Skip to content

Commit a2a3c3f

Browse files
rshourourshourou
committed
resolve webapi service issue
1 parent 8e14344 commit a2a3c3f

1 file changed

Lines changed: 189 additions & 148 deletions

File tree

‎infrastructure/prime-app-ephemeral-template.yml‎

Lines changed: 189 additions & 148 deletions
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,8 @@ objects:
149149
mountPath: /etc/nginx/certs/plr
150150
- name: nginx-config
151151
readOnly: true
152-
mountPath: /etc/nginx/conf.d/default.conf
153-
subPath: default.conf
152+
mountPath: /etc/nginx/nginx.conf
153+
subPath: nginx.conf
154154
- name: env-config
155155
readOnly: true
156156
mountPath: /opt/app-root/src/assets/config-map.json
@@ -213,174 +213,214 @@ objects:
213213
labels:
214214
app.kubernetes.io/part-of: ${SVC_NAME}
215215
data:
216-
default.conf: |-
216+
nginx.conf: |-
217217
# Based on https://www.nginx.com/resources/wiki/start/topics/examples/full/#nginx-conf
218218
#user www www; ## Default: nobody
219-
server {
220-
listen 8080;
221-
server_name localhost *.gov.bc.ca;
222-
server_tokens off;
223219
224-
root /opt/app-root/src;
225-
index index.html index.htm;
220+
worker_processes auto;
221+
error_log "/var/log/nginx/error.log";
222+
error_log "/tmp/error_fluentbit.log";
223+
pid "/tmp/nginx.pid";
226224
227-
include mime.types;
228-
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
229-
add_header X-XSS-Protection "1; mode=block" always;
230-
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
231-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
232-
add_header X-Content-Type-Options "nosniff" always;
233-
add_header Referrer-Policy "no-referrer-when-downgrade";
225+
events {
226+
worker_connections 1024;
227+
}
234228
235-
gzip on;
236-
gzip_min_length 1000;
237-
gzip_proxied expired no-cache no-store private auth;
238-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
229+
http {
230+
include /etc/nginx/mime.types;
231+
default_type application/octet-stream;
232+
log_format main '$remote_addr - $remote_user [$time_local] '
233+
'"$request" $status $body_bytes_sent "$http_referer" '
234+
'"$http_user_agent" "$http_x_forwarded_for"';
235+
access_log "/var/log/nginx/access.log" main;
236+
# add_header X-Frame-Options SAMEORIGIN;
239237
240-
location / {
241-
try_files $uri $uri/ /index.html$args;
242-
}
243-
location /api/docman/ {
244-
proxy_pass http://${SVC_NAME}-document-manager:6001/;
245-
}
246-
location /api/v1/ {
247-
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
248-
}
249-
location /api/v1/PLRHL7 {
250-
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
251-
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
252-
}
253-
location /nginx_status {
254-
# Enable Nginx stats
255-
stub_status on;
256-
# Only allow access from localhost
257-
allow 127.0.0.1;
258-
# Other request should be denied
259-
deny all;
260-
# No need to log this request, its just noise
261-
access_log on;
262-
}
263-
}
264-
server {
265-
listen 8443 ssl;
266-
server_name *.gov.bc.ca;
267-
ssl_password_file certs/passwd.txt;
268-
ssl_certificate certs/chained.crt;
269-
ssl_certificate_key certs/private.key;
270-
server_tokens off;
271-
# ssl_verify_client optional_no_ca;
238+
client_body_temp_path "/tmp/client_body" 1 2;
239+
proxy_temp_path "/tmp/proxy" 1 2;
240+
fastcgi_temp_path "/tmp/fastcgi" 1 2;
241+
scgi_temp_path "/tmp/scgi" 1 2;
242+
uwsgi_temp_path "/tmp/uwsgi" 1 2;
272243
273-
root /opt/app-root/src;
274-
index index.html index.htm;
244+
sendfile on;
245+
# tcp_nopush on;
246+
tcp_nodelay off;
247+
gzip on;
248+
gzip_http_version 1.0;
249+
gzip_comp_level 2;
250+
gzip_proxied any;
251+
gzip_types text/plain text/css application/javascript text/xml application/xml+rss;
252+
keepalive_timeout 65;
253+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
254+
ssl_ciphers HIGH:!aNULL:!MD5;
255+
client_max_body_size 80M;
256+
server_tokens off;
275257
276-
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
277-
add_header X-XSS-Protection "1; mode=block" always;
278-
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
279-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
280-
add_header X-Content-Type-Options "nosniff" always;
281-
add_header Referrer-Policy "no-referrer-when-downgrade";
258+
server {
259+
listen 8080;
260+
server_name localhost *.gov.bc.ca;
261+
server_tokens off;
282262
283-
gzip on;
284-
gzip_min_length 1000;
285-
gzip_proxied expired no-cache no-store private auth;
286-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
263+
root /opt/app-root/src;
264+
index index.html index.htm;
287265
288-
location / {
289-
try_files $uri $uri/ /index.html$args;
290-
}
291-
location /api/docman/ {
292-
proxy_pass http://${SVC_NAME}-document-manager:6001/;
293-
}
294-
location /api/v1/ {
295-
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
296-
}
297-
location /api/v1/PLRHL7 {
298-
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
299-
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
266+
include mime.types;
267+
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
268+
add_header X-XSS-Protection "1; mode=block" always;
269+
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
270+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
271+
add_header X-Content-Type-Options "nosniff" always;
272+
add_header Referrer-Policy "no-referrer-when-downgrade";
273+
274+
gzip on;
275+
gzip_min_length 1000;
276+
gzip_proxied expired no-cache no-store private auth;
277+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
278+
279+
location / {
280+
try_files $uri $uri/ /index.html$args;
281+
}
282+
location /api/docman/ {
283+
proxy_pass http://${SVC_NAME}-document-manager:6001/;
284+
}
285+
location /api/v1/ {
286+
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
287+
}
288+
location /api/v1/PLRHL7 {
289+
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
290+
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
291+
}
292+
location /nginx_status {
293+
# Enable Nginx stats
294+
stub_status on;
295+
# Only allow access from localhost
296+
allow 127.0.0.1;
297+
# Other request should be denied
298+
deny all;
299+
# No need to log this request, its just noise
300+
access_log on;
301+
}
300302
}
301-
location /nginx_status {
302-
# Enable Nginx stats
303-
stub_status on;
303+
server {
304+
listen 8443 ssl;
305+
server_name *.gov.bc.ca;
306+
ssl_password_file certs/passwd.txt;
307+
ssl_certificate certs/chained.crt;
308+
ssl_certificate_key certs/private.key;
309+
server_tokens off;
310+
# ssl_verify_client optional_no_ca;
304311
305-
# Only allow access from localhost
306-
allow 127.0.0.1;
312+
root /opt/app-root/src;
313+
index index.html index.htm;
307314
308-
# Other request should be denied
309-
deny all;
315+
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
316+
add_header X-XSS-Protection "1; mode=block" always;
317+
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
318+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
319+
add_header X-Content-Type-Options "nosniff" always;
320+
add_header Referrer-Policy "no-referrer-when-downgrade";
310321
311-
# No need to log this request, its just noise
312-
access_log on;
313-
}
314-
}
315-
server {
316-
listen 8888;
317-
server_name *.gov.bc.ca;
318-
server_tokens off;
322+
gzip on;
323+
gzip_min_length 1000;
324+
gzip_proxied expired no-cache no-store private auth;
325+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
319326
320-
root /opt/app-root/src;
321-
index index.html index.htm;
327+
location / {
328+
try_files $uri $uri/ /index.html$args;
329+
}
330+
location /api/docman/ {
331+
proxy_pass http://${SVC_NAME}-document-manager:6001/;
332+
}
333+
location /api/v1/ {
334+
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
335+
}
336+
location /api/v1/PLRHL7 {
337+
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
338+
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
339+
}
340+
location /nginx_status {
341+
# Enable Nginx stats
342+
stub_status on;
322343
323-
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
324-
add_header X-XSS-Protection "1; mode=block" always;
325-
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
326-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
327-
add_header X-Content-Type-Options "nosniff" always;
328-
add_header Referrer-Policy "no-referrer-when-downgrade";
329-
gzip on;
330-
gzip_min_length 1000;
331-
gzip_proxied expired no-cache no-store private auth;
332-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
344+
# Only allow access from localhost
345+
allow 127.0.0.1;
333346
334-
location / {
335-
try_files $uri $uri/ /index.html$args;
336-
}
337-
location /api/docman/ {
338-
proxy_pass http://${SVC_NAME}-document-manager:6001;
339-
}
340-
location /api/v1/ {
341-
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
347+
# Other request should be denied
348+
deny all;
349+
350+
# No need to log this request, its just noise
351+
access_log on;
352+
}
342353
}
343-
location /nginx_status {
344-
# Enable Nginx stats
345-
stub_status on;
346-
# Only allow access from localhost
347-
allow 127.0.0.1;
348-
# Other request should be denied
349-
deny all;
350-
# No need to log this request, its just noise
351-
access_log on;
354+
server {
355+
listen 8888;
356+
server_name *.gov.bc.ca;
357+
server_tokens off;
358+
359+
root /opt/app-root/src;
360+
index index.html index.htm;
361+
362+
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
363+
add_header X-XSS-Protection "1; mode=block" always;
364+
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
365+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
366+
add_header X-Content-Type-Options "nosniff" always;
367+
add_header Referrer-Policy "no-referrer-when-downgrade";
368+
gzip on;
369+
gzip_min_length 1000;
370+
gzip_proxied expired no-cache no-store private auth;
371+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
372+
373+
location / {
374+
try_files $uri $uri/ /index.html$args;
375+
}
376+
location /api/docman/ {
377+
proxy_pass http://${SVC_NAME}-document-manager:6001;
378+
}
379+
location /api/v1/ {
380+
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
381+
}
382+
location /nginx_status {
383+
# Enable Nginx stats
384+
stub_status on;
385+
# Only allow access from localhost
386+
allow 127.0.0.1;
387+
# Other request should be denied
388+
deny all;
389+
# No need to log this request, its just noise
390+
access_log on;
391+
}
352392
}
353-
}
354-
server {
355-
# Block for API end-points that require a client certificate (Multual Authentication)
356-
listen 8890 ssl;
357-
server_name *.gov.bc.ca;
358-
ssl_password_file certs/passwd.txt;
359-
ssl_certificate certs/chained.crt;
360-
ssl_certificate_key certs/private.key;
361-
server_tokens off;
362-
ssl_verify_client optional_no_ca;
363-
ssl_client_certificate certs/plr/trusted-ca-certs.pem;
364-
root /opt/app-root/src;
365-
index index.html index.htm;
393+
server {
394+
# Block for API end-points that require a client certificate (Multual Authentication)
395+
listen 8890 ssl;
396+
server_name *.gov.bc.ca;
397+
ssl_password_file certs/passwd.txt;
398+
ssl_certificate certs/chained.crt;
399+
ssl_certificate_key certs/private.key;
400+
server_tokens off;
401+
ssl_verify_client optional_no_ca;
402+
ssl_client_certificate certs/plr/trusted-ca-certs.pem;
403+
root /opt/app-root/src;
404+
index index.html index.htm;
366405
367-
# add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
368-
# add_header X-XSS-Protection "1; mode=block" always;
369-
# add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
370-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
371-
add_header X-Content-Type-Options "nosniff" always;
372-
# add_header Referrer-Policy "no-referrer-when-downgrade";
373-
gzip on;
374-
gzip_min_length 1000;
375-
gzip_proxied expired no-cache no-store private auth;
376-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
406+
# add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
407+
# add_header X-XSS-Protection "1; mode=block" always;
408+
# add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
409+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
410+
add_header X-Content-Type-Options "nosniff" always;
411+
# add_header Referrer-Policy "no-referrer-when-downgrade";
412+
gzip on;
413+
gzip_min_length 1000;
414+
gzip_proxied expired no-cache no-store private auth;
415+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
377416
378-
location /api/v1/PLRHL7 {
379-
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
380-
proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
417+
location /api/v1/PLRHL7 {
418+
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
419+
proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
420+
}
381421
}
382422
}
383-
423+
384424

385425
# Frontend Service
386426
- apiVersion: v1
@@ -708,7 +748,8 @@ objects:
708748
port: 8080
709749
targetPort: 8080
710750
selector:
711-
name: ${SVC_NAME}-webapi
751+
app.kubernetes.io/name: frontend
752+
app.kubernetes.io/part-of: ${SVC_NAME}
712753

713754
###########################################
714755
### Document Manager (backend) ###

0 commit comments

Comments
 (0)