Added support for proxy url

[voldyman]

I run gokapi behind a Caddy server using reverse proxy as well as on my local network. Both setups have different hostnames and currently Gokapi only supports using one "public hostname" which leads to one endpoint failing to download (downloadPresigned uses the configured url).

This changes add support for respecting the X-Forwarded-* headers to respond with the appropriate hostname and fixes the issue.

[Forceu]

Thank you for your PR. Has there been any AI involved in this PR?

[voldyman]

Only when I was trying to figure out why the reverse proxy config in my Caddyfile wasn't working and the generated url used the internal hostname.
The code was written by hand and tested by had in my setup. I guess AI wouldn't have forgotten to fix the tests 😅

[Forceu]

Thank you for the quick response :) I would prefer not to add httpRequest *http.Request to all API entries, as the httpRequest is already submitted with requestParser.ProcessParameter(r *http.Request) error, which is called for all API entries. (Which would also make the reviewing of this PR a lot easier) ;)

If an API call requires the http.Request, you can add it to it's struct, which can for example been seen here:

Gokapi/internal/webserver/api/routing.go

Lines 343 to 350 in 5c1c147

	type paramFilesAdd struct {
	Request *http.Request
	}
	func (p *paramFilesAdd) ProcessParameter(r *http.Request) error {
	p.Request = r
	return nil
	}

[voldyman]

Gotcha, another option was to route the X-Forwarded-For value in the context and wire the context through the API.

• the X-Forwarded-For is higher level information than the request data for each request type
• although it'll keep the PR as sprawling as it is now

Which one do you prefer? i can update the PR after work today.

[Forceu]

I think the best way would be to include the *http.Request and pass it to the new function that returns the server URL. The default url can be retrieved with configuration.Get() - maybe it would be useful to refactor the proxy parsing function to a different package, to avoid an import cycle, but I can do that as well if you are not too proficient with Go.

[voldyman]

i think i kinda did what you asked, added the http.request to the params structs, didn't need to update any parsing code (it needs codegen that i wasn't sure of anyway).
does this look better?

[voldyman]

Let me know if you want any other change or if you want to implement it yourself

[Forceu]

Thanks, I will probably modify the PR a bit next week, unfortunately I don't have a lot of time in the coming days.

[jwwlyons]

Just wanted to weigh in that I've run into the same problem, running behind Caddy with a split domain:

I have the "admin" side of things protected with mTLS on one domain gokapi.mystuff.net and the public-facing things on a different subdomain, dl.gokapi.mystuff.net, without mTLS and with some limited allowed paths in Caddy so that only the things involved in file upload/download can get through.

But when I try to download from the admin page, it switches to the public URL, and then fails to download with an error
{"Result":"error","ErrorMessage":"Not authenticated"}
(I'm guessing because the session cookie isn't shared between the sub-domains?):

I can just edit the generated link back to my "private" URL (eg, remove the leading dl.) and it downloads just fine, but it would be nice if hitting the download button from the /admin or /filerequests page stayed on the domain that the request originated from, instead of going over to the public hostname