Drone infra behind firewall

[foooocus]

Did anyone here deploy drone infrastructure behind firewall? If so, appreciate if you could briefly tell me about the setup?
I’m specifically interested in GitHub integration part, where user authentication and authorization is done in addition to build triggers. If I use port 443 setup for SSL config, do I still need port 80 exposed to internet?
Also, I know there is an enterprise version of Drone, will that be of any help in this case?
TIA!

[chrisns]

I made and use https://github.com/pinked/clustered-drone/blob/master/docker-compose.yml because I’m a cheapskate so no ngrok with fixed names and also didn’t want to open ports on firewall
downside is that if someone knows my external localtunnel.me address they could claim it and receive my github webhook notifications - but I don’t have anything sensitive in commit messages to worry about protecting.

[erkolson (Erik)]

I have not set it up through a firewall but this might be helpful:

Drone behind Cloudfront

When drone is placed behind a reverse proxy or load balancer it cannot determine its actual url and will therefore have problems with oauth redirects, status updates, etc. For drone to determine its actual url you need to provide both the X-Forwarded-For and X-Forwarded-Proto header variables.

You will need something to proxy the :443 traffic through the firewall, no need for port 80

[foooocus]

Thanks for the responses!

No tunnel option for me @chrisns, so can’t do it.

@erkolson That is what I’m planning to do as well, to put drone behind NGINX server.