Odoo not isolated in Testing environment

[sgheller]

Hello,

I have my testing env set up with the following compose file but odoo is not being isolated.
There is no globalwhitelist running and in dev env isolation works as expected.

Thanks

test.yaml

  version: "2.4"

services:
  odoo:
    extends:
      file: common.yaml
      service: odoo
    env_file:
      - .docker/odoo.env
      - .docker/db-access.env
    environment:
      DOODBA_ENVIRONMENT: "${DOODBA_ENVIRONMENT-test}"
      # To install demo data export DOODBA_WITHOUT_DEMO=false
      WITHOUT_DEMO: "${DOODBA_WITHOUT_DEMO-all}"
      SMTP_PORT: "1025"
      SMTP_SERVER: smtplocal
    restart: unless-stopped
    depends_on:
      - db
      - smtp
    networks:
      default:
      inverseproxy_shared:
    labels:
      doodba.domain.main: "xxx"
      traefik.enable: "true"
      traefik.domain: "xxx"
      traefik.forbiddenCrawlers-0.frontend.headers.customResponseHeaders:
        "X-Robots-Tag:noindex, nofollow"
      traefik.forbiddenCrawlers-0.frontend.rule: Host:xxx;Path:/{anything:.*}
      traefik.longpolling-0.frontend.rule: Host:xxx;Path:/longpolling/{anything:.*}
      traefik.longpolling-0.port: 8072
      traefik.http.services.odoo-project-13-0-test-main.loadbalancer.server.port: 8069
      traefik.http.services.odoo-project-13-0-test-longpolling.loadbalancer.server.port: 8072
      traefik.http.routers.odoo-project-13-0-test-longpolling-0.rule:
        Host(`xxx`) && PathPrefix(`/longpolling/`)
      traefik.http.routers.odoo-project-13-0-test-longpolling-0.service: odoo-project-13-0-test-longpolling
      traefik.http.routers.odoo-project-13-0-test-longpolling-0.middlewares: odoo-project-13-0-test-forceSecure
      traefik.http.routers.odoo-project-13-0-test-longpolling-secure-0.rule:
        Host(`xxx`) && PathPrefix(`/longpolling/`)
      traefik.http.routers.odoo-project-13-0-test-longpolling-secure-0.service: odoo-project-13-0-test-longpolling
      traefik.http.routers.odoo-project-13-0-test-longpolling-secure-0.middlewares: odoo-project-13-0-test-forceSecure
      traefik.http.routers.odoo-project-13-0-test-longpolling-secure-0.tls: "true"
      traefik.http.routers.odoo-project-13-0-test-longpolling-secure-0.tls.certResolver: letsencrypt
      traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-0.rule:
        Host(`xxx`) && (PathPrefix(`/`))
      traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-0.service: odoo-project-13-0-test-main
      ? traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-0.middlewares
      : odoo-project-13-0-test-buffering, odoo-project-13-0-test-compress,
        odoo-project-13-0-test-forbid-crawlers,
        odoo-project-13-0-test-forceSecure
      ? traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-secure-0.rule
      : Host(`xxx`) && (PathPrefix(`/`))
      traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-secure-0.service: odoo-project-13-0-test-main
      ? traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-secure-0.middlewares
      : odoo-project-13-0-test-buffering, odoo-project-13-0-test-compress,
        odoo-project-13-0-test-forbid-crawlers,
        odoo-project-13-0-test-forceSecure
      traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-secure-0.tls: "true"
      traefik.http.routers.odoo-project-13-0-test-forbiddenCrawlers-secure-0.tls.certResolver: letsencrypt
    command:
      - odoo
      - --workers=2
      - --max-cron-threads=1

  db:
    extends:
      file: common.yaml
      service: db
    env_file:
      - .docker/db-creation.env
    restart: unless-stopped

  smtp:
    extends:
      file: common.yaml
      service: smtpfake
    restart: unless-stopped
    networks:
      default:
        aliases:
          - smtplocal
      inverseproxy_shared:
    labels:
      doodba.domain.main: "xxx"
      traefik.docker.network: "inverseproxy_shared"
      traefik.enable: "true"
      traefik.frontend.passHostHeader: "true"
      traefik.mailhog-0.frontend.rule: Host:xxx;PathPrefixStrip:/smtpfake/
      traefik.mailhog-0.port: 8025
      # Mailhog service
      traefik.http.middlewares.odoo-project-13-0-test-mailhog-stripprefix.stripPrefix.prefixes: /smtpfake/
      traefik.http.services.odoo-project-13-0-test-mailhog.loadbalancer.server.port: 8025
      ? traefik.http.middlewares.odoo-project-13-0-test-buffering.buffering.retryExpression
      : IsNetworkError() && Attempts() < 5
      traefik.http.middlewares.odoo-project-13-0-test-compress.compress: "true"
      ? traefik.http.middlewares.odoo-project-13-0-test-forbid-crawlers.headers.customResponseHeaders.X-Robots-Tag
      : "noindex, nofollow"
      traefik.http.middlewares.odoo-project-13-0-test-forceSecure.headers.forceSTSHeader: "true"
      traefik.http.middlewares.odoo-project-13-0-test-forceSecure.headers.sslRedirect: "true"
      traefik.http.routers.odoo-project-13-0-test-mailhog-0.rule:
        Host(`xxx`) && PathPrefix(`/smtpfake/`)
      traefik.http.routers.odoo-project-13-0-test-mailhog-0.service: odoo-project-13-0-test-mailhog
      traefik.http.routers.odoo-project-13-0-test-mailhog-0.middlewares:
        odoo-project-13-0-test-buffering, odoo-project-13-0-test-compress,
        odoo-project-13-0-test-forbid-crawlers,
        odoo-project-13-0-test-forceSecure,
        odoo-project-13-0-test-mailhog-stripprefix
      traefik.http.routers.odoo-project-13-0-test-mailhog-secure-0.rule:
        Host(`xxx`) && PathPrefix(`/smtpfake/`)
      traefik.http.routers.odoo-project-13-0-test-mailhog-secure-0.service: odoo-project-13-0-test-mailhog
      traefik.http.routers.odoo-project-13-0-test-mailhog-secure-0.middlewares:
        odoo-project-13-0-test-buffering, odoo-project-13-0-test-compress,
        odoo-project-13-0-test-forbid-crawlers,
        odoo-project-13-0-test-forceSecure,
        odoo-project-13-0-test-mailhog-stripprefix
      traefik.http.routers.odoo-project-13-0-test-mailhog-secure-0.tls: "true"
      traefik.http.routers.odoo-project-13-0-test-mailhog-secure-0.tls.certResolver: letsencrypt
    volumes:
      - "smtpconf:/etc/mailhog:ro,z"
    entrypoint: [sh, -c]
    command:
      - test -r /etc/mailhog/auth && export MH_AUTH_FILE=/etc/mailhog/auth; exec MailHog

networks:
  default:
    internal: true
    driver_opts:
      encrypted: 1

  inverseproxy_shared:
    external: true

volumes:
  filestore:
  db:
  smtpconf:

devel.yaml

version: "2.4"

services:
  odoo_proxy:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    depends_on:
      - odoo
    networks: &public
      default:
      public:
    ports:
      - "127.0.0.1:13899:6899"
      - "127.0.0.1:13069:8069"
    environment:
      PORT: "6899 8069"
      TARGET: odoo

  odoo:
    extends:
      file: common.yaml
      service: odoo
    build:
      args:
        # To aggregate in development, use `setup-devel.yaml`
        AGGREGATE: "false"
        # Export these variables to own files created by odoo in your filesystem
        UID: "${UID:-1000}"
        GID: "${GID:-1000}"
        # No need for this in development
        PIP_INSTALL_ODOO: "false"
        CLEAN: "false"
        COMPILE: "false"
    environment:
      DOODBA_ENVIRONMENT: "${DOODBA_ENVIRONMENT-devel}"
      LIST_DB: "true"
      DEBUGPY_ENABLE: "${DOODBA_DEBUGPY_ENABLE:-0}"
      PGDATABASE: &dbname devel
      PYTHONDONTWRITEBYTECODE: 1
      PYTHONOPTIMIZE: ""
      PYTHONPATH: /opt/odoo/custom/src/odoo
      SMTP_PORT: "1025"
      WDB_WEB_PORT: "13984"
      # To avoid installing demo data export DOODBA_WITHOUT_DEMO=all
      WITHOUT_DEMO: "${DOODBA_WITHOUT_DEMO-false}"
    volumes:
      - ./odoo/custom:/opt/odoo/custom:ro,z
      - ./odoo/auto:/opt/odoo/auto:rw,z
    depends_on:
      - db
      - proxy_cdnjs_cloudflare_com
      - proxy_fonts_googleapis_com
      - proxy_fonts_gstatic_com
      - proxy_www_google_com
      - proxy_www_googleapis_com
      - proxy_www_gravatar_com
      - smtp
      - wdb
    command:
      - odoo
      - --limit-memory-soft=0
      - --limit-time-real-cron=9999999
      - --limit-time-real=9999999
      - --workers=0
      - --dev=qweb,werkzeug,xml

  db:
    extends:
      file: common.yaml
      service: db
    environment:
      POSTGRES_DB: *dbname
      POSTGRES_PASSWORD: odoopassword

  pgweb:
    image: sosedoff/pgweb
    networks: *public
    ports:
      - "127.0.0.1:13081:8081"
    environment:
      DATABASE_URL: postgres://odoo:odoopassword@db:5432/devel?sslmode=disable
    depends_on:
      - db

  smtp:
    extends:
      file: common.yaml
      service: smtpfake
    networks: *public
    ports:
      - "127.0.0.1:13025:8025"

  wdb:
    image: kozea/wdb
    networks: *public
    ports:
      - "127.0.0.1:13984:1984"
    # HACK https://github.com/Kozea/wdb/issues/136
    init: true

  # Whitelist outgoing traffic for tests, reports, etc.
  proxy_wsaahomo_afip_gov_ar:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - wsaahomo.afip.gov.ar
      public:
    environment:
      TARGET: wsaahomo.afip.gov.ar
      PRE_RESOLVE: 1

  proxy_wswhomo_afip_gov_ar:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - wswhomo.afip.gov.ar
      public:
    environment:
      TARGET: wswhomo.afip.gov.ar
      PRE_RESOLVE: 1

  proxy_cdnjs_cloudflare_com:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - cdnjs.cloudflare.com
      public:
    environment:
      TARGET: cdnjs.cloudflare.com
      PRE_RESOLVE: 1

  proxy_fonts_googleapis_com:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - fonts.googleapis.com
      public:
    environment:
      TARGET: fonts.googleapis.com
      PRE_RESOLVE: 1

  proxy_fonts_gstatic_com:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - fonts.gstatic.com
      public:
    environment:
      TARGET: fonts.gstatic.com
      PRE_RESOLVE: 1

  proxy_www_google_com:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - www.google.com
      public:
    environment:
      TARGET: www.google.com
      PRE_RESOLVE: 1

  proxy_www_googleapis_com:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - www.googleapis.com
      public:
    environment:
      TARGET: www.googleapis.com
      PRE_RESOLVE: 1

  proxy_www_gravatar_com:
    image: ghcr.io/tecnativa/docker-whitelist:latest
    networks:
      default:
        aliases:
          - www.gravatar.com
      public:
    environment:
      TARGET: www.gravatar.com
      PRE_RESOLVE: 1

networks:
  default:
    internal: true
  public:

volumes:
  filestore:
  db:

[HviorForgeFlow]

Take a look here:
https://github.com/Tecnativa/doodba/tree/dbaaa2782a2d00e093063ebee3478c1d4093def3#global-whitelist

[sgheller]

I did, but shouldn't it be isolated by default? I'm not using the whitelist. Are my network configs ok?

[pedrobaeza]

It's isolated except whitelist by default.

[sgheller]

Answer:

Traefik docker-compose file only had one (public) network defined and shared with test.yaml.
Now this network was changed to internal and another one was created as public.

[pleirb]

@sgheller Is it too much trouble if you can give me the steps to follow to reproduce a success story that works in production mode? I've tried a little bit of everything and I'm still lost with this. From already thank you very much!

[pleirb]

@sgheller¿Es mucha molestia si me puedes dar los pasos a seguir para reproducir un caso de éxito que funcione en modo producción? He probado un poco de todo y sigo perdido con esto. Desde ya muchas gracias!

I answer myself, to solve, what they comment here has helped me: #418