api: allow auth delegation

1 files changed, 13 insertions, 6 deletions

diff --git a/src/main.rs b/src/main.rs
index a10eb73..b27db27 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -94,7 +94,8 @@ async fn main() -> Result<()> {
     // the spot, and startup (starting transports, bootstrap) can take minutes.
     let stop = watch_for_shutdown().context("Installing signal handlers")?;
     // A broken htpasswd will abort startup.
-    let auth_state = AuthState::new(args.htpasswd.as_deref().context("htpasswd is required")?)?;
+    let auth_state =
+        AuthState::from_settings(&args)?.context("htpasswd or user-header is required")?;
 
     info!(
         bind_addr = args.bind_addr.to_string(),
@@ -268,6 +269,9 @@ async fn main() -> Result<()> {
 
     // The node shutting down (`AppState::closing`): the server drains.
     let closing = state.closing.subscribe();
+    // With the address each request came from: a proxy's user header is believed from
+    // `--trusted-proxies` only (`api::auth`).
+    let app = app.into_make_service_with_connect_info::<std::net::SocketAddr>();
     let server_builder = axum::serve(listener, app).with_graceful_shutdown(async move {
         stopped(closing).await;
         info!("Shutdown signal received. Draining API connections...")
@@ -336,7 +340,7 @@ async fn main() -> Result<()> {
 #[cfg(feature = "libp2p")]
 async fn relay_only(args: &config::Settings) -> Result<()> {
     let stop = watch_for_shutdown().context("Installing signal handlers")?;
-    let auth_state = args.htpasswd.as_deref().map(AuthState::new).transpose()?;
+    let auth_state = AuthState::from_settings(args)?;
     let transport: Arc<dyn Transport> = Arc::new(transport::libp2p::Libp2pTransport::start(
         transport::libp2p::Libp2pConfig::from_settings(args, true)?,
     )?);
@@ -351,13 +355,16 @@ async fn relay_only(args: &config::Settings) -> Result<()> {
             info!(address = %listener.local_addr()?, "HTTP API listening");
             let stop = stop.clone();
             Some(tokio::spawn(async move {
-                axum::serve(listener, app)
-                    .with_graceful_shutdown(stopped(stop))
-                    .await
+                axum::serve(
+                    listener,
+                    app.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+                )
+                .with_graceful_shutdown(stopped(stop))
+                .await
             }))
         }
         None => {
-            info!("No htpasswd: no HTTP API");
+            info!("No htpasswd or user-header: no HTTP API");
             None
         }
     };