Feat/nginx proxy and cert handling

.gitignore

@@ -9,3 +9,10 @@ htmlcov
 .pytest_cache
 local_blob_storage
 services/coverage.xml
+
+resources/nginx/ssl/*.crt
+resources/nginx/ssl/*.key
+resources/nginx/ssl/*.pem
+services/resources/ca/*.crt
+services/resources/ca/*.key
+services/resources/ca/*.pem

docker-compose-addons.yml

@@ -27,6 +27,8 @@ services:
 
       DESTINATION_DB: ${COUNT_DESTINATION_DB}
 
+      PG_SSL_REQUIRED: ${PG_SSL_REQUIRED:-True}
+
       MONGO_DB_URI: ${MONGO_DB_URI}
       MONGO_DB_NAME: ${CM_DATABASE_NAME}
       INPUT_COUNTS_MONGO_COLLECTION_NAME: ${INPUT_COUNTS_MONGO_COLLECTION_NAME}
@@ -35,6 +37,8 @@ services:
       KAFKA_BIGQUERY_TABLENAME: ${KAFKA_BIGQUERY_TABLENAME}
 
       LOGGING_LEVEL: ${COUNTS_LOGGING_LEVEL}
+    volumes:
+      - ./services/resources/ca:/etc/ssl/ca
     logging:
       options:
         max-size: '10m'
@@ -67,7 +71,11 @@ services:
       PG_DB_USER: ${PG_DB_USER}
       PG_DB_PASS: ${PG_DB_PASS}
 
+      PG_SSL_REQUIRED: ${PG_SSL_REQUIRED:-True}
+
       LOGGING_LEVEL: ${RSU_STATUS_LOGGING_LEVEL}
+    volumes:
+      - ./services/resources/ca:/etc/ssl/ca
     logging:
       options:
         max-size: '10m'
@@ -82,97 +90,97 @@ services:
       dockerfile: Dockerfile.iss_health_check
     image: iss_health_check:latest
     restart: on-failure:3
-    depends_on:
-      cvmanager_postgres:
-        condition: service_healthy
-        required: false
     environment:
-      STORAGE_TYPE: ${STORAGE_TYPE}
+      STORAGE_TYPE: ${STORAGE_TYPE:-POSTGRES}
 
       ISS_API_KEY: ${ISS_API_KEY}
       ISS_API_KEY_NAME: ${ISS_API_KEY_NAME}
       ISS_PROJECT_ID: ${ISS_PROJECT_ID}
       ISS_SCMS_TOKEN_REST_ENDPOINT: ${ISS_SCMS_TOKEN_REST_ENDPOINT}
       ISS_SCMS_VEHICLE_REST_ENDPOINT: ${ISS_SCMS_VEHICLE_REST_ENDPOINT}
-      ISS_KEY_TABLE_NAME: ${ISS_KEY_TABLE_NAME}
+      ISS_KEY_TABLE_NAME: ${ISS_KEY_TABLE_NAME:-iss_keys}
 
       PG_DB_HOST: ${PG_DB_HOST}
       PG_DB_NAME: ${PG_DB_NAME}
       PG_DB_USER: ${PG_DB_USER}
       PG_DB_PASS: ${PG_DB_PASS}
 
+      PG_SSL_REQUIRED: ${PG_SSL_REQUIRED:-True}
+
       PROJECT_ID: ${GCP_PROJECT_ID}
       GOOGLE_APPLICATION_CREDENTIALS: /home/gcp_key.json
 
       LOGGING_LEVEL: ${ISS_LOGGING_LEVEL}
     volumes:
       - ./resources/google/${GOOGLE_ACCESS_KEY_NAME}:/home/gcp_key.json
+      - ./services/resources/ca:/etc/ssl/ca
     logging:
       options:
         max-size: '10m'
         max-file: '5'
 
-  firmware_manager_upgrade_scheduler:
-    profiles:
-      - addons
-      - firmware_manager_upgrade_scheduler
-    build:
-      context: services
-      dockerfile: Dockerfile.fmus
-    image: jpo_firmware_manager_upgrade_scheduler:latest
-    restart: on-failure:3
-
-    ports:
-      - '8089:8080'
-    environment:
-      PG_DB_HOST: ${PG_DB_HOST}
-      PG_DB_NAME: postgres
-      PG_DB_USER: ${PG_DB_USER}
-      PG_DB_PASS: ${PG_DB_PASS}
-
-      UPGRADE_RUNNER_ENDPOINT: ${FIRMWARE_MANAGER_UPGRADE_RUNNER_ENDPOINT}
-
-      LOGGING_LEVEL: ${FIRMWARE_MANAGER_LOGGING_LEVEL}
-    volumes:
-      - ${HOST_BLOB_STORAGE_DIRECTORY}:/mnt/blob_storage
-    logging:
-      options:
-        max-size: '10m'
-        max-file: '5'
-
-  firmware_manager_upgrade_runner:
-    profiles:
-      - addons
-      - firmware_manager_upgrade_runner
-    build:
-      context: services
-      dockerfile: Dockerfile.fmur
-    image: jpo_firmware_manager_upgrade_runner:latest
-    restart: on-failure:3
-
-    ports:
-      - '8090:8080'
-    environment:
-      BLOB_STORAGE_PROVIDER: ${BLOB_STORAGE_PROVIDER}
-      BLOB_STORAGE_BUCKET: ${BLOB_STORAGE_BUCKET}
-
-      FW_UPGRADE_MAX_RETRY_LIMIT: ${FW_UPGRADE_MAX_RETRY_LIMIT}
-
-      GCP_PROJECT: ${GCP_PROJECT_ID}
-      GOOGLE_APPLICATION_CREDENTIALS: /home/gcp_key.json
-
-      SMTP_SERVER_IP: ${SMTP_SERVER_IP}
-      SMTP_EMAIL: ${SMTP_EMAIL}
-      SMTP_USERNAME: ${SMTP_USERNAME}
-      SMTP_PASSWORD: ${SMTP_PASSWORD}
-
-      UPGRADE_SCHEDULER_ENDPOINT: ${FIRMWARE_MANAGER_UPGRADE_SCHEDULER_ENDPOINT}
-
-      LOGGING_LEVEL: ${FIRMWARE_MANAGER_LOGGING_LEVEL}
-    volumes:
-      - ./resources/google/${GOOGLE_ACCESS_KEY_NAME}:/home/gcp_key.json
-      - ${HOST_BLOB_STORAGE_DIRECTORY}:/mnt/blob_storage
-    logging:
-      options:
-        max-size: '10m'
-        max-file: '5'
+#  firmware_manager_upgrade_scheduler:
+#    profiles:
+#      - addons
+#      - firmware_manager_upgrade_scheduler
+#    build:
+#      context: services
+#      dockerfile: Dockerfile.fmus
+#    image: jpo_firmware_manager_upgrade_scheduler:latest
+#    restart: on-failure:3
+#
+#    ports:
+#      - '8089:8080'
+#    environment:
+#      PG_DB_HOST: ${PG_DB_HOST}
+#      PG_DB_NAME: postgres
+#      PG_DB_USER: ${PG_DB_USER}
+#      PG_DB_PASS: ${PG_DB_PASS}
+#
+#      UPGRADE_RUNNER_ENDPOINT: ${FIRMWARE_MANAGER_UPGRADE_RUNNER_ENDPOINT}
+#
+#      LOGGING_LEVEL: ${FIRMWARE_MANAGER_LOGGING_LEVEL}
+#    volumes:
+#      - ${HOST_BLOB_STORAGE_DIRECTORY}:/mnt/blob_storage
+#    logging:
+#      options:
+#        max-size: '10m'
+#        max-file: '5'
+#
+#  firmware_manager_upgrade_runner:
+#    profiles:
+#      - addons
+#      - firmware_manager_upgrade_runner
+#    build:
+#      context: services
+#      dockerfile: Dockerfile.fmur
+#    image: jpo_firmware_manager_upgrade_runner:latest
+#    restart: on-failure:3
+#
+#    ports:
+#      - '8090:8080'
+#    environment:
+#      BLOB_STORAGE_PROVIDER: ${BLOB_STORAGE_PROVIDER}
+#      BLOB_STORAGE_BUCKET: ${BLOB_STORAGE_BUCKET}
+#
+#      FW_UPGRADE_MAX_RETRY_LIMIT: ${FW_UPGRADE_MAX_RETRY_LIMIT}
+#
+#      GCP_PROJECT: ${GCP_PROJECT_ID}
+#      GOOGLE_APPLICATION_CREDENTIALS: /home/gcp_key.json
+#
+#      SMTP_SERVER_IP: ${SMTP_SERVER_IP}
+#      SMTP_EMAIL: ${SMTP_EMAIL}
+#      SMTP_USERNAME: ${SMTP_USERNAME}
+#      SMTP_PASSWORD: ${SMTP_PASSWORD}
+#
+#      UPGRADE_SCHEDULER_ENDPOINT: ${FIRMWARE_MANAGER_UPGRADE_SCHEDULER_ENDPOINT}
+#
+#      LOGGING_LEVEL: ${FIRMWARE_MANAGER_LOGGING_LEVEL}
+#    volumes:
+#      - ./resources/google/${GOOGLE_ACCESS_KEY_NAME}:/home/gcp_key.json
+#      - ${HOST_BLOB_STORAGE_DIRECTORY}:/mnt/blob_storage
+#      - ${NGINX_PROXY_RESOURCES:-./resources/nginx}/ssl/server.crt:/etc/ssl/certs/server.crt
+#    logging:
+#      options:
+#        max-size: '10m'
+#        max-file: '5'

docker-compose.yml

@@ -5,6 +5,33 @@ include:
   - docker-compose-obu-ota-server.yml
 
 services:
+  cvmanager_nginx_proxy:
+    profiles:
+      - nginx_proxy
+    build:
+      context: ./resources/nginx
+      dockerfile: Dockerfile
+    image: cvmanager_nginx_proxy:latest
+    restart: unless-stopped
+    ports:
+      - 80:80
+      - 443:443
+    environment:
+      NGINX_ENVSUBST_OUTPUT_DIR: /etc/nginx
+      SERVER_HOST: ${WEBAPP_DOMAIN}
+    volumes:
+      - ./resources/nginx/nginx-ssl.conf:/etc/nginx/templates/nginx.conf.template
+      - ./resources/nginx/ssl:/etc/ssl
+    depends_on:
+      - cvmanager_webapp
+      - cvmanager_keycloak
+      - cvmanager_api
+      - cvmanager_postgres
+    logging:
+      options:
+        max-size: '10m'
+        max-file: '5'
+
   cvmanager_api:
     profiles:
       - basic
@@ -16,14 +43,11 @@ services:
     restart: always
     extra_hosts:
       ${WEBAPP_DOMAIN}: ${WEBAPP_HOST_IP}
-      ${KEYCLOAK_DOMAIN}: ${KC_HOST_IP}
-    ports:
-      - '8081:5000'
     environment:
       PG_DB_HOST: ${PG_DB_HOST}
       PG_DB_USER: ${PG_DB_USER}
       PG_DB_PASS: ${PG_DB_PASS}
-      PG_DB_NAME: postgres
+      PG_DB_NAME: ${PG_DB_NAME}
       INSTANCE_CONNECTION_NAME: ${INSTANCE_CONNECTION_NAME}
 
       MONGO_DB_URI: ${MONGO_DB_URI}
@@ -73,8 +97,14 @@ services:
 
       TIMEZONE: ${TIMEZONE}
       LOGGING_LEVEL: ${API_LOGGING_LEVEL}
+      KEYCLOAK_VERIFY: ${KEYCLOAK_VERIFY:-/etc/ssl/ca/ca.crt}
+      PG_SSL_REQUIRED: ${PG_SSL_REQUIRED:-True}
+      REQUESTS_CA_BUNDLE: /etc/ssl/ca/ca.crt
+    depends_on:
+      - cvmanager_postgres
     volumes:
       - ./resources/google/${GOOGLE_ACCESS_KEY_NAME}:/home/gcp_key.json
+      - ./services/resources/ca:/etc/ssl/ca
     logging:
       options:
         max-size: '10m'
@@ -119,9 +149,6 @@ services:
         required: false
     extra_hosts:
       ${WEBAPP_DOMAIN}: ${WEBAPP_HOST_IP}
-      ${KEYCLOAK_DOMAIN}: ${KC_HOST_IP}
-    ports:
-      - '80:80'
     logging:
       options:
         max-size: '10m'
@@ -162,39 +189,38 @@ services:
       cvmanager_postgres:
         required: false
         condition: service_started
-
     extra_hosts:
       ${WEBAPP_DOMAIN}: ${WEBAPP_HOST_IP}
-      ${KEYCLOAK_DOMAIN}: ${KC_HOST_IP}
-    ports:
-      - '8084:8080'
-      - '9000:9000'
     environment:
       KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN}
       KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
       WEBAPP_ORIGIN: ${WEBAPP_ENDPOINT}
       KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN}
       KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD}
       KC_HEALTH_ENABLED: 'true'
-      KC_LOG_LEVEL: ${KC_LOGGING_LEVEL}
+      KC_LOG_LEVEL: ${KC_LOGGING_LEVEL:-INFO}
       KC_DB: postgres
       KC_DB_URL: jdbc:postgresql://${PG_DB_HOST}/postgres?currentSchema=keycloak
       KC_DB_USERNAME: ${PG_DB_USER}
       KC_DB_PASSWORD: ${PG_DB_PASS}
       KC_HOSTNAME: ${KEYCLOAK_DOMAIN}
+      KC_HOSTNAME_PORT: 443
+      KC_HOSTNAME_STRICT_HTTPS: 'true'
+      KC_HOSTNAME_STRICT: 'false'
       KEYCLOAK_API_CLIENT_SECRET_KEY: ${KEYCLOAK_API_CLIENT_SECRET_KEY}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
-      KC_HOSTNAME_STRICT_HTTPS: 'false'
       KC_HTTP_ENABLED: 'true'
+      KC_PROXY_HEADERS: xforwarded
+      KC_HOSTNAME_STRICT_BACKCHANNEL: 'false'
     command:
       - start-dev
       - --import-realm
     logging:
       options:
         max-size: '10m'
     healthcheck:
-      test: ['CMD', 'curl', '-f', 'http://localhost:9000/health']
+      test: ['CMD', 'curl', '-f', 'http://localhost:8080/realms/master']
       interval: 30s
       timeout: 10s
       retries: 3

resources/keycloak/realm.json

@@ -27,7 +27,7 @@
     "oauth2DeviceCodeLifespan": 600,
     "oauth2DevicePollingInterval": 5,
     "enabled": true,
-    "sslRequired": "external",
+    "sslRequired": "all",
     "registrationAllowed": false,
     "registrationEmailAsUsername": false,
     "rememberMe": false,
@@ -688,8 +688,8 @@
         "enabled": true,
         "alwaysDisplayInConsole": false,
         "clientAuthenticatorType": "client-secret",
-        "redirectUris": ["http://localhost:3000/*", "http://localhost/*", "http://cvmanager.local.com/*"],
-        "webOrigins": ["http://localhost:3000", "http://localhost", "http://cvmanager.local.com"],
+        "redirectUris": ["http://localhost:3000/*", "http://localhost/*", "https://cvmanager.local.com/*"],
+        "webOrigins": ["http://localhost:3000", "http://localhost", "https://cvmanager.local.com"],
         "notBefore": 0,
         "bearerOnly": false,
         "consentRequired": false,

resources/nginx/Dockerfile

@@ -0,0 +1,14 @@
+FROM nginx:alpine
+
+# The official nginx image supports environment variable substitution in templates
+# placed in /etc/nginx/templates/*.template.
+# We mount the config in docker-compose, but we can also copy it here as a default.
+
+# Ensure we have openssl for dhparam generation if needed by the script
+RUN apk add --no-network --no-cache openssl || apk add --no-cache openssl
+
+# Ensure gen_dhparam.sh is executable when mounted
+COPY gen_dhparam.sh /docker-entrypoint.d/gen_dhparam.sh
+RUN chmod +x /docker-entrypoint.d/gen_dhparam.sh
+
+# The gen_dhparam.sh script will be executed by the entrypoint because it's in /docker-entrypoint.d/