colin
/
better-argo-tunnels
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix basicauth: don't double dollar signs for docker service update
ci/woodpecker/push/woodpecker Pipeline was successful Details 

The bcrypt hash was escaping $ to $$ which is only needed in compose
files. docker service update --label-add with single-quoted values
preserves dollar signs literally, so doubling them broke Traefik auth.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Leopere 2026-02-09 14:46:50 -05:00
parent 2867c2bb0a
commit 85a286e5f1
Signed by: colin
SSH Key Fingerprint: SHA256:nRPCQTeMFLdGytxRQmPVK9VXY3/ePKQ5lGRyJhT5DY8
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
internal/server/labels.go
View File

@ -161,15 +161,15 @@ func (lm *LabelManager) Remove(tunKey string) error {
} }
// generateHTPasswd creates a bcrypt-hashed htpasswd entry for Traefik basicauth. // generateHTPasswd creates a bcrypt-hashed htpasswd entry for Traefik basicauth.
// The output format is user:$$hash (with $ escaped for Docker label values). // The output format is user:$hash. Dollar signs are NOT doubled here because
// we pass labels via docker service update with single-quoted values, which
// preserves them literally. Doubling is only needed in compose files.
func generateHTPasswd(user, pass string) (string, error) { func generateHTPasswd(user, pass string) (string, error) {
hash, err := bcrypt.GenerateFromPassword([]byte(pass), bcrypt.DefaultCost) hash, err := bcrypt.GenerateFromPassword([]byte(pass), bcrypt.DefaultCost)
if err != nil { if err != nil {
return "", fmt.Errorf("bcrypt hash: %w", err) return "", fmt.Errorf("bcrypt hash: %w", err)
} }
// Traefik in Docker labels requires dollar signs to be doubled. return fmt.Sprintf("%s:%s", user, string(hash)), nil
escaped := strings.ReplaceAll(string(hash), "$", "$$")
return fmt.Sprintf("%s:%s", user, escaped), nil
} }
// labelFlag formats a --label-add value, quoting properly for shell. // labelFlag formats a --label-add value, quoting properly for shell.