stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
cf5b72974f923126944f4dcd47e85864ebb31a3b
git.stella-ops.org/devops/docker/Dockerfile.console
master 04360dff63 save checkpoint
2026-02-07 12:44:24 +02:00

273 lines
11 KiB
Docker
Raw Blame History

# syntax=docker/dockerfile:1.7
# Multi-stage Angular console image with non-root runtime (DOCKER-44-001)
ARG NODE_IMAGE=node:20-bookworm-slim
ARG NGINX_IMAGE=nginxinc/nginx-unprivileged:1.27-alpine
ARG APP_DIR=src/Web/StellaOps.Web
ARG DIST_DIR=dist
ARG APP_PORT=8080
FROM ${NODE_IMAGE} AS build
ARG APP_DIR
ARG DIST_DIR
ENV npm_config_fund=false npm_config_audit=false SOURCE_DATE_EPOCH=1704067200
WORKDIR /app
COPY ${APP_DIR}/package*.json ./
RUN npm install --no-progress
COPY ${APP_DIR}/ ./
RUN npm run build -- --configuration=production --output-path=${DIST_DIR}
FROM ${NGINX_IMAGE} AS runtime
ARG APP_PORT=8080
ARG DIST_DIR=dist
ENV APP_PORT=${APP_PORT}
USER 101
WORKDIR /
COPY --from=build /app/${DIST_DIR}/ /usr/share/nginx/html/
COPY devops/docker/healthcheck-frontend.sh /usr/local/bin/healthcheck-frontend.sh
RUN rm -f /etc/nginx/conf.d/default.conf && \
cat > /etc/nginx/conf.d/default.conf <<CONF
resolver 127.0.0.11 valid=10s ipv6=off;
server {
listen ${APP_PORT};
listen [::]:${APP_PORT};
server_name _;
root /usr/share/nginx/html;
# --- Proxy defaults ---
proxy_http_version 1.1;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_buffering off;
proxy_read_timeout 120s;
# --- API reverse proxy (eliminates CORS for same-origin requests) ---
# Platform API (direct /api/ prefix for clients using environment.apiBaseUrl)
location /api/ {
proxy_pass http://platform.stella-ops.local/api/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Gateway API (strips /gateway/ prefix for release-orchestrator clients)
location /gateway/ {
set \$gateway_upstream http://gateway.stella-ops.local;
rewrite ^/gateway/(.*)\$ /\$1 break;
proxy_pass \$gateway_upstream;
proxy_set_header Host gateway.stella-ops.local;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Platform service (preserves /platform/ prefix for envsettings, admin)
location /platform/ {
proxy_pass http://platform.stella-ops.local/platform/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
}
# Authority general proxy (preserves /authority/ prefix for audit endpoints)
location /authority/ {
proxy_pass http://authority.stella-ops.local/authority/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
}
# Authority console endpoints (branding, admin — preserves /console/ prefix)
location /console/ {
proxy_pass http://authority.stella-ops.local/console/;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Authority OpenIddict endpoints (HTTPS — /connect/authorize, /connect/token, etc.)
location /connect/ {
set \$authority_connect https://authority.stella-ops.local;
proxy_pass \$authority_connect;
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header Host authority.stella-ops.local;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header X-Forwarded-Host \$host;
}
# OIDC discovery endpoint
location = /.well-known/openid-configuration {
set \$authority_oidc https://authority.stella-ops.local;
proxy_pass \$authority_oidc/.well-known/openid-configuration;
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header Host authority.stella-ops.local;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header X-Forwarded-Host \$host;
}
# JWKS endpoint
location = /jwks {
set \$authority_jwks https://authority.stella-ops.local;
proxy_pass \$authority_jwks/jwks;
proxy_ssl_verify off;
proxy_ssl_server_name on;
proxy_set_header Host authority.stella-ops.local;
proxy_set_header X-Forwarded-Proto \$scheme;
proxy_set_header X-Forwarded-Host \$host;
}
# Scanner service (strips /scanner/ prefix)
location /scanner/ {
set \$scanner_upstream http://scanner.stella-ops.local;
rewrite ^/scanner/(.*)\$ /\$1 break;
proxy_pass \$scanner_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Policy gateway (strips /policy/ prefix, regex avoids colliding with
# Angular /policy/exceptions, /policy/packs SPA routes)
location ~ ^/policy/(api|v[0-9]+)/ {
set \$policy_upstream http://policy-gateway.stella-ops.local;
rewrite ^/policy/(.*)\$ /\$1 break;
proxy_pass \$policy_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Concelier — VEX feed aggregator (strips /concelier/ prefix)
location /concelier/ {
set \$concelier_upstream http://concelier.stella-ops.local;
rewrite ^/concelier/(.*)\$ /\$1 break;
proxy_pass \$concelier_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Attestor service (strips /attestor/ prefix)
location /attestor/ {
set \$attestor_upstream http://attestor.stella-ops.local;
rewrite ^/attestor/(.*)\$ /\$1 break;
proxy_pass \$attestor_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Notify service (strips /notify/ prefix)
location /notify/ {
set \$notify_upstream http://notify.stella-ops.local;
rewrite ^/notify/(.*)\$ /\$1 break;
proxy_pass \$notify_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Scheduler service (strips /scheduler/ prefix)
location /scheduler/ {
set \$scheduler_upstream http://scheduler.stella-ops.local;
rewrite ^/scheduler/(.*)\$ /\$1 break;
proxy_pass \$scheduler_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Signals service (strips /signals/ prefix)
location /signals/ {
set \$signals_upstream http://signals.stella-ops.local;
rewrite ^/signals/(.*)\$ /\$1 break;
proxy_pass \$signals_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Excititor service (key: excitor, strips /excitor/ prefix)
location /excitor/ {
set \$excitor_upstream http://excititor.stella-ops.local;
rewrite ^/excitor/(.*)\$ /\$1 break;
proxy_pass \$excitor_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Findings Ledger service (key: ledger, strips /ledger/ prefix)
location /ledger/ {
set \$ledger_upstream http://findings.stella-ops.local;
rewrite ^/ledger/(.*)\$ /\$1 break;
proxy_pass \$ledger_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# VEX Hub service (key: vex, strips /vex/ prefix)
location /vex/ {
set \$vex_upstream http://vexhub.stella-ops.local;
rewrite ^/vex/(.*)\$ /\$1 break;
proxy_pass \$vex_upstream;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto \$scheme;
}
# Environment settings (direct access alias)
# sub_filter rewrites absolute Docker-internal URLs to relative paths so the
# browser routes all API calls through this nginx reverse proxy (CORS fix).
location = /envsettings.json {
proxy_pass http://platform.stella-ops.local/envsettings.json;
proxy_set_header Host \$host;
proxy_set_header Accept-Encoding "";
sub_filter_types application/json;
sub_filter_once off;
sub_filter '"http://gateway.stella-ops.local"' '"/gateway"';
sub_filter '"http://platform.stella-ops.local"' '"/platform"';
sub_filter '"http://authority.stella-ops.local"' '"/authority"';
sub_filter '"http://scanner.stella-ops.local"' '"/scanner"';
sub_filter '"http://policy-gateway.stella-ops.local"' '"/policy"';
sub_filter '"http://concelier.stella-ops.local"' '"/concelier"';
sub_filter '"http://attestor.stella-ops.local"' '"/attestor"';
sub_filter '"http://notify.stella-ops.local"' '"/notify"';
sub_filter '"http://scheduler.stella-ops.local"' '"/scheduler"';
sub_filter '"http://signals.stella-ops.local"' '"/signals"';
sub_filter '"http://excititor.stella-ops.local"' '"/excitor"';
sub_filter '"http://findings.stella-ops.local"' '"/ledger"';
sub_filter '"http://vexhub.stella-ops.local"' '"/vex"';
sub_filter '"http://vexlens.stella-ops.local"' '"/vexlens"';
}
# --- Static files + SPA fallback (must be last) ---
location / {
try_files \$uri \$uri/ /index.html;
}
}
CONF
EXPOSE ${APP_PORT}
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD /usr/local/bin/healthcheck-frontend.sh
CMD ["nginx","-g","daemon off;"]
Reference in New Issue View Git Blame Copy Permalink