Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add PUBLIC_ROUTE into nginx server_name #1046

Merged
merged 5 commits into from
Aug 30, 2023
Merged

Add PUBLIC_ROUTE into nginx server_name #1046

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dd1d942
Use host, not user-agent, to tell request from CloudFront or not
FuhuXia Aug 30, 2023
43b0fa8
disable nginx-cloudfront for now
FuhuXia Aug 30, 2023
7a5f391
change make validate-proxy
FuhuXia Aug 30, 2023
a3ddf94
re-enable nginx-cloudfront as step 3 of the deployment
FuhuXia Aug 30, 2023
d678031
Merge branch 'main' into ngnix-cloudfront-setting
FuhuXia Aug 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,12 +46,15 @@ test: build
# docker build -t ghcr.io/gsa/catalog.data.gov:latest ckan/
docker-compose -f docker-compose.yml -f docker-compose.test.yml up --abort-on-container-exit test

# everytime you added some new variables, you need to swap it with some test values
# and swap it back after the test. This is because "nginx -t" test cannot read env variables.
validate-proxy:
sed -i 's/{{nameservers}}/127.0.0.1/g' proxy/nginx.conf
sed -i 's/{{env "EXTERNAL_ROUTE"}}/127.0.0.2/g' proxy/nginx.conf proxy/nginx-cloudfront.conf
sed -i 's/{{env "INTERNAL_ROUTE"}}/127.0.0.3/g' proxy/nginx.conf
sed -i 's/{{env "EXTERNAL_ROUTE_ADMIN"}}/127.0.0.4/g' proxy/nginx.conf
sed -i 's/{{env "INTERNAL_ROUTE_ADMIN"}}/127.0.0.5/g' proxy/nginx.conf
sed -i 's/{{env "PUBLIC_ROUTE"}}/127.0.0.6/g' proxy/nginx.conf proxy/nginx-cloudfront.conf
sed -i 's/{{port}}/1111/g' proxy/nginx.conf proxy/nginx-common.conf
sed -i 's/{{env "PUBLIC_ROUTE"}}/test.com/g' proxy/nginx-cloudfront.conf proxy/nginx-authy.conf
sed -i 's#{{env "S3_URL"}}#http://test.com#g' proxy/nginx-common.conf
Expand All @@ -62,6 +65,7 @@ validate-proxy:
sed -i 's/127.0.0.3/{{env "INTERNAL_ROUTE"}}/g' proxy/nginx.conf
sed -i 's/127.0.0.4/{{env "EXTERNAL_ROUTE_ADMIN"}}/g' proxy/nginx.conf
sed -i 's/127.0.0.5/{{env "INTERNAL_ROUTE_ADMIN"}}/g' proxy/nginx.conf
sed -i 's/127.0.0.6/{{env "PUBLIC_ROUTE"}}/g' proxy/nginx.conf proxy/nginx-cloudfront.conf
sed -i 's/1111/{{port}}/g' proxy/nginx.conf proxy/nginx-common.conf
sed -i 's/test.com/{{env "PUBLIC_ROUTE"}}/g' proxy/nginx-cloudfront.conf
sed -i 's#http://test.com#{{env "S3_URL"}}#g' proxy/nginx-common.conf
Expand Down
4 changes: 3 additions & 1 deletion proxy/nginx-cloudfront.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,13 @@ if ($uri = "/api/action/status_show") {
set $onlyCF "${onlyCF}letMeIn,";
}

# we use EXTERNAL_ROUTE != PUBLIC_ROUTE to determine if we are behind a CDN
if ($somevariable != {{env "PUBLIC_ROUTE"}}) {
set $onlyCF "${onlyCF}onCDN,";
}

if ($http_user_agent != "Amazon CloudFront") {
# If host in request head is not public_route, then it is not from CloudFront
if ($http_host != {{env "PUBLIC_ROUTE"}}) {
set $onlyCF "${onlyCF}notFromCF";
}

Expand Down
3 changes: 2 additions & 1 deletion proxy/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ http {

# talk to the right internal app
map $server_name $internal_url {
{{env "PUBLIC_ROUTE"}} {{env "INTERNAL_ROUTE"}};
{{env "EXTERNAL_ROUTE"}} {{env "INTERNAL_ROUTE"}};
{{env "EXTERNAL_ROUTE_ADMIN"}} {{env "INTERNAL_ROUTE_ADMIN"}};
}
Expand All @@ -34,7 +35,7 @@ http {
## Gunicorn specs
server {
# catalog-web
server_name {{env "EXTERNAL_ROUTE"}};
server_name {{env "EXTERNAL_ROUTE"}} {{env "PUBLIC_ROUTE"}};

auth_basic auth_configured; # this is a placeholder value replaced by .profile. we should only add basic auth to staging.
auth_basic_user_file /home/vcap/app/etc/nginx/.htpasswd;
Expand Down