Foreman » Smart Proxy

I can't use foreman in production with this issue so a workaround I'm using at the moment is to add to the vhost something like this:

  <Location />
    Order Deny,Allow
    Deny from all
        Allow from <my allowed nets ex: 192.168.0.0/24>
        Allow from 127.0.0.1
  </Location>
  <Location ~ "^/unattended/(kickstart|built)$" >
    Order Deny,Allow
    Deny from all
        Allow from <my client nets where only unattended should be available>
      </Location>

This is a barrier to my use of Foreman for provisioning due to my clients being on an internal non-routed network. As a short-term fix we've used iptables on the smart-proxy (only system with external access to the foreman) to forward requests from the internal clients, my configuration also requires https://github.com/theforeman/foreman/pull/102 as well to completely resolve the issue.

I've tried my hand at allowing the Smart Proxy to manage the ACL for a Squid proxy, so hosts that can't reach Foreman directly can use the Squid proxy.

• https://github.com/doherty/smart-proxy/tree/969
• https://github.com/doherty/foreman/tree/969

For the record, it looks like clients still try to reach the Foreman server to do the "built" request. The ticket #1096 unfortunately did not solve what was in the subject text. Creating new ticket #11582 for this.