kOlapsis/maintenant v1.6.1

Fix : Limit URL found per container with proxy-labels

on GitHub

A fix for MAINTENANT_PROXY_LABELS, the reverse proxy label discovery introduced in 1.6.0. If you turned it on, upgrade: the previous behaviour could raise alerts on routes that were never meant to be checked.

One endpoint per container

Discovery created an endpoint for every URL found on a container. But a container routinely declares several routers for the same service: a main route, a websocket route on a path, an API route, sometimes a route behind an authentication middleware. The endpoint list filled up with near duplicates, and the routes that answer 401 to an anonymous checker, or that are not meant to be reached by a plain GET, went down and paged you.

Every candidate URL is still collected, but a single one is now kept, chosen in this order:

1. No authentication in front of it. Traefik's basicauth, digestauth and forwardauth, a middleware whose name contains auth (Authelia and Authentik are declared on the proxy, so the name is all there is to go on), and Caddy's basicauth and forward_auth.
2. No path, and between two paths the shorter one.
3. https over http.
4. Lowest URL alphabetically, so the same container always gives the same endpoint across restarts.

A container with Host(`app.example.com`) on one router and Host(`app.example.com`) && PathPrefix(`/ws`) on another is now monitored once, at the root. The hostname added to maintenant.tls.certificates follows the selected URL.

Upgrading

No migration, nothing to configure. The endpoints discovery no longer declares are deactivated on the next label sync, at startup or when the container next changes state, so the extra ones stop being checked on their own. Their past checks stay in the history. Endpoints you created yourself, and explicit maintenant.endpoint.* labels, were never affected.