436 lines
16 KiB
Plaintext
436 lines
16 KiB
Plaintext
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
|
|
server {
|
|
listen 8080;
|
|
listen [::]:8080;
|
|
server_name _;
|
|
root /usr/share/nginx/html/browser;
|
|
|
|
# --- Proxy defaults ---
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 120s;
|
|
|
|
# --- API reverse proxy (eliminates CORS for same-origin requests) ---
|
|
|
|
# Platform API (direct /api/ prefix)
|
|
location /api/ {
|
|
proxy_pass http://platform.stella-ops.local/api/;
|
|
}
|
|
|
|
# Gateway API (strips /gateway/ prefix)
|
|
location /gateway/ {
|
|
set $gateway_upstream http://gateway.stella-ops.local;
|
|
rewrite ^/gateway/(.*)$ /$1 break;
|
|
proxy_pass $gateway_upstream;
|
|
proxy_set_header Host gateway.stella-ops.local;
|
|
}
|
|
|
|
# Platform envsettings.json with URL rewriting
|
|
location = /platform/envsettings.json {
|
|
proxy_pass http://platform.stella-ops.local/platform/envsettings.json;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Accept-Encoding "";
|
|
sub_filter_types application/json;
|
|
sub_filter_once off;
|
|
sub_filter '"http://stella-ops.local/connect/authorize"' '"/connect/authorize"';
|
|
sub_filter '"http://stella-ops.local/connect/token"' '"/connect/token"';
|
|
sub_filter '"http://stella-ops.local/connect/logout"' '"/connect/logout"';
|
|
sub_filter '"http://stella-ops.local"' '""';
|
|
sub_filter '"http://gateway.stella-ops.local"' '"/gateway"';
|
|
sub_filter '"http://platform.stella-ops.local"' '"/platform"';
|
|
sub_filter '"http://authority.stella-ops.local"' '"/authority"';
|
|
sub_filter '"http://scanner.stella-ops.local"' '"/scanner"';
|
|
sub_filter '"http://policy-gateway.stella-ops.local"' '"/policy"';
|
|
sub_filter '"http://concelier.stella-ops.local"' '"/concelier"';
|
|
sub_filter '"http://attestor.stella-ops.local"' '"/attestor"';
|
|
sub_filter '"http://notify.stella-ops.local"' '"/notify"';
|
|
sub_filter '"http://scheduler.stella-ops.local"' '"/scheduler"';
|
|
sub_filter '"http://signals.stella-ops.local"' '"/signals"';
|
|
sub_filter '"http://excititor.stella-ops.local"' '"/excitor"';
|
|
sub_filter '"http://findings.stella-ops.local"' '"/ledger"';
|
|
sub_filter '"http://vexhub.stella-ops.local"' '"/vex"';
|
|
sub_filter '"http://vexlens.stella-ops.local"' '"/vexlens"';
|
|
sub_filter '"http://registry-token.stella-ops.local"' '"/registry-token"';
|
|
sub_filter '"http://binaryindex.stella-ops.local"' '"/binaryindex"';
|
|
sub_filter '"http://symbols.stella-ops.local"' '"/symbols"';
|
|
sub_filter '"http://unknowns.stella-ops.local"' '"/unknowns"';
|
|
sub_filter '"http://advisoryai.stella-ops.local"' '"/advisoryai"';
|
|
sub_filter '"http://airgap-controller.stella-ops.local"' '"/airgap"';
|
|
sub_filter '"http://integrations.stella-ops.local"' '"/integrations"';
|
|
sub_filter '"http://smremote.stella-ops.local"' '"/smremote"';
|
|
sub_filter '"http://taskrunner.stella-ops.local"' '"/taskrunner"';
|
|
sub_filter '"http://sbomservice.stella-ops.local"' '"/sbomservice"';
|
|
sub_filter '"http://timelineindexer.stella-ops.local"' '"/timelineindexer"';
|
|
sub_filter '"http://issuerdirectory.stella-ops.local"' '"/issuerdirectory"';
|
|
sub_filter '"http://packsregistry.stella-ops.local"' '"/packsregistry"';
|
|
sub_filter '"http://exportcenter.stella-ops.local"' '"/exportcenter"';
|
|
sub_filter '"http://graph.stella-ops.local"' '"/graph"';
|
|
sub_filter '"http://policy-engine.stella-ops.local"' '"/policy-engine"';
|
|
sub_filter '"http://cartographer.stella-ops.local"' '"/cartographer"';
|
|
sub_filter '"http://vulnexplorer.stella-ops.local"' '"/vulnexplorer"';
|
|
sub_filter '"http://doctor.stella-ops.local"' '"/doctor"';
|
|
sub_filter '"http://orchestrator.stella-ops.local"' '"/orchestrator"';
|
|
sub_filter '"http://reachgraph.stella-ops.local"' '"/reachgraph"';
|
|
sub_filter '"http://signer.stella-ops.local"' '"/signer"';
|
|
sub_filter '"http://router.stella-ops.local"' '"/router"';
|
|
sub_filter '"http://opsmemory.stella-ops.local"' '"/opsmemory"';
|
|
sub_filter '"http://timeline.stella-ops.local"' '"/timeline"';
|
|
sub_filter '"http://riskengine.stella-ops.local"' '"/riskengine"';
|
|
sub_filter '"http://replay.stella-ops.local"' '"/replay"';
|
|
sub_filter '"http://evidencelocker.stella-ops.local"' '"/evidencelocker"';
|
|
sub_filter '"http://notifier.stella-ops.local"' '"/notifier"';
|
|
sub_filter '"http://airgap-time.stella-ops.local"' '"/airgap-time"';
|
|
}
|
|
|
|
# Platform service (preserves /platform/ prefix)
|
|
location /platform/ {
|
|
proxy_pass http://platform.stella-ops.local/platform/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
# Authority general proxy
|
|
location /authority/ {
|
|
proxy_pass http://authority.stella-ops.local/authority/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
# Authority console endpoints
|
|
location /console/ {
|
|
proxy_pass http://authority.stella-ops.local/console/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
|
|
# Authority OpenIddict endpoints (HTTPS)
|
|
location /connect/ {
|
|
set $authority_connect https://authority.stella-ops.local;
|
|
proxy_pass $authority_connect;
|
|
proxy_ssl_verify off;
|
|
proxy_ssl_server_name on;
|
|
proxy_set_header Host authority.stella-ops.local;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
}
|
|
|
|
# OIDC discovery endpoint
|
|
location = /.well-known/openid-configuration {
|
|
set $authority_oidc https://authority.stella-ops.local;
|
|
proxy_pass $authority_oidc/.well-known/openid-configuration;
|
|
proxy_ssl_verify off;
|
|
proxy_ssl_server_name on;
|
|
proxy_set_header Host authority.stella-ops.local;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
}
|
|
|
|
# JWKS endpoint
|
|
location = /jwks {
|
|
set $authority_jwks https://authority.stella-ops.local;
|
|
proxy_pass $authority_jwks/jwks;
|
|
proxy_ssl_verify off;
|
|
proxy_ssl_server_name on;
|
|
proxy_set_header Host authority.stella-ops.local;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
}
|
|
|
|
# Scanner service
|
|
location /scanner/ {
|
|
set $scanner_upstream http://scanner.stella-ops.local;
|
|
rewrite ^/scanner/(.*)$ /$1 break;
|
|
proxy_pass $scanner_upstream;
|
|
}
|
|
|
|
# Policy gateway
|
|
location ~ ^/policy/(api|v[0-9]+)/ {
|
|
set $policy_upstream http://policy-gateway.stella-ops.local;
|
|
rewrite ^/policy/(.*)$ /$1 break;
|
|
proxy_pass $policy_upstream;
|
|
}
|
|
|
|
# Concelier
|
|
location /concelier/ {
|
|
set $concelier_upstream http://concelier.stella-ops.local;
|
|
rewrite ^/concelier/(.*)$ /$1 break;
|
|
proxy_pass $concelier_upstream;
|
|
}
|
|
|
|
# Attestor service
|
|
location /attestor/ {
|
|
set $attestor_upstream http://attestor.stella-ops.local;
|
|
rewrite ^/attestor/(.*)$ /$1 break;
|
|
proxy_pass $attestor_upstream;
|
|
}
|
|
|
|
# Notify service
|
|
location /notify/ {
|
|
set $notify_upstream http://notify.stella-ops.local;
|
|
rewrite ^/notify/(.*)$ /$1 break;
|
|
proxy_pass $notify_upstream;
|
|
}
|
|
|
|
# Scheduler service
|
|
location /scheduler/ {
|
|
set $scheduler_upstream http://scheduler.stella-ops.local;
|
|
rewrite ^/scheduler/(.*)$ /$1 break;
|
|
proxy_pass $scheduler_upstream;
|
|
}
|
|
|
|
# Signals service
|
|
location /signals/ {
|
|
set $signals_upstream http://signals.stella-ops.local;
|
|
rewrite ^/signals/(.*)$ /$1 break;
|
|
proxy_pass $signals_upstream;
|
|
}
|
|
|
|
# Excititor service
|
|
location /excitor/ {
|
|
set $excitor_upstream http://excititor.stella-ops.local;
|
|
rewrite ^/excitor/(.*)$ /$1 break;
|
|
proxy_pass $excitor_upstream;
|
|
}
|
|
|
|
# Findings Ledger service
|
|
location /ledger/ {
|
|
set $ledger_upstream http://findings.stella-ops.local;
|
|
rewrite ^/ledger/(.*)$ /$1 break;
|
|
proxy_pass $ledger_upstream;
|
|
}
|
|
|
|
# VEX Hub service
|
|
location /vex/ {
|
|
set $vex_upstream http://vexhub.stella-ops.local;
|
|
rewrite ^/vex/(.*)$ /$1 break;
|
|
proxy_pass $vex_upstream;
|
|
}
|
|
|
|
# VexLens service
|
|
location /vexlens/ {
|
|
set $vexlens_upstream http://vexlens.stella-ops.local;
|
|
rewrite ^/vexlens/(.*)$ /$1 break;
|
|
proxy_pass $vexlens_upstream;
|
|
}
|
|
|
|
# Additional service proxies for all remaining apiBaseUrls
|
|
location /registry-token/ {
|
|
set $upstream http://registry-token.stella-ops.local;
|
|
rewrite ^/registry-token/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /binaryindex/ {
|
|
set $upstream http://binaryindex.stella-ops.local;
|
|
rewrite ^/binaryindex/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /symbols/ {
|
|
set $upstream http://symbols.stella-ops.local;
|
|
rewrite ^/symbols/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /unknowns/ {
|
|
set $upstream http://unknowns.stella-ops.local;
|
|
rewrite ^/unknowns/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /advisoryai/ {
|
|
set $upstream http://advisoryai.stella-ops.local;
|
|
rewrite ^/advisoryai/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /airgap/ {
|
|
set $upstream http://airgap-controller.stella-ops.local;
|
|
rewrite ^/airgap/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /integrations/ {
|
|
set $upstream http://integrations.stella-ops.local;
|
|
rewrite ^/integrations/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /smremote/ {
|
|
set $upstream http://smremote.stella-ops.local;
|
|
rewrite ^/smremote/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /taskrunner/ {
|
|
set $upstream http://taskrunner.stella-ops.local;
|
|
rewrite ^/taskrunner/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /sbomservice/ {
|
|
set $upstream http://sbomservice.stella-ops.local;
|
|
rewrite ^/sbomservice/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /timelineindexer/ {
|
|
set $upstream http://timelineindexer.stella-ops.local;
|
|
rewrite ^/timelineindexer/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /issuerdirectory/ {
|
|
set $upstream http://issuerdirectory.stella-ops.local;
|
|
rewrite ^/issuerdirectory/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /packsregistry/ {
|
|
set $upstream http://packsregistry.stella-ops.local;
|
|
rewrite ^/packsregistry/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /exportcenter/ {
|
|
set $upstream http://exportcenter.stella-ops.local;
|
|
rewrite ^/exportcenter/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /graph/ {
|
|
set $upstream http://graph.stella-ops.local;
|
|
rewrite ^/graph/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /policy-engine/ {
|
|
set $upstream http://policy-engine.stella-ops.local;
|
|
rewrite ^/policy-engine/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /cartographer/ {
|
|
set $upstream http://cartographer.stella-ops.local;
|
|
rewrite ^/cartographer/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /vulnexplorer/ {
|
|
set $upstream http://vulnexplorer.stella-ops.local;
|
|
rewrite ^/vulnexplorer/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /doctor/ {
|
|
set $upstream http://doctor.stella-ops.local;
|
|
rewrite ^/doctor/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /orchestrator/ {
|
|
set $upstream http://orchestrator.stella-ops.local;
|
|
rewrite ^/orchestrator/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /reachgraph/ {
|
|
set $upstream http://reachgraph.stella-ops.local;
|
|
rewrite ^/reachgraph/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /signer/ {
|
|
set $upstream http://signer.stella-ops.local;
|
|
rewrite ^/signer/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /router/ {
|
|
set $upstream http://router.stella-ops.local;
|
|
rewrite ^/router/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /opsmemory/ {
|
|
set $upstream http://opsmemory.stella-ops.local;
|
|
rewrite ^/opsmemory/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /timeline/ {
|
|
set $upstream http://timeline.stella-ops.local;
|
|
rewrite ^/timeline/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /riskengine/ {
|
|
set $upstream http://riskengine.stella-ops.local;
|
|
rewrite ^/riskengine/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /replay/ {
|
|
set $upstream http://replay.stella-ops.local;
|
|
rewrite ^/replay/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /evidencelocker/ {
|
|
set $upstream http://evidencelocker.stella-ops.local;
|
|
rewrite ^/evidencelocker/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /notifier/ {
|
|
set $upstream http://notifier.stella-ops.local;
|
|
rewrite ^/notifier/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
location /airgap-time/ {
|
|
set $upstream http://airgap-time.stella-ops.local;
|
|
rewrite ^/airgap-time/(.*)$ /$1 break;
|
|
proxy_pass $upstream;
|
|
}
|
|
|
|
# Environment settings (direct access alias with URL rewriting)
|
|
location = /envsettings.json {
|
|
proxy_pass http://platform.stella-ops.local/envsettings.json;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Accept-Encoding "";
|
|
sub_filter_types application/json;
|
|
sub_filter_once off;
|
|
sub_filter '"http://stella-ops.local/connect/authorize"' '"/connect/authorize"';
|
|
sub_filter '"http://stella-ops.local/connect/token"' '"/connect/token"';
|
|
sub_filter '"http://stella-ops.local/connect/logout"' '"/connect/logout"';
|
|
sub_filter '"http://stella-ops.local"' '""';
|
|
sub_filter '"http://gateway.stella-ops.local"' '"/gateway"';
|
|
sub_filter '"http://platform.stella-ops.local"' '"/platform"';
|
|
sub_filter '"http://authority.stella-ops.local"' '"/authority"';
|
|
sub_filter '"http://scanner.stella-ops.local"' '"/scanner"';
|
|
sub_filter '"http://policy-gateway.stella-ops.local"' '"/policy"';
|
|
sub_filter '"http://concelier.stella-ops.local"' '"/concelier"';
|
|
sub_filter '"http://attestor.stella-ops.local"' '"/attestor"';
|
|
sub_filter '"http://notify.stella-ops.local"' '"/notify"';
|
|
sub_filter '"http://scheduler.stella-ops.local"' '"/scheduler"';
|
|
sub_filter '"http://signals.stella-ops.local"' '"/signals"';
|
|
sub_filter '"http://excititor.stella-ops.local"' '"/excitor"';
|
|
sub_filter '"http://findings.stella-ops.local"' '"/ledger"';
|
|
sub_filter '"http://vexhub.stella-ops.local"' '"/vex"';
|
|
sub_filter '"http://vexlens.stella-ops.local"' '"/vexlens"';
|
|
}
|
|
|
|
# --- Static files + SPA fallback (must be last) ---
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|