-
Notifications
You must be signed in to change notification settings - Fork 15
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Setup proxy configuration * Update documentation for proxy changes
- Loading branch information
1 parent
0d4ef47
commit 7393d6d
Showing
11 changed files
with
134 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ | |
| | AWS_ACCESS_KEY_ID | Access key for S3, provided as a Cloud.gov Service | | | ||
| | AWS_SECRET_ACCESS_KEY | Secret Access key for S3, provided as a Cloud.gov Service | | | ||
| | BUCKET_NAME | Bucket Name for S3, provided as a Cloud.gov Service | | | ||
| | CHALLENGE_OWNER_ASSUMED_TLDS | By default, only .gov email addresses are assumed to want the Challenge Manager role, this allows other government TLD values to also be considered as wanting the Challenge Manager role | .mil | | ||
| | CHALLENGE_OWNER_ASSUMED_TLDS | By default, only .gov email addresses are assumed to want the Challenge Manager role, this allows other government TLD values to also be considered as wanting the Challenge Manager role | .mil | | ||
| | DATABASE_URL | The standard formatted postgres URL composed from the components of username, password, hostname, and database name, as provided by the Cloud.gov RDS service | postgres://username:password@hostname:port/database | | ||
| | GOV_DELIVERY_ACCOUNT_CODE | The GovDelivery account code | | | ||
| | GOV_DELIVERY_API_PASSWORD | The password of the API account with admin permission for the API | | | ||
|
|
@@ -22,6 +22,7 @@ | |
| | GOV_DELIVERY_TOPIC_SUBSCRIBE_URL | The URL that the topic code gets added to for each challenge to be subscribed to | | | ||
| | GOV_DELIVERY_URL | The base API url for the GovDelivery API | | | ||
| | HOST | The external DNS name of the running portal | portal.challenge.gov | | ||
| | LOCAL_PROXY_HOST | The local sidecar proxy that will relay to the egress proxy | 127.0.0.1 | | ||
| | LOGIN_CLIENT_ID | The login client ID for the application in Login.gov | urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:challenge_gov | | ||
| | LOGIN_PRIVATE_KEY_PASSWORD | The password to decrypt the private key used in the Login.gov OpenID connect flow | password | | ||
| | LOGIN_PUBLIC_KEY_PATH | The path within the code repository to the provide key for the application to use with Login.gov | environment_key.pem | | ||
|
|
@@ -30,7 +31,10 @@ | |
| | LOG_RETENTION_IN_DAYS | Number of days of security audit logs to keep in the database | 90 | | ||
| | MAILER_FROM_ADDRESS | The from/reply-to address for transactional email sent by the system | [email protected] | | ||
| | MIX_ENV | The environment mode for the running application, should always be prod | prod | | ||
| | PROXYROUTE | The fully qualified URL for the upstream egress proxy with protocol, authentication, domain, and port. Used by the caddy sidecar | | | ||
| | RECAPTCHA_SECRET_KEY | Google reCaptcha 3 secret key | | | ||
| | RECAPTCHA_SITE_KEY | Google reCaptcha 3 public site key | | | ||
| | SECRET_KEY_BASE | Random seed used to encrypt secrets (cookies) for session management between the application and the browser | | | ||
| | SESSION_TIMEOUT_IN_MINUTES | Amount of idle time before the system logs a user out | 15 | | ||
| | SMTP_SERVER | The DNS or IP address of the SMTP server to connect to. May be a TCP relay proxy | | | ||
| | SMTP_PORT | The port of the SMTP server to connect to. May be a TCP relay proxy | | | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| #!/bin/sh | ||
|
|
||
| # Despite the temptation to use #!/bin/bash, we want to keep this file as as | ||
| # POSIX sh-compatible as possible. This is to facilitate testing the .profile | ||
| # under Alpine, which doesn't have /bin/bash, but does have ash (which is itself | ||
| # a flavor of busybox). | ||
| ENABLE_ASH_BASH_COMPAT=1 | ||
|
|
||
| set -e | ||
|
|
||
| # Ensure there's only one entry per line, and leave no whitespace | ||
| PROXY_DENY=$( echo -n "$PROXY_DENY" | sed 's/^\S/ &/' | sed 's/\ /\n/g' | sed '/^\s*$/d' ) | ||
| PROXY_ALLOW=$( echo -n "$PROXY_ALLOW" | sed 's/^\S/ &/' | sed 's/\ /\n/g' | sed '/^\s*$/d' ) | ||
|
|
||
| # Append to the appropriate files | ||
| echo -n "$PROXY_DENY" > deny.acl | ||
| echo -n "$PROXY_ALLOW" > allow.acl | ||
|
|
||
| # Newline Terminate Non-Empty File If Not Already aka ntnefina | ||
| # https://stackoverflow.com/a/10082466/17138235 | ||
| # | ||
| # It's unclear if this works properly under Alpine because it uses ANSI-C | ||
| # quoting; that needs more testiing. However, if caddy complains about a blank | ||
| # in the file, you know why! | ||
| ntnefina() { | ||
| if [ -s "$1" ] && [ "$(tail -c1 "$1"; echo x)" != $'\nx' ]; then | ||
| echo "" >> "$1" | ||
| fi | ||
| } | ||
|
|
||
| ntnefina deny.acl | ||
| ntnefina allow.acl | ||
|
|
||
| # Make it easy to run curl tests on ourselves | ||
| https_proxy="https://$PROXY_USERNAME:$PROXY_PASSWORD@$(echo "$VCAP_APPLICATION" | jq .application_uris[0] | sed 's/"//g'):61443" | ||
| export https_proxy | ||
|
|
||
| # Make open ports configurable via the PROXY_PORTS environment variable. | ||
| # For example "80 443 22 61443". Default to 443 only. | ||
| if [ -z "${PROXY_PORTS}" ]; then | ||
| PROXY_PORTS="443" | ||
| fi | ||
| export PROXY_PORTS | ||
|
|
||
| echo | ||
| echo | ||
| echo "The proxy connection URL is:" | ||
| echo " $https_proxy" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| { | ||
| debug | ||
| log { | ||
| format console | ||
| level INFO | ||
| } | ||
| auto_https off | ||
| } | ||
|
|
||
| :8888 { | ||
| route { | ||
| forward_proxy { | ||
| acl { | ||
| allow all | ||
| } | ||
| ports 80 443 61443 | ||
| upstream $PROXYROUTE | ||
| } | ||
| } | ||
| log { | ||
| format json | ||
| level INFO | ||
| output stdout | ||
| } | ||
| } |
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| echo "Updating Caddy config" | ||
| ./proxy/envsubst < ./proxy/Caddyfile.local.tmpl > ./proxy/Caddyfile.local | ||
|
|
||
| echo "Starting Caddy" | ||
| exec ./proxy/caddy run --config ./proxy/Caddyfile.local |