diff --git a/dojo/middleware.py b/dojo/middleware.py index 733c66f4cd..8ca34a3d7c 100644 --- a/dojo/middleware.py +++ b/dojo/middleware.py @@ -6,6 +6,7 @@ from threading import local from django.db import models from django.urls import reverse +from django.http import HttpResponse logger = logging.getLogger(__name__) @@ -164,3 +165,21 @@ def __init__(self, get_response): def __call__(self, request): request.META.update(settings.ADDITIONAL_HEADERS) return self.get_response(request) + + +class HealthCheckMiddleware: + """ + Middleware that will allow for a healthcheck to return UP without the caller being in the + DJANGO ALLOWED_HOSTS list. Needed for AWS ALB healthchecks and improves general k8 healthchecks + """ + + def __init__(self, get_response): + + self.get_response = get_response + + def __call__(self, request): + if request.META['PATH_INFO'] == '/health': + return HttpResponse('UP!') + else: + response = self.get_response(request) + return response diff --git a/dojo/settings/settings.dist.py b/dojo/settings/settings.dist.py index ede8ae60f0..b84eb40bae 100644 --- a/dojo/settings/settings.dist.py +++ b/dojo/settings/settings.dist.py @@ -920,6 +920,7 @@ def generate_url(scheme, double_slashes, user, password, host, port, path, param # MIDDLEWARE # ------------------------------------------------------------------------------ DJANGO_MIDDLEWARE_CLASSES = [ + 'dojo.middleware.HealthCheckMiddleware', 'django.middleware.common.CommonMiddleware', 'dojo.middleware.APITrailingSlashMiddleware', 'dojo.middleware.DojoSytemSettingsMiddleware', diff --git a/helm/defectdojo/values.yaml b/helm/defectdojo/values.yaml index c9b098b770..4ee27a4fd9 100644 --- a/helm/defectdojo/values.yaml +++ b/helm/defectdojo/values.yaml @@ -201,6 +201,8 @@ django: # Depending on the size and complexity of your scans, you might want to increase the default ingress timeouts if you see repeated 504 Gateway Timeouts # nginx.ingress.kubernetes.io/proxy-read-timeout: "1800" # nginx.ingress.kubernetes.io/proxy-send-timeout: "1800" + # specific for AWS deployments Defectdojo has the /health endpoint for ALB healthchecks + # alb.ingress.kubernetes.io/healthcheck-path: /health nginx: tls: enabled: false diff --git a/nginx/nginx.conf b/nginx/nginx.conf index aaa62e7e43..f0368ed55e 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -72,7 +72,13 @@ http { include /etc/nginx/wsgi_params; access_log off; } - + # Used by AWS ALB health checks + location = /health { + limit_except GET { deny all; } + include /run/defectdojo/uwsgi_pass; + include /etc/nginx/wsgi_params; + access_log off; + } error_page 500 502 503 504 /50x.html; } diff --git a/nginx/nginx_TLS.conf b/nginx/nginx_TLS.conf index 59edae6e9c..cac7a89040 100644 --- a/nginx/nginx_TLS.conf +++ b/nginx/nginx_TLS.conf @@ -134,6 +134,13 @@ http { include /etc/nginx/wsgi_params; access_log off; } + # Used by AWS ALB health checks + location = /health { + limit_except GET { deny all; } + include /run/defectdojo/uwsgi_pass; + include /etc/nginx/wsgi_params; + access_log off; + } error_page 500 502 503 504 /50x.html; } }