stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
27d27b1952aa96e473f68b4dbfaf7f92d0b0314c
git.stella-ops.org/devops/docker/Dockerfile.console

328 lines
15 KiB
Docker
Raw Blame History

# syntax=docker/dockerfile:1.7
# Multi-stage Angular console image with non-root runtime (DOCKER-44-001)
ARG NODE_IMAGE=node:20-bookworm-slim
ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.27-alpine
ARG APP_DIR=src/Web/StellaOps.Web
ARG DIST_DIR=dist
ARG APP_PORT=8080
FROM ${NODE_IMAGE} AS build
ARG APP_DIR
ARG DIST_DIR
ENV npm_config_fund=false npm_config_audit=false SOURCE_DATE_EPOCH=1704067200
WORKDIR /app
COPY ${APP_DIR}/package*.json ./
RUN npm install --no-progress
# Angular resolves the docs-content asset mapping from repo-root docs/.
COPY docs/ /docs/
COPY ${APP_DIR}/ ./
RUN npm run build -- --configuration=production --output-path=${DIST_DIR}
FROM ${NGINX_IMAGE} AS runtime
ARG APP_PORT=8080
ARG DIST_DIR=dist
ENV APP_PORT=${APP_PORT}
USER 101
WORKDIR /
# Angular 19+ outputs to a browser/ subdirectory inside the dist folder.
# Copy only the browser/ contents so that index.html lives at the nginx root.
COPY --from=build /app/${DIST_DIR}/browser/ /usr/share/nginx/html/
COPY devops/docker/healthcheck-frontend.sh /usr/local/bin/healthcheck-frontend.sh
RUN rm -f /etc/nginx/conf.d/default.conf && \
cat > /etc/nginx/conf.d/default.conf <<CONF
resolver 127.0.0.11 valid=10s ipv6=off;
server {
listen ${APP_PORT};
listen [::]:${APP_PORT};
server_name _;
root /usr/share/nginx/html;
# --- Proxy defaults ---
proxy_http_version 1.1;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_buffering off;
proxy_read_timeout 120s;
# --- API reverse proxy (eliminates CORS for same-origin requests) ---
# Platform API (direct /api/ prefix for clients using environment.apiBaseUrl)
location /api/ {
proxy_pass http://platform.stella-ops.local/api/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Platform service (preserves /platform/ prefix for envsettings, admin)
location /platform/ {
proxy_pass http://platform.stella-ops.local/platform/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
}
# Authority general proxy (preserves /authority/ prefix for audit endpoints)
location /authority/ {
proxy_pass http://authority.stella-ops.local/authority/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
}
# Authority console endpoints (branding, admin — preserves /console/ prefix)
location /console/ {
proxy_pass http://authority.stella-ops.local/console/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Authority OpenIddict endpoints (HTTPS — /connect/authorize, /connect/token, etc.)
location /connect/ {
set \$authority_connect https://authority.stella-ops.local;
proxy_pass \$authority_connect;
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header Host authority.stella-ops.local;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header X-Forwarded-Host \$host;
}
# OIDC discovery endpoint
location = /.well-known/openid-configuration {
set \$authority_oidc https://authority.stella-ops.local;
proxy_pass \$authority_oidc/.well-known/openid-configuration;
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header Host authority.stella-ops.local;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header X-Forwarded-Host \$host;
}
# JWKS endpoint
location = /jwks {
set \$authority_jwks https://authority.stella-ops.local;
proxy_pass \$authority_jwks/jwks;
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header Host authority.stella-ops.local;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header X-Forwarded-Host \$host;
}
# Scanner service (strips /scanner/ prefix)
location /scanner/ {
set \$scanner_upstream http://scanner.stella-ops.local;
rewrite ^/scanner/(.*)\$ /\$1 break;
proxy_pass \$scanner_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Policy gateway (strips /policy/ prefix, regex avoids colliding with
# Angular /policy/exceptions, /policy/packs SPA routes)
location ~ ^/policy/(api|v[0-9]+)/ {
set \$policy_upstream http://policy-gateway.stella-ops.local;
rewrite ^/policy/(.*)\$ /\$1 break;
proxy_pass \$policy_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Concelier — VEX feed aggregator (strips /concelier/ prefix)
location /concelier/ {
set \$concelier_upstream http://concelier.stella-ops.local;
rewrite ^/concelier/(.*)\$ /\$1 break;
proxy_pass \$concelier_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Attestor service (strips /attestor/ prefix)
location /attestor/ {
set \$attestor_upstream http://attestor.stella-ops.local;
rewrite ^/attestor/(.*)\$ /\$1 break;
proxy_pass \$attestor_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Notify service (strips /notify/ prefix)
location /notify/ {
set \$notify_upstream http://notify.stella-ops.local;
rewrite ^/notify/(.*)\$ /\$1 break;
proxy_pass \$notify_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Scheduler service (strips /scheduler/ prefix)
location /scheduler/ {
set \$scheduler_upstream http://scheduler.stella-ops.local;
rewrite ^/scheduler/(.*)\$ /\$1 break;
proxy_pass \$scheduler_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Signals service (strips /signals/ prefix)
location /signals/ {
set \$signals_upstream http://signals.stella-ops.local;
rewrite ^/signals/(.*)\$ /\$1 break;
proxy_pass \$signals_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Excititor service (key: excitor, strips /excitor/ prefix)
location /excitor/ {
set \$excitor_upstream http://excititor.stella-ops.local;
rewrite ^/excitor/(.*)\$ /\$1 break;
proxy_pass \$excitor_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Findings Ledger service (key: ledger, strips /ledger/ prefix)
location /ledger/ {
set \$ledger_upstream http://findings.stella-ops.local;
rewrite ^/ledger/(.*)\$ /\$1 break;
proxy_pass \$ledger_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# VEX Hub service (key: vex, strips /vex/ prefix)
location /vex/ {
set \$vex_upstream http://vexhub.stella-ops.local;
rewrite ^/vex/(.*)\$ /\$1 break;
proxy_pass \$vex_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Environment settings — SPA fetches /platform/envsettings.json at startup.
# sub_filter rewrites Docker-internal hostnames to relative paths so the
# browser routes all API calls through this nginx reverse proxy (CORS fix).
# The authority issuer URL is rewritten to empty so OIDC stays same-origin.
location = /platform/envsettings.json {
proxy_pass http://platform.stella-ops.local/platform/envsettings.json;
proxy_set_header Host \$host;
proxy_set_header Accept-Encoding "";
sub_filter_types application/json;
sub_filter_once off;
sub_filter '"http://stella-ops.local/connect/authorize"' '"/connect/authorize"';
sub_filter '"http://stella-ops.local/connect/token"' '"/connect/token"';
sub_filter '"http://stella-ops.local/connect/logout"' '"/connect/logout"';
sub_filter '"http://stella-ops.local"' '""';
sub_filter '"http://router.stella-ops.local"' '""';
sub_filter '"http://platform.stella-ops.local"' '"/platform"';
sub_filter '"http://authority.stella-ops.local"' '"/authority"';
sub_filter '"http://scanner.stella-ops.local"' '"/scanner"';
sub_filter '"http://policy-gateway.stella-ops.local"' '"/policy"';
sub_filter '"http://concelier.stella-ops.local"' '"/concelier"';
sub_filter '"http://attestor.stella-ops.local"' '"/attestor"';
sub_filter '"http://notify.stella-ops.local"' '"/notify"';
sub_filter '"http://scheduler.stella-ops.local"' '"/scheduler"';
sub_filter '"http://signals.stella-ops.local"' '"/signals"';
sub_filter '"http://excititor.stella-ops.local"' '"/excitor"';
sub_filter '"http://findings.stella-ops.local"' '"/ledger"';
sub_filter '"http://vexhub.stella-ops.local"' '"/vex"';
sub_filter '"http://vexlens.stella-ops.local"' '"/vexlens"';
sub_filter '"http://registry-token.stella-ops.local"' '"/registry-token"';
sub_filter '"http://binaryindex.stella-ops.local"' '"/binaryindex"';
sub_filter '"http://symbols.stella-ops.local"' '"/symbols"';
sub_filter '"http://unknowns.stella-ops.local"' '"/unknowns"';
sub_filter '"http://advisoryai.stella-ops.local"' '"/advisoryai"';
sub_filter '"http://airgap-controller.stella-ops.local"' '"/airgap"';
sub_filter '"http://integrations.stella-ops.local"' '"/integrations"';
sub_filter '"http://smremote.stella-ops.local"' '"/smremote"';
sub_filter '"http://taskrunner.stella-ops.local"' '"/taskrunner"';
sub_filter '"http://sbomservice.stella-ops.local"' '"/sbomservice"';
sub_filter '"http://timelineindexer.stella-ops.local"' '"/timelineindexer"';
sub_filter '"http://issuerdirectory.stella-ops.local"' '"/issuerdirectory"';
sub_filter '"http://packsregistry.stella-ops.local"' '"/packsregistry"';
sub_filter '"http://exportcenter.stella-ops.local"' '"/exportcenter"';
sub_filter '"http://graph.stella-ops.local"' '"/graph"';
sub_filter '"http://policy-engine.stella-ops.local"' '"/policy-engine"';
sub_filter '"http://cartographer.stella-ops.local"' '"/cartographer"';
sub_filter '"http://vulnexplorer.stella-ops.local"' '"/vulnexplorer"';
sub_filter '"http://doctor.stella-ops.local"' '"/doctor"';
sub_filter '"http://orchestrator.stella-ops.local"' '"/orchestrator"';
sub_filter '"http://reachgraph.stella-ops.local"' '"/reachgraph"';
sub_filter '"http://signer.stella-ops.local"' '"/signer"';
sub_filter '"http://router.stella-ops.local"' '"/router"';
sub_filter '"http://opsmemory.stella-ops.local"' '"/opsmemory"';
sub_filter '"http://timeline.stella-ops.local"' '"/timeline"';
sub_filter '"http://riskengine.stella-ops.local"' '"/riskengine"';
sub_filter '"http://replay.stella-ops.local"' '"/replay"';
sub_filter '"http://evidencelocker.stella-ops.local"' '"/evidencelocker"';
sub_filter '"http://notifier.stella-ops.local"' '"/notifier"';
sub_filter '"http://airgap-time.stella-ops.local"' '"/airgap-time"';
}
# Legacy /envsettings.json alias (some clients may still use this path)
location = /envsettings.json {
proxy_pass http://platform.stella-ops.local/envsettings.json;
proxy_set_header Host \$host;
proxy_set_header Accept-Encoding "";
sub_filter_types application/json;
sub_filter_once off;
sub_filter '"http://stella-ops.local/connect/authorize"' '"/connect/authorize"';
sub_filter '"http://stella-ops.local/connect/token"' '"/connect/token"';
sub_filter '"http://stella-ops.local/connect/logout"' '"/connect/logout"';
sub_filter '"http://stella-ops.local"' '""';
sub_filter '"http://router.stella-ops.local"' '""';
sub_filter '"http://platform.stella-ops.local"' '"/platform"';
sub_filter '"http://authority.stella-ops.local"' '"/authority"';
sub_filter '"http://scanner.stella-ops.local"' '"/scanner"';
sub_filter '"http://policy-gateway.stella-ops.local"' '"/policy"';
sub_filter '"http://concelier.stella-ops.local"' '"/concelier"';
sub_filter '"http://attestor.stella-ops.local"' '"/attestor"';
sub_filter '"http://notify.stella-ops.local"' '"/notify"';
sub_filter '"http://scheduler.stella-ops.local"' '"/scheduler"';
sub_filter '"http://signals.stella-ops.local"' '"/signals"';
sub_filter '"http://excititor.stella-ops.local"' '"/excitor"';
sub_filter '"http://findings.stella-ops.local"' '"/ledger"';
sub_filter '"http://vexhub.stella-ops.local"' '"/vex"';
sub_filter '"http://vexlens.stella-ops.local"' '"/vexlens"';
}
# --- Static files + SPA fallback (must be last) ---
location / {
try_files \$uri \$uri/ /index.html;
}
}
CONF
EXPOSE ${APP_PORT}
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD /usr/local/bin/healthcheck-frontend.sh
CMD ["nginx","-g","daemon off;"]
Reference in New Issue View Git Blame Copy Permalink