optional and add all claims instead of just the subject --------- Co-authored-by: Geoffrey Ragot <[email protected]>
53 lines
973 B
Caddyfile
53 lines
973 B
Caddyfile
{
|
|
order versions after metrics
|
|
order audit after encode
|
|
debug
|
|
}
|
|
|
|
:80 {
|
|
tracing {
|
|
span gateway
|
|
}
|
|
|
|
# Audit plugin configuration
|
|
audit {
|
|
topic_name local-audit
|
|
organization_id local-org
|
|
stack_id local-stack
|
|
auth_issuer http://localhost/api/auth
|
|
auth_internal_url http://localhost/api/auth
|
|
|
|
# Kafka publisher
|
|
publisher_kafka_broker redpanda:29092
|
|
publisher_kafka_enabled false
|
|
publisher_kafka_tls_enabled false
|
|
publisher_kafka_sasl_enabled false
|
|
|
|
# Nats publisher
|
|
publisher_nats_enabled true
|
|
publisher_nats_url nats://nats:4222
|
|
publisher_nats_client_id gateway
|
|
}
|
|
|
|
# Ledger API reverse proxy
|
|
handle_path /api/ledger* {
|
|
reverse_proxy 127.0.0.1:3068
|
|
}
|
|
|
|
# Versions plugin endpoint
|
|
handle /versions {
|
|
versions {
|
|
region "local"
|
|
env "local"
|
|
endpoints {
|
|
ledger http://127.0.0.1:3068/_info http://127.0.0.1:3068/_healthcheck
|
|
}
|
|
}
|
|
}
|
|
|
|
# Catch-all for unhandled API routes
|
|
handle /api/* {
|
|
respond "Bad Gateway" 502
|
|
}
|
|
}
|