feat: listen on file descriptor

docs/content/en/configuration/miscellaneous/server.md

@@ -62,8 +62,8 @@ server:
 {{< ref-common ref="address" description="Common Syntax: Address" text="This option uses a common syntax. " >}}
 
 Configures the listener address for the Main HTTP Server. The address itself is a listener and the scheme must either be
-the `unix` scheme or one of the `tcp` schemes. It can configure the host, port, and path the listener responds to. If
-the path is configured to anything other than `/` Authelia will handle requests for both `/` and the configured path.
+the `unix` scheme, one of the `tcp` schemes or the `fd` scheme. It can configure the host, port, and path the listener responds to. If
+the path is configured to anything other than `/` Authelia will handle requests for both `/` and the configured path. For the `fd` scheme, the port number will be used as file descriptor.
 
 __Examples:__
 
@@ -82,6 +82,12 @@ server:
  address: unix:///var/run/authelia.sock
 ```
 
+```yaml
+server:
+ address: fd://:3
+# When running "systemd-socket-activate -l 9091 go run ./cmd/authelia", the connections to port 9091 will be forwaded to file descriptor 3.
+```
+
 ### asset_path
 
 {{< confkey type="string " required="no" >}}

internal/configuration/schema/const.go

@@ -149,17 +149,18 @@ const (
 
 // Address Schemes.
 const (
- AddressSchemeTCP = "tcp"
- AddressSchemeTCP4 = "tcp4"
- AddressSchemeTCP6 = "tcp6"
- AddressSchemeUDP = "udp"
- AddressSchemeUDP4 = "udp4"
- AddressSchemeUDP6 = "udp6"
- AddressSchemeUnix = "unix"
- AddressSchemeLDAP = "ldap"
- AddressSchemeLDAPS = "ldaps"
- AddressSchemeLDAPI = "ldapi"
- AddressSchemeSMTP = "smtp"
- AddressSchemeSUBMISSION = "submission"
- AddressSchemeSUBMISSIONS = "submissions"
+ AddressSchemeTCP = "tcp"
+ AddressSchemeTCP4 = "tcp4"
+ AddressSchemeTCP6 = "tcp6"
+ AddressSchemeUDP = "udp"
+ AddressSchemeUDP4 = "udp4"
+ AddressSchemeUDP6 = "udp6"
+ AddressSchemeUnix = "unix"
+ AddressSchemeLDAP = "ldap"
+ AddressSchemeLDAPS = "ldaps"
+ AddressSchemeLDAPI = "ldapi"
+ AddressSchemeSMTP = "smtp"
+ AddressSchemeSUBMISSION = "submission"
+ AddressSchemeSUBMISSIONS = "submissions"
+ AddressSchemeFileDescriptor = "fd"
 )

internal/configuration/schema/types_address.go

@@ -253,10 +253,10 @@ func (a *Address) IsExplicitlySecure() bool {
 // ValidateListener returns true if the Address is valid for a connection listener.
 func (a *Address) ValidateListener() error {
  switch a.Scheme() {
- case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix:
+ case AddressSchemeTCP, AddressSchemeTCP4, AddressSchemeTCP6, AddressSchemeUDP, AddressSchemeUDP4, AddressSchemeUDP6, AddressSchemeUnix, AddressSchemeFileDescriptor:
  break
  default:
- return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as '%s'", a.Scheme())
+ return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', 'unix', or 'fd' but is configured as '%s'", a.Scheme())
  }
 
  return nil
@@ -269,10 +269,10 @@ func (a *Address) ValidateHTTP() error {
  }
 
  switch a.Scheme() {
- case AddressSchemeUnix:
+ case AddressSchemeUnix, AddressSchemeFileDescriptor:
  return nil
  default:
- return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as '%s'", a.Scheme())
+ return fmt.Errorf("scheme must be one of 'tcp', 'tcp4', 'tcp6', 'unix', or 'fd' but is configured as '%s'", a.Scheme())
  }
 }
 
@@ -468,6 +468,10 @@ func (a *Address) validate() (err error) {
  if err = a.validateProtocol(); err != nil {
  return err
  }
+ case AddressSchemeFileDescriptor:
+ if err = a.validateFD(); err != nil {
+ return err
+ }
  }
 
  a.valid = true
@@ -545,3 +549,16 @@ func (a *Address) validateUnixSocket() (err error) {
 
  return nil
 }
+
+func (a *Address) validateFD() (err error) {
+ port := a.url.Port()
+
+ actualPort, err := strconv.Atoi(port)
+ if err != nil {
+ return err
+ }
+
+ a.setport(actualPort)
+
+ return nil
+}

internal/configuration/schema/types_address_test.go

@@ -122,6 +122,14 @@ func TestNewAddressFromString(t *testing.T) {
  "a://0.0.0.0",
  "",
  },
+ {
+ "ShouldParseFileDescriptor",
+ "fd://:4",
+ &Address{true, false, -1, 4, &url.URL{Scheme: "fd", Host: ":4"}},
+ ":4",
+ "fd://:4",
+ "",
+ },
  {
  "ShouldNotParseInvalidPort",
  "tcp://0.0.0.0:abc",
@@ -251,18 +259,18 @@ func TestAddress_ValidateErrors(t *testing.T) {
  &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeLDAP, Host: "127.0.0.1"}},
  "",
  "scheme must be one of 'smtp', 'submission', or 'submissions' but is configured as 'ldap'",
+ "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'unix', or 'fd' but is configured as 'ldap'",
  "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'",
- "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'ldap'",
- "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'ldap'",
+ "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', 'unix', or 'fd' but is configured as 'ldap'",
  },
  {
  "ShouldValidateSMTPAddress",
  &Address{true, false, -1, 0, &url.URL{Scheme: AddressSchemeSMTP, Host: "127.0.0.1"}},
  "scheme must be one of 'ldap', 'ldaps', or 'ldapi' but is configured as 'smtp'",
  "",
+ "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'unix', or 'fd' but is configured as 'smtp'",
  "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'",
- "scheme must be one of 'tcp', 'tcp4', 'tcp6', or 'unix' but is configured as 'smtp'",
- "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', or 'unix' but is configured as 'smtp'",
+ "scheme must be one of 'tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6', 'unix', or 'fd' but is configured as 'smtp'",
  },
  {
  "ShouldValidateTCPAddress",
@@ -436,6 +444,22 @@ func TestAddressOutputValues(t *testing.T) {
  assert.Equal(t, "example.com", address.Hostname())
  assert.Equal(t, "example.com:9092", address.NetworkAddress())
  assert.Equal(t, 9092, address.Port())
+
+ address = &Address{true, false, -1, 9091, &url.URL{Scheme: AddressSchemeTCP, Host: "0.0.0.0:9091"}}
+
+ assert.Equal(t, "tcp://0.0.0.0:9091", address.String())
+ assert.Equal(t, "tcp", address.Scheme())
+ assert.Equal(t, "0.0.0.0:9091", address.Host())
+ assert.Equal(t, "0.0.0.0", address.Hostname())
+ assert.Equal(t, "0.0.0.0:9091", address.NetworkAddress())
+ assert.Equal(t, 9091, address.Port())
+
+ listener, err = address.Listener()
+
+ assert.NotNil(t, listener)
+ assert.NoError(t, err)
+
+ assert.NoError(t, listener.Close())
 }
 
 func TestNewAddressUnix(t *testing.T) {

internal/configuration/schema/types_addresses_nix.go

@@ -5,6 +5,8 @@
 import (
  "fmt"
  "net"
+ "os"
+ "strconv"
  "syscall"
 )
 
@@ -23,6 +25,11 @@
 
  return ln, err
  }
+ if a.url.Scheme == AddressSchemeFileDescriptor {
+ fd := os.NewFile(uintptr(a.port), strconv.Itoa(a.port))
+ defer fd.Close()
+ return net.FileListener(fd)
+ }
 
  return net.Listen(a.Network(), a.NetworkAddress())
 }