rev: wwwallet, set nginx proxy for use localhost instead satosa-nginx host

Author: saralongobardiacn

.gitignore

@@ -29,6 +29,7 @@ Docker-compose/djangosaml2_sp/*
 Docker-compose/mongo/db/*
 Docker-compose/nginx/html/static/*
 Docker-compose/nginx/conf.d/sites-enabled/wwwallet.conf
+Docker-compose/nginx/conf.d/wwwallet.default.conf
 Docker-compose/certbot/live/localhost
 Docker-compose/.env
 Docker-compose/wwwallet/*

Docker-compose/docker-compose.yml

@@ -35,6 +35,19 @@ services:
       - "5000:5000"
     networks:
       - iam-proxy-italia
+    volumes:
+      - ./nginx/conf.d/wwwallet.default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./certbot/live/${SATOSA_HOSTNAME:-localhost}:/etc/nginx/certs:ro
+    environment:
+      - NGINX_HOST=${SATOSA_HOSTNAME:-localhost}
+      - TZ=${TZ:-Europe/Rome}
+      - NODE_TLS_REJECT_UNAUTHORIZED=0
+    command: >
+      bash -c "
+        apt-get update && apt-get install -y nginx && \
+        nginx -g 'daemon off;' &
+        node ./dist/src/app.js
+      "
 
   wwwallet-frontend:
     profiles:
@@ -212,7 +225,9 @@ services:
     ports:
       - "443:443"
     volumes:
-      - ./nginx/conf.d:/etc/nginx/conf.d:ro
+      - ./nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./nginx/conf.d/sites-enabled:/etc/nginx/conf.d/sites-enabled:ro
+      - ./nginx/html:/etc/nginx/html:ro
       - ./nginx/html:/usr/share/nginx/html:ro
       - ./certbot/archive:/etc/archive:ro
       - ./certbot/live/${SATOSA_HOSTNAME:-localhost}:/etc/nginx/certs:ro
@@ -254,6 +269,7 @@ services:
 networks:
   iam-proxy-italia:
     name: iam-proxy-italia
+    external: true
 
 ## External volumes
 # volumes:

Docker-compose/run-docker-compose.sh

@@ -103,6 +103,10 @@ function initialize_satosa {
         "wwwallet-frontend wallet-common directory is already initialized" \
         "mkdir -p ./wwwallet/wallet-frontend/lib/wallet-common && cp -R ../iam-proxy-italia-project/wwwallet/wallet-common/* ./wwwallet/wallet-frontend/lib/wallet-common/"
 
+      init_files "./nginx/conf.d/wwwallet.default.conf" \
+        "wwwallet nginx config is already initialized" \
+        "cp -R ../iam-proxy-italia-project/wwwallet/configs/nginx/wwwallet.default.conf ./nginx/conf.d/wwwallet.default.conf"
+
       merge_env ./.env ../iam-proxy-italia-project/wwwallet/configs/.env.prod ./wwwallet/wallet-frontend/.env.prod
       cp -R ../iam-proxy-italia-project/wwwallet/configs/config.template.ts ./wwwallet/wallet-backend-server/config/config.template.ts
       cp -R ../iam-proxy-italia-project/wwwallet/configs/vite.config.ts ./wwwallet/wallet-frontend/vite.config.ts

docs/readme.wwwallet_setup.md

@@ -42,5 +42,5 @@ Note that the url must point to the OpenID4VCI Frontend to work properly.
 An example of the SQL command to be executed is the following:
 ```sql
 INSERT INTO wwwalletdb.credential_issuer (clientId,credentialIssuerIdentifier,visible)
-	VALUES ('Satosa OpenID4VCI','https://satosa-nginx/OpenID4VCI',1);
+	VALUES ('Satosa OpenID4VCI','https://localhost/OpenID4VCI',1);
 ```

iam-proxy-italia-project/wwwallet/configs/nginx/wwwallet.default.conf

@@ -0,0 +1,59 @@
+server {
+    listen 443 ssl;
+    server_name  $NGINX_HOST;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_certificate /etc/nginx/certs/fullchain.pem;
+    ssl_certificate_key /etc/nginx/certs/privkey.pem;
+
+    ssl_ciphers HIGH:!aNULL:!MD5;
+
+    client_max_body_size 10m;
+    large_client_header_buffers 4 16k;
+
+    add_header X-Frame-Options "DENY";
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Robots-Tag none;
+
+    root /usr/share/nginx/html;
+
+    # Static files
+    location /static/ {
+        alias /usr/share/nginx/html/static/;
+        autoindex on;
+    }
+
+    # OpenID4VCI requests pass to iam-proxy-italia via uwsgi
+    location /OpenID4VCI/ {
+        include /etc/nginx/uwsgi_params;
+        uwsgi_pass iam-proxy-italia:10000;
+
+        uwsgi_param Host $host;
+        uwsgi_param X-Real-IP $remote_addr;
+        uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for;
+        uwsgi_param X-Forwarded-Proto https;
+        uwsgi_param HTTP_X_FORWARDED_PROTOCOL https;
+
+        uwsgi_connect_timeout 75s;
+        uwsgi_read_timeout 40s;
+        uwsgi_buffer_size 128k;
+        uwsgi_buffers 4 256k;
+        uwsgi_busy_buffers_size 256k;
+    }
+
+    # Error pages
+    error_page 404 /404.html;
+    location = /404.html {
+        root /usr/share/nginx/html/errors;
+    }
+
+    error_page 403 /403.html;
+    location = /403.html {
+        root /usr/share/nginx/html/errors;
+    }
+
+    error_page 500 502 503 504 /50x.html;
+    location = /50x.html {
+        root /usr/share/nginx/html/errors;
+    }
+}