Skip to content

Commit 5b9d355

Browse files
david-monichidavid-monichi
committed
feat: addes custom nginx to helm charts for CoMPAS services
Signed-off-by: David Monichi <[email protected]>
1 parent c5a515d commit 5b9d355

39 files changed

+541
-133
lines changed

‎helm/charts/compas-keycloak/resources/compas-realm.json‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1248,17 +1248,17 @@
12481248
"clientId": "cim-mapping",
12491249
"name": "CIM Mapping",
12501250
"description": "CIM Mapping Service to convert CIM Data to SCL Data",
1251-
"rootUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1252-
"adminUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1251+
"rootUrl": "{{ .Values.public.keycloak.hostname }}/",
1252+
"adminUrl": "{{ .Values.public.keycloak.hostname }}/",
12531253
"surrogateAuthRequired": false,
12541254
"enabled": true,
12551255
"alwaysDisplayInConsole": false,
12561256
"clientAuthenticatorType": "client-secret",
12571257
"redirectUris": [
1258-
"{{ .Values.global.keycloak.baseUrl }}/*"
1258+
"{{ .Values.public.keycloak.hostname }}/*"
12591259
],
12601260
"webOrigins": [
1261-
"{{ .Values.global.keycloak.baseUrl }}"
1261+
"{{ .Values.public.keycloak.hostname }}"
12621262
],
12631263
"notBefore": 0,
12641264
"bearerOnly": false,
@@ -1328,17 +1328,17 @@
13281328
{
13291329
"id": "ace17366-e696-4821-9f24-89b797acb736",
13301330
"clientId": "openscd",
1331-
"rootUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1332-
"adminUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1331+
"rootUrl": "{{ .Values.public.keycloak.hostname }}/",
1332+
"adminUrl": "{{ .Values.public.keycloak.hostname }}/",
13331333
"surrogateAuthRequired": false,
13341334
"enabled": true,
13351335
"alwaysDisplayInConsole": false,
13361336
"clientAuthenticatorType": "client-secret",
13371337
"redirectUris": [
1338-
"{{ .Values.global.keycloak.baseUrl }}/*"
1338+
"{{ .Values.public.keycloak.hostname }}/*"
13391339
],
13401340
"webOrigins": [
1341-
"{{ .Values.global.keycloak.baseUrl }}"
1341+
"{{ .Values.public.keycloak.hostname }}"
13421342
],
13431343
"notBefore": 0,
13441344
"bearerOnly": false,
@@ -1447,17 +1447,17 @@
14471447
"clientId": "scl-auto-alignment",
14481448
"name": "SCL Auto Alignment Service",
14491449
"description": "The SCL Auto Alignment Service for calculating XY Coordinates",
1450-
"rootUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1451-
"adminUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1450+
"rootUrl": "{{ .Values.public.keycloak.hostname }}/",
1451+
"adminUrl": "{{ .Values.public.keycloak.hostname }}/",
14521452
"surrogateAuthRequired": false,
14531453
"enabled": true,
14541454
"alwaysDisplayInConsole": false,
14551455
"clientAuthenticatorType": "client-secret",
14561456
"redirectUris": [
1457-
"{{ .Values.global.keycloak.baseUrl }}/*"
1457+
"{{ .Values.public.keycloak.hostname }}/*"
14581458
],
14591459
"webOrigins": [
1460-
"{{ .Values.global.keycloak.baseUrl }}"
1460+
"{{ .Values.public.keycloak.hostname }}"
14611461
],
14621462
"notBefore": 0,
14631463
"bearerOnly": false,
@@ -1529,17 +1529,17 @@
15291529
"clientId": "scl-data-service",
15301530
"name": "SCL Data Service",
15311531
"description": "The SCL Data Service for storing / retrieving SCLs",
1532-
"rootUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1533-
"adminUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1532+
"rootUrl": "{{ .Values.public.keycloak.hostname }}/",
1533+
"adminUrl": "{{ .Values.public.keycloak.hostname }}/",
15341534
"surrogateAuthRequired": false,
15351535
"enabled": true,
15361536
"alwaysDisplayInConsole": false,
15371537
"clientAuthenticatorType": "client-secret",
15381538
"redirectUris": [
1539-
"{{ .Values.global.keycloak.baseUrl }}/*"
1539+
"{{ .Values.public.keycloak.hostname }}/*"
15401540
],
15411541
"webOrigins": [
1542-
"{{ .Values.global.keycloak.baseUrl }}"
1542+
"{{ .Values.public.keycloak.hostname }}"
15431543
],
15441544
"notBefore": 0,
15451545
"bearerOnly": false,
@@ -1611,17 +1611,17 @@
16111611
"clientId": "scl-validator",
16121612
"name": "SCL Validator Service",
16131613
"description": "The SCL Validator Service to validate SCL Files",
1614-
"rootUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1615-
"adminUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1614+
"rootUrl": "{{ .Values.public.keycloak.hostname }}/",
1615+
"adminUrl": "{{ .Values.public.keycloak.hostname }}/",
16161616
"surrogateAuthRequired": false,
16171617
"enabled": true,
16181618
"alwaysDisplayInConsole": false,
16191619
"clientAuthenticatorType": "client-secret",
16201620
"redirectUris": [
1621-
"{{ .Values.global.keycloak.baseUrl }}/*"
1621+
"{{ .Values.public.keycloak.hostname }}/*"
16221622
],
16231623
"webOrigins": [
1624-
"{{ .Values.global.keycloak.baseUrl }}"
1624+
"{{ .Values.public.keycloak.hostname }}"
16251625
],
16261626
"notBefore": 0,
16271627
"bearerOnly": false,
@@ -1693,17 +1693,17 @@
16931693
"clientId": "sitipe-service",
16941694
"name": "Sitipe Service",
16951695
"description": "The Sitipe Service to retrieve Sitipe related data",
1696-
"rootUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1697-
"adminUrl": "{{ .Values.global.keycloak.baseUrl }}/",
1696+
"rootUrl": "{{ .Values.public.keycloak.hostname }}/",
1697+
"adminUrl": "{{ .Values.public.keycloak.hostname }}/",
16981698
"surrogateAuthRequired": false,
16991699
"enabled": true,
17001700
"alwaysDisplayInConsole": false,
17011701
"clientAuthenticatorType": "client-secret",
17021702
"redirectUris": [
1703-
"{{ .Values.global.keycloak.baseUrl }}/*"
1703+
"{{ .Values.public.keycloak.hostname }}/*"
17041704
],
17051705
"webOrigins": [
1706-
"{{ .Values.global.keycloak.baseUrl }}"
1706+
"{{ .Values.public.keycloak.hostname }}"
17071707
],
17081708
"notBefore": 0,
17091709
"bearerOnly": false,
@@ -3204,7 +3204,7 @@
32043204
"clientSessionIdleTimeout": "0",
32053205
"parRequestUriLifespan": "60",
32063206
"clientSessionMaxLifespan": "0",
3207-
"frontendUrl": "{{ .Values.global.keycloak.baseUrl }}/auth",
3207+
"frontendUrl": "{{ .Values.public.keycloak.hostname }}/auth",
32083208
"clientOfflineSessionIdleTimeout": "0",
32093209
"cibaInterval": "5"
32103210
},

‎helm/charts/compas-keycloak/values.yaml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
11
config:
22
keycloak:
3-
keycloakUrl: "http://localhost/"
4-
clientUrl: "http://localhost/"
3+
keycloakUrl: "http://compas.local/"
4+
clientUrl: "http://compas.local/"
5+
6+
service:
7+
environment:
8+
public:
9+
keycloak:
10+
realm: compas
511

612
keycloak:
713
postgresql:
814
enabled: false
915

1016
ingress:
1117
enabled: true;
12-
hostname: "localhost"
18+
hostname: "compas.local"
1319
annotations:
1420
alb.ingress.kubernetes.io/group.name: "openscd"
15-
external-dns.alpha.kubernetes.io/hostname: localhost
21+
external-dns.alpha.kubernetes.io/hostname: compas.local
1622
kubernetes.io/ingress.class: nginx
1723

1824
extraEnvVars:

‎helm/charts/compas-nginx/resources/authenticate.include‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
access_by_lua_block {
2+
local opts = {
3+
redirect_uri = "http://compas.local/redirect_uri",
4+
discovery = "http://compas.local/realms/compas/.well-known/openid-configuration",
5+
client_id = "openscd",
6+
redirect_uri_scheme = "http",
7+
logout_path = "/logout",
8+
redirect_after_logout_uri = "http://compas.local/realms/compas/protocol/openid-connect/logout?redirect_uri=http://compas.local/",
9+
redirect_after_logout_with_id_token_hint = false,
10+
session_contents = {id_token=true, access_token=true},
11+
renew_access_token_on_expiry = true,
12+
}
13+
14+
-- call introspect for OAuth 2.0 Bearer Access Token validation
15+
local res, err = require("resty.openidc").authenticate(opts)
16+
17+
if err then
18+
ngx.status = 403
19+
ngx.say(err)
20+
ngx.exit(ngx.HTTP_FORBIDDEN)
21+
end
22+
23+
ngx.var.access_token = res.access_token
24+
}

‎helm/charts/compas-nginx/resources/nginx.conf‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
worker_processes 1;
2+
error_log /var/log/nginx/error.log debug;
3+
pid /var/run/nginx.pid;
4+
5+
events {
6+
worker_connections 1024;
7+
}
8+
9+
http {
10+
# set search paths for pure Lua external libraries (';;' is the default path):
11+
lua_package_path '/usr/local/openresty/lualib/?.lua;;';
12+
# cache for discovery metadata documents
13+
lua_shared_dict discovery 1m;
14+
# cache for JWKs
15+
lua_shared_dict jwks 1m;
16+
17+
resolver 127.0.0.11;
18+
index index.html index.htm;
19+
20+
server {
21+
set $access_token '';
22+
set $session_cookie_samesite off;
23+
set $session_name compas_session;
24+
25+
listen 80 default_server;
26+
listen [::]:80 default_server;
27+
server_name reverse-proxy;
28+
29+
# set client body size to 150M #
30+
client_max_body_size 150M;
31+
32+
# I disabled caching so the browser won't cache the site.
33+
expires 0;
34+
add_header Cache-Control private;
35+
36+
# Default forward all web calls to the OpenSCD Container
37+
location / {
38+
include /etc/nginx/include/authenticate.include;
39+
40+
proxy_set_header X-Real-IP $remote_addr;
41+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
42+
proxy_set_header X-Forwarded-Proto $scheme;
43+
proxy_set_header X-Forwarded-Port $server_port;
44+
45+
proxy_pass http://compas-openscd/;
46+
47+
proxy_set_header Host $http_host;
48+
proxy_cache_bypass $http_upgrade;
49+
proxy_redirect off;
50+
}
51+
52+
# Forwarding to KeyCloak container.
53+
location /realms/ {
54+
proxy_set_header X-Real-IP $remote_addr;
55+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
56+
proxy_set_header X-Forwarded-Proto $scheme;
57+
proxy_set_header X-Forwarded-Port $server_port;
58+
59+
proxy_pass http://compas-keycloak/realms/;
60+
61+
proxy_set_header Host $http_host;
62+
proxy_cache_bypass $http_upgrade;
63+
proxy_redirect off;
64+
}
65+
66+
# Forwarding to KeyCloak container.
67+
location /auth/ {
68+
proxy_set_header X-Real-IP $remote_addr;
69+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
70+
proxy_set_header X-Forwarded-Proto $scheme;
71+
proxy_set_header X-Forwarded-Port $server_port;
72+
73+
proxy_pass http://compas-keycloak/auth/;
74+
75+
proxy_set_header Host $http_host;
76+
proxy_cache_bypass $http_upgrade;
77+
proxy_redirect off;
78+
}
79+
80+
# Forwarding to the SCL Validator Service container (websockets).
81+
location /compas-scl-data-service/scl-ws/ {
82+
include /etc/nginx/include/authenticate.include;
83+
84+
proxy_http_version 1.1;
85+
proxy_set_header Upgrade $http_upgrade;
86+
proxy_set_header Connection "Upgrade";
87+
proxy_set_header Host $host;
88+
89+
proxy_set_header X-Real-IP $remote_addr;
90+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
91+
proxy_set_header X-Forwarded-Proto $scheme;
92+
proxy_set_header X-Forwarded-Port $server_port;
93+
proxy_set_header Authorization "Bearer ${access_token}";
94+
95+
proxy_pass http://compas-keycloak/compas-scl-data-service/scl-ws/;
96+
}
97+
98+
# Forwarding to the SCL Data Service container.
99+
location /compas-scl-data-service/ {
100+
include /etc/nginx/include/authenticate.include;
101+
102+
proxy_set_header X-Real-IP $remote_addr;
103+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
104+
proxy_set_header X-Forwarded-Proto $scheme;
105+
proxy_set_header X-Forwarded-Port $server_port;
106+
proxy_set_header Authorization "Bearer ${access_token}";
107+
108+
proxy_pass http://compas-keycloak/compas-scl-data-service/;
109+
110+
proxy_set_header Host $http_host;
111+
proxy_cache_bypass $http_upgrade;
112+
proxy_redirect off;
113+
}
114+
115+
# Forwarding to the CIM Mapping Service container.
116+
location /compas-cim-mapping/ {
117+
include /etc/nginx/include/authenticate.include;
118+
119+
proxy_set_header X-Real-IP $remote_addr;
120+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
121+
proxy_set_header X-Forwarded-Proto $scheme;
122+
proxy_set_header X-Forwarded-Port $server_port;
123+
proxy_set_header Authorization "Bearer ${access_token}";
124+
125+
proxy_pass http://compas-keycloak/compas-cim-mapping/;
126+
127+
proxy_set_header Host $http_host;
128+
proxy_cache_bypass $http_upgrade;
129+
proxy_redirect off;
130+
}
131+
132+
# Forwarding to the SCL Auto Alignment Service container.
133+
location /compas-scl-auto-alignment/ {
134+
include /etc/nginx/include/authenticate.include;
135+
136+
proxy_set_header X-Real-IP $remote_addr;
137+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
138+
proxy_set_header X-Forwarded-Proto $scheme;
139+
proxy_set_header X-Forwarded-Port $server_port;
140+
proxy_set_header Authorization "Bearer ${access_token}";
141+
142+
proxy_pass http://compas-keycloak/compas-scl-auto-alignment/;
143+
144+
proxy_set_header Host $http_host;
145+
proxy_cache_bypass $http_upgrade;
146+
proxy_redirect off;
147+
}
148+
149+
# Forwarding to the SCL Validator Service container (websockets).
150+
location /compas-scl-validator/validate-ws/ {
151+
include /etc/nginx/include/authenticate.include;
152+
153+
proxy_http_version 1.1;
154+
proxy_set_header Upgrade $http_upgrade;
155+
proxy_set_header Connection "Upgrade";
156+
proxy_set_header Host $host;
157+
158+
proxy_set_header X-Real-IP $remote_addr;
159+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
160+
proxy_set_header X-Forwarded-Proto $scheme;
161+
proxy_set_header X-Forwarded-Port $server_port;
162+
proxy_set_header Authorization "Bearer ${access_token}";
163+
164+
proxy_pass http://compas-keycloak/compas-scl-validator/validate-ws/;
165+
}
166+
167+
# Forwarding to the SCL Validator Service container (http).
168+
location /compas-scl-validator/ {
169+
include /etc/nginx/include/authenticate.include;
170+
171+
proxy_set_header Host $http_host;
172+
173+
proxy_set_header X-Real-IP $remote_addr;
174+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
175+
proxy_set_header X-Forwarded-Proto $scheme;
176+
proxy_set_header X-Forwarded-Port $server_port;
177+
proxy_set_header Authorization "Bearer ${access_token}";
178+
179+
proxy_pass http://compas-keycloak/compas-scl-validator/;
180+
181+
proxy_cache_bypass $http_upgrade;
182+
proxy_redirect off;
183+
}
184+
185+
# redirect server error pages to the static page /40x.html
186+
error_page 404 /404.html;
187+
location = /40x.html {
188+
}
189+
# redirect server error pages to the static page /50x.html
190+
error_page 500 502 503 504 /50x.html;
191+
location = /50x.html {
192+
}
193+
}
194+
}

‎helm/charts/compas-nginx/templates/_helpers.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
4646
Selector labels
4747
*/}}
4848
{{- define "application.selectorLabels" -}}
49-
app.kubernetes.io/name: {{ include ".Chart.name" . }}
49+
app.kubernetes.io/name: {{ .Chart.Name }}
5050
app.kubernetes.io/instance: {{ .Release.Name }}
5151
{{- end }}
5252

0 commit comments

Comments
 (0)