Simplify reverse proxy, remove LUA if possible

[clepski]

User Story

As a developer I want stable integration tests. In the past year the integration tests broke multiple times because of the reverse proxy. Especially the LUA packages have caused a lot of problems, e.g. luarocks/luarocks#1797.

I want to simplify the reverse proxy, so it does not depend on outdated LUA packages such as lua-resty-openidc.

So that the integration tests do not break regularly anymore.

Acceptance criteria

• Remove dependencies on lua-resty-openidc
• Simplify reverse proxy where possible

Start with a spike first: 12 hours
Spike acceptance criteria: Proposal how to move foward.

[Sander3003]

https://traefik.io/pricing/ was one of the options mentioned before

[Sander3003]

https://caddyserver.com/ or https://www.envoyproxy.io/ or stay with OpenResty could be options as well

[clepski]

Options

Keep OpenResty

• No work to be done
• Configuration not that complex https://github.com/com-pas/compas-deployment/blob/main/compas/reverse-proxy/authenticate.include, https://github.com/com-pas/compas-deployment/blob/main/compas/reverse-proxy/nginx.conf
• Still dependant on Lua and lua-resty-openidc

Caddy

• Easy setup
• Does not provide Open ID Connect itself, so we have to use a plugin like https://github.com/greenpau/caddy-security
• Needs some config / code, see reference implementation https://github.com/authcrunch/authcrunch.github.io/blob/main/assets/conf/oauth/keycloak/Caddyfile

Traefik

• Config mostly through labels in the docker compose file
• Does support keycloak, see https://github.com/asatrya/keycloak-traefik-tutorial
• Less extendable than the other options, if config is not enough we might have a problem

Basic Nginx

• Does not provide Open ID Connect functionality
• We would have to implement a lot ourselves
• Reference implementation looks complex https://github.com/nginxinc/nginx-openid-connect/blob/main/openid_connect.js

Conclusion

🚫 Basic Nginx feels like too much work and implementation necessary.

🚫 Traefik is not extendable enough for our needs.

✅ Keeping OpenResty is of course the easiest option, the configuration is not as complex as first assumed. The main downside is Lua based plugins seem flaky.

✅ Caddy is a valid option as well, but it does require a plugin as well, which is not maintained by the Caddy developers. It does require some work to be setup, configured and tested.

[Sander3003]

@clepski do you have a preference how to move forward?

[clepski]

I am leaning towards keeping the current setup, because the configuration is not that complex and I don't know how long replacing it with Caddy would take.

[Sander3003]

Let's stick with Openresty, if the frustrations are getting to high, we can switch to Caddy server later.