lhellebr · Oct 8, 2026 · amolpati30 · Oct 7, 2026 · lhellebr · Oct 8, 2026
diff --git a/development/playbooks/deploy-dev/metadata.obsah.yaml b/development/playbooks/deploy-dev/metadata.obsah.yaml
@@ -3,6 +3,11 @@ help: |
   Deploy and manage Foreman development environment with git-based Foreman and containerized backend services.
 
 variables:
+  server_aliases:
+    help: Server alias. Used for Subject Alternative Names in generated certificates and accepted server names. Can be specified multiple times.
+    action: append_unique
+    type: FQDN
+    parameter: --server-alias
   foreman_development_enabled_plugins:
     help: Plugin to enable (can be used multiple times)
     action: append

diff --git a/development/roles/foreman_development/templates/smart-proxy/settings.yml.j2 b/development/roles/foreman_development/templates/smart-proxy/settings.yml.j2
@@ -36,6 +36,7 @@
 #:foreman_url: http://127.0.0.1:3000
 
 :foreman_url: https://{{ ansible_facts['fqdn'] }}
+:permitted_hosts: {{ ([ansible_facts['fqdn']] + (server_aliases | default([]))) | to_json }}
 
 # SSL settings for client authentication against Foreman. If undefined, the values
 # from general SSL options are used instead. Mainly useful when Foreman uses

diff --git a/docs/user/certificates.md b/docs/user/certificates.md
@@ -111,6 +111,8 @@ Aliases passed to `auth-bundle` with `--proxy-alias` apply only to that invocati
 
 On each run the role compares the Subject Alternative Names in the existing server certificate against the desired list (hostname + any `--server-alias` values). If they differ, the CSR and certificate are regenerated automatically. This means both adding and removing aliases are handled transparently without manual cleanup.
 
+Server aliases are automatically added as `permitted_hosts` to foreman-proxy.
+
 ### Validity period
 
 When certificates are generated by foremanctl, you can control lifetimes in days:

diff --git a/docs/user/parameters.md b/docs/user/parameters.md
@@ -78,7 +78,7 @@ There are multiple use cases from the users perspective that dictate what parame
 
 | Parameter | Description | foreman-installer Parameter |
 | ----------| ----------- | --------------------------- |
-| `--server-alias` (on `deploy`) | Allows defining additional DNS names (SANs) for the main server's certificate | --certs-cname |
+| `--server-alias` (on `deploy`) | Allows defining additional DNS names (SANs) for the main server's certificate and permitted_hosts in foreman-proxy | --certs-cname |
 | `--proxy-alias` (on `auth-bundle`) | Allows defining additional DNS names (SANs) for a secondary system's certificate, e.g. a load-balanced proxy | --foreman-proxy-cname |
 | `--certificate-server-certificate` | Path to a custom server certificate to use instead of the auto-generated one. Requires `--certificate-source=custom_server` on `deploy`. | `--certs-server-cert` |
 | `--certificate-server-key` | Path to the private key for the custom server certificate. | `--certs-server-key` |

diff --git a/src/playbooks/deploy-proxy/metadata.obsah.yaml b/src/playbooks/deploy-proxy/metadata.obsah.yaml
@@ -19,4 +19,5 @@ variables:
 include:
   - _flavor_features
   - _flavors/foreman-proxy-content
+  - _server_aliases
   - _vendor_overrides/deploy-proxy
diff --git a/src/roles/foreman_proxy/defaults/main.yaml b/src/roles/foreman_proxy/defaults/main.yaml
@@ -8,6 +8,9 @@ foreman_proxy_url: "https://{{ foreman_proxy_name }}:{{ foreman_proxy_https_port
 
 # Settings
 foreman_proxy_trusted_hosts: []
+# Unlike trusted_hosts (authorized client machines), permitted_hosts lists the
+# proxy's own hostnames accepted in HTTP Host headers.
+foreman_proxy_permitted_hosts: "{{ [foreman_proxy_name] + (server_aliases | default([])) }}"
 
 foreman_proxy_base_features:
   - logs

diff --git a/src/roles/foreman_proxy/templates/settings.yml.j2 b/src/roles/foreman_proxy/templates/settings.yml.j2
@@ -1,6 +1,7 @@
 :settings_directory: /etc/foreman-proxy/settings.d
 
 :foreman_url: {{ foreman_proxy_foreman_server_url }}
+:permitted_hosts: {{ foreman_proxy_permitted_hosts | to_json }}
 :trusted_hosts:
 {% for host in foreman_proxy_trusted_hosts %}
   - {{ host }}

diff --git a/tests/conftest.py b/tests/conftest.py
@@ -388,7 +388,7 @@ def curl_request(server, certificates, quadlet_client_certificate, server_fqdn):
     server.run(f"echo '{cert}' > /tmp/quadlet.crt")
     server.run(f"echo '{key}' > /tmp/quadlet.key")
 
-    def _request(path, base_url=None, method=None, data=None, headers=None, return_body=False):
+    def _request(path, base_url=None, method=None, data=None, headers=None, return_body=False, resolve=None, insecure=False):
         url = f"{base_url or f'https://{server_fqdn}'}/{path}"
         curl_opts = (
             f"--cacert {certificates['server_ca_certificate']} "
@@ -398,6 +398,10 @@ def _request(path, base_url=None, method=None, data=None, headers=None, return_b
         )
         if not return_body:
             curl_opts += "--write-out '%{http_code}' --output /dev/null "
+        if resolve:
+            curl_opts += f"--resolve {resolve} "
+        if insecure:
+            curl_opts += "--insecure "
         if method:
             curl_opts += f"-X {method} "
         if data:

diff --git a/tests/feature/foreman-proxy/base_test.py b/tests/feature/foreman-proxy/base_test.py
@@ -2,6 +2,7 @@
 import json
 
 import pytest
+import yaml
 
 from tests.conftest import FOREMAN_PROXY_PORT
 
@@ -39,6 +40,49 @@ def test_foreman_proxy_features(curl_request, proxy_base_url, enabled_features):
         assert "container_gateway" not in features
 
 
+def test_foreman_proxy_permitted_hosts_config(server, server_fqdn, obsah_params):
+    cmd = server.run(
+        "podman secret inspect "
+        "--format '{{.SecretData}}' "
+        "--showsecret foreman-proxy-settings-yml"
+    )
+    assert cmd.succeeded
+
+    settings = yaml.safe_load(cmd.stdout)
+    expected_hosts = [server_fqdn] + (obsah_params.get('server_aliases') or [])
+    assert settings[':permitted_hosts'] == expected_hosts
+
+
+def test_foreman_proxy_host_injection(curl_request, server):
+    warning = 'permitted_hosts is configured but not enforced by this Sinatra version'
+    invocation_id = server.check_output(
+        "systemctl show foreman-proxy.service --property=InvocationID --value"
+    ).strip()
+    assert invocation_id, "Could not determine the current foreman-proxy service invocation"
+
+    journal = server.run(
+        f"journalctl -u foreman-proxy _SYSTEMD_INVOCATION_ID={invocation_id} --no-pager"
+    )
+    assert journal.succeeded, f"Failed to read foreman-proxy startup journal: {journal.stderr}"
+    if warning in journal.stdout:
+        pytest.skip("Host-header rejection is not supported by the installed Sinatra version")
+
+    host = 'evil.hackers.test'
+    request = {
+        'base_url': f"https://{host}:{FOREMAN_PROXY_PORT}",
+        'headers': {"Host": host},
+        'resolve': f"{host}:{FOREMAN_PROXY_PORT}:127.0.0.1",
+        'insecure': True,
+    }
+    status = curl_request("v2/features", **request)
+    assert status.succeeded, f"Failed to query Foreman Proxy: {status.stderr}"
+    assert status.stdout.strip() == '403', f"Expected HTTP 403, got {status.stdout.strip()}"
+
+    body = curl_request("v2/features", return_body=True, **request)
+    assert body.succeeded, f"Failed to query Foreman Proxy: {body.stderr}"
+    assert body.stdout.strip() == 'Host not permitted'
+
+
 def test_foreman_proxy_service(server):
     foreman_proxy = server.service("foreman-proxy")
     assert foreman_proxy.is_running