chore: replace deprecated standalone eda-ui image with nginx (#1071)

Signed-off-by: Alex <[email protected]>

.gitguardian.yaml

@@ -0,0 +1,7 @@
+secret:
+  ignored_paths:
+    - 'docs/*'
+    - tools/docker/nginx/certs/*
+    - tools/docker/nginx/redis-tls/*
+    - tests/unit/data/*
+    - tests/integration/api/test_event_stream_ecdsa.py

.gitleaks.toml

@@ -1,9 +1,9 @@
 [allowlist]
 description = "Global Allowlist"
 
-# Ignore based on any subset of the file path
 paths = [
-        '''tests\/unit\/data''', 
-        '''tools\/docker\/redis-tls''',
-        '''tests\/integration\/api\/test_event_stream_ecdsa.py'''
-]
+    '''tests\/unit\/data''',
+    '''tools\/docker\/redis-tls''',
+    '''tests\/integration\/api\/test_event_stream_ecdsa.py''',
+    '''tools\/docker\/nginx\/certs''',
+] # Ignore based on any subset of the file path

tools/docker/docker-compose-dev-redis-tls.yaml

@@ -44,6 +44,11 @@ x-environment:
   - EDA_RESOURCE_SERVER__VALIDATE_HTTPS=${EDA_RESOURCE_SERVER__VALIDATE_HTTPS:-False}
   - EDA_RESOURCE_JWT_USER_ID=${EDA_RESOURCE_JWT_USER_ID:-'@none None'}
   - EDA_ANSIBLE_BASE_MANAGED_ROLE_REGISTRY=${EDA_ANSIBLE_BASE_MANAGED_ROLE_REGISTRY:-@json {}}
+  - EDA_STATIC_URL=${EDA_STATIC_URL:-api/eda/static/}
+  - SSL_CERTIFICATE=${SSL_CERTIFICATE:-/certs/wildcard.crt}
+  - SSL_CERTIFICATE_KEY=${SSL_CERTIFICATE_KEY:-/certs/wildcard.key}
+  - SSL_CLIENT_CERTIFICATE=${SSL_CLIENT_CERTIFICATE:-/certs/client.crt}
+
 
 services:
   podman-pre-setup:
@@ -241,11 +246,16 @@ services:
       - '../../:/app/src:z'
     restart: always
 
-  eda-ui:
-    image: ${EDA_UI_IMAGE:-quay.io/ansible/eda-ui}:${EDA_UI_VERSION:-main}
+  eda-nginx:
+    image: ${EDA_NGINX_IMAGE:-docker.io/nginx:alpine}
     environment: *common-env
+    command: nginx -g "daemon off;"
     ports:
       - '${EDA_UI_PORT:-8443}:443'
+    volumes:
+      - './my_certs:/tmp/my_certs:z'
+      - './nginx/certs:/certs:z'
+      - './nginx/default.conf.template:/etc/nginx/templates/default.conf.template:z'
     depends_on:
       eda-api:
         condition: service_healthy

tools/docker/docker-compose-dev.yaml

@@ -48,9 +48,10 @@ x-environment: &common-env
   EDA_EVENT_STREAM_MTLS_BASE_URL: ${EDA_EVENT_STREAM_MTLS_BASE_URL:-https://localhost:8443/mtls/edgecafe-beef-feed-fade-decadeedgecafe/}
   EDA_WEBHOOK_HOST: ${EDA_WEBHOOK_HOST:-eda-webhook-api:8000}
   EDA_WEBHOOK_SERVER: http://${EDA_WEBHOOK_HOST:-eda-webhook-api:8000}
-  SSL_CERTIFICATE: ${SSL_CERTIFICATE:-/certs/cert.pem}
-  SSL_CERTIFICATE_KEY: ${SSL_CERTIFICATE_KEY:-/certs/cert.key}
-  SSL_CLIENT_CERTIFICATE: ${SSL_CLIENT_CERTIFICATE:-/certs/CA.pem}
+  EDA_STATIC_URL: ${EDA_STATIC_URL:-api/eda/static/}
+  SSL_CERTIFICATE: ${SSL_CERTIFICATE:-/certs/wildcard.crt}
+  SSL_CERTIFICATE_KEY: ${SSL_CERTIFICATE_KEY:-/certs/wildcard.key}
+  SSL_CLIENT_CERTIFICATE: ${SSL_CLIENT_CERTIFICATE:-/certs/client.crt}
 
 services:
   podman-pre-setup-node1:
@@ -283,13 +284,16 @@ services:
     ports:
       - '${EDA_PROXY_PORT:-3128}:3128'
 
-  eda-ui:
-    image: ${EDA_UI_IMAGE:-quay.io/ansible/eda-ui}:${EDA_UI_VERSION:-main}
+  eda-nginx:
+    image: ${EDA_NGINX_IMAGE:-docker.io/nginx:alpine}
     environment: *common-env
+    command: nginx -g "daemon off;"
     ports:
       - '${EDA_UI_PORT:-8443}:443'
     volumes:
-      - './tools/docker/my_certs:/tmp/my_certs:z'
+      - './my_certs:/tmp/my_certs:z'
+      - './nginx/certs:/certs:z'
+      - './nginx/default.conf.template:/etc/nginx/templates/default.conf.template:z'
     depends_on:
       eda-webhook-api:
         condition: service_healthy

tools/docker/docker-compose-stage.yaml

@@ -41,9 +41,9 @@ x-environment:
   - EDA_EVENT_STREAM_MTLS_BASE_URL=${EDA_EVENT_STREAM_MTLS_BASE_URL:-https://localhost:8443/mtls/edgecafe-beef-feed-fade-decadeedgecafe/}
   - EDA_WEBHOOK_HOST=${EDA_WEBHOOK_HOST:-eda-webhook-api:8000}
   - EDA_WEBHOOK_SERVER=http://${EDA_WEBHOOK_HOST:-eda-webhook-api:8000}
-  - SSL_CERTIFICATE=${SSL_CERTIFICATE:-/certs/cert.pem}
-  - SSL_CERTIFICATE_KEY=${SSL_CERTIFICATE_KEY:-/certs/cert.key}
-  - SSL_CLIENT_CERTIFICATE=${SSL_CLIENT_CERTIFICATE:-/certs/CA.pem}
+  - SSL_CERTIFICATE=${SSL_CERTIFICATE:-/certs/wildcard.crt}
+  - SSL_CERTIFICATE_KEY=${SSL_CERTIFICATE_KEY:-/certs/wildcard.key}
+  - SSL_CLIENT_CERTIFICATE=${SSL_CLIENT_CERTIFICATE:-/certs/client.crt}
 
 services:
   podman-pre-setup:
@@ -96,14 +96,16 @@ services:
       timeout: 5s
       retries: 3
       start_period: 5s
+
   eda-api:
     image: ${EDA_IMAGE:-quay.io/ansible/eda-server}:${EDA_IMAGE_VERSION:-main}
     environment: *common-env
     command:
       - /bin/bash
       - -c
       - >-
-        aap-eda-manage migrate
+        aap-eda-manage collectstatic --noinput
+        && aap-eda-manage migrate
         && ANSIBLE_REVERSE_RESOURCE_SYNC=false aap-eda-manage create_initial_data
         && ANSIBLE_REVERSE_RESOURCE_SYNC=false scripts/create_superuser.sh
         && gunicorn -b 0.0.0.0:8000
@@ -124,6 +126,8 @@ services:
     networks:
       - service-mesh
       - default
+    volumes:
+      - 'eda-api-staticfiles:/var/lib/eda/static:z'
 
   eda-ws:
     image: ${EDA_IMAGE:-quay.io/ansible/eda-server}:${EDA_IMAGE_VERSION:-main}
@@ -216,20 +220,25 @@ services:
     ports:
       - '${EDA_PROXY_PORT:-3128}:3128'
 
-  eda-ui:
-    image: ${EDA_UI_IMAGE:-quay.io/ansible/eda-ui}:${EDA_UI_VERSION:-main}
+  eda-nginx:
+    image: ${EDA_NGINX_IMAGE:-docker.io/nginx:alpine}
     environment: *common-env
+    command: nginx -g "daemon off;"
     ports:
       - '${EDA_UI_PORT:-8443}:443'
     volumes:
-      - './tools/docker/my_certs:/tmp/my_certs:z'
+      - './my_certs:/tmp/my_certs:z'
+      - './nginx/certs:/certs:z'
+      - './nginx/default.conf.template:/etc/nginx/templates/default.conf.template:z'
+      - 'eda-api-staticfiles:/staticfiles:z'
     depends_on:
       eda-webhook-api:
         condition: service_healthy
 
 volumes:
   postgres_data: {}
   podman_data: {}
+  eda-api-staticfiles: {}
 
 networks:
   service-mesh:

tools/docker/nginx/certs/client.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgsCFD0dvcgtXeu8WagL1ETOKGPTRDuyMA0GCSqGSIb3DQEBCwUAME4x
+CzAJBgNVBAYTAlVTMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0Rl
+ZmF1bHQgQ29tcGFueSBMdGQxCjAIBgNVBAMMASowHhcNMjQwOTI3MTA1NTExWhcN
+MjUwOTI3MTA1NTExWjBOMQswCQYDVQQGEwJVUzEVMBMGA1UEBwwMRGVmYXVsdCBD
+aXR5MRwwGgYDVQQKDBNEZWZhdWx0IENvbXBhbnkgTHRkMQowCAYDVQQDDAEqMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmTlUoRcWKaqtbSP6SXDTvnS
+AsjN+4gjybC2/Y0s/c58n7p04BuAQwq2MJGBVYU/bmdy5NuftxL3GFK+pSxdo3Ds
+AZqk4VIjANboG/wK7GTubcM02jgGDpvVCv68FqfXLdNxxXAwiZ6ecuDG0Zofh+au
+Er/Aw0+I1U2WXB+5AodE5DkSEi1++JvR0ue9ny5BCNrO8MP/OEGm+DbekWCiqcvc
+gYwjLVyVIDtmOH2BYUrjxS7bANF70DVVIc4NyZJMekJrpNUBrJtdhVTvs/PkYh7M
+EHcnnNeCPe0XC+nI+ctoDvY5PLcDdS0Y+RfWjQ5rRR/jkyD/GRXtHxB61H06sQID
+AQABMA0GCSqGSIb3DQEBCwUAA4IBAQA5wirw6WAQuDgoBP9FBXewVXBPv9kXICHO
+GMOAqbeWySMQZKDHVtz7Pl+K1tj70Yoy9ELQMLeKei8KiJU0D9fkay41KzhIgQLR
+ZRMIHhYdsTNnxmgATh5du9VZya8GXBuIdV9k4AKSUoQUCBDipvjp7RQPOFApIAzw
+I6jR0tA2d6av4XdWONvBbMq8otnSdh9Fkyw6hdy9lDODwo+A8eTNxHOk3EjW49Xf
+xbg/3vcMl6PM07z+Efno/L0Y5j9r4/afUy0m/WXlREFtRJ+VsHBEsc+flk92xviF
+ZfAxLfX46XDU1Oo7eet+IzLbe6E89DZPkLasoNS/zUQHe95NO7mu
+-----END CERTIFICATE-----

tools/docker/nginx/certs/client.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAsmTlUoRcWKaqtbSP6SXDTvnSAsjN+4gjybC2/Y0s/c58n7p0
+4BuAQwq2MJGBVYU/bmdy5NuftxL3GFK+pSxdo3DsAZqk4VIjANboG/wK7GTubcM0
+2jgGDpvVCv68FqfXLdNxxXAwiZ6ecuDG0Zofh+auEr/Aw0+I1U2WXB+5AodE5DkS
+Ei1++JvR0ue9ny5BCNrO8MP/OEGm+DbekWCiqcvcgYwjLVyVIDtmOH2BYUrjxS7b
+ANF70DVVIc4NyZJMekJrpNUBrJtdhVTvs/PkYh7MEHcnnNeCPe0XC+nI+ctoDvY5
+PLcDdS0Y+RfWjQ5rRR/jkyD/GRXtHxB61H06sQIDAQABAoIBAQCE+hjHDcsYegQ+
+Nj4f+PpBYI9fa/e/S5gBvCxrjFTBTK4xEngUpetSDiYIxi22ZgEGdy550gyYFxcB
+loxt60hRkNcbyv6kxuk4svmKArLRy9q/DwfSsngxY4/HBmOGL86CZl8kYaCMtSQ/
+VbZef5iJYTbY2v8Bl8PT3GX8fdkXPCYcpo3c491MhMsfk2/tmLC7vdlQIG31Gyw/
+gk4chmqibRmVoHWEXu8p1IyhMICk3tC7f2vszRxuh9Nq/qiof2n3KfUjxuNz5Uai
+xaIeRBGdoPAii9pfc4IFs5wLgR8xbelBeN6snSpmCMyqSL1eb+nFnKgOkFm+9+rv
+qsIUe7QRAoGBAOkeo3O43f7fS3e3On7nvXTM2BX0PRwspYxF1zTOpUz5ZqUaSD4a
+mHdgIdpztH586O9iCN9ZVNZeab8Ffv6emM73HqqECiHADMdK8mg1tovxZSdJ1TSL
++IxgHmUt2z+0r7+IKMFZZjcXhdZkxPA+reNDtxXA7LSuOYo+ccSK1LlbAoGBAMPn
+OUq8veRVa3pNfP6nTBUX8Zd630/Dbyf+PXeAbbLWJeRyAfSEdShU8oDRWyTHgDbd
+RJbpyC8pdOFeIyWvSB/CjEQFqx9WmKKNlCkwW2eQwvZRZXNPg6qWkow5wZgePXRr
+irS1tGlT+TRZ+zMSFfMxhhQA52HVsRdbK/Cgfc3jAoGBAMNNCND1av6RIg+csOQK
+z91flBTodp35BYR8KmyyRygytXzShP2KmHtCTXpPf0KM8TVD430CwSGLHXqMZzV3
+tzuFKureDgLye4InVuhZP6METKNapsUMEuG/0RchENLRVH/Y2ZQKiqjTCyxvZdKE
+IHgKjgMqiuRgJhKceAGZ8deLAoGBAI4v8i5jpXPn59ViDpoKNTeOJGSs4w5SrAgc
+COMGjRhjRCd19CNUTHCUj1qeGYgtYMrxeIoMbqaEcXftypbcjP24R/RLJPPe93Ps
+TKBEn+Mgd9EuLPMvwEH9fapXdUMCl9o6//a/d42HTHYJ5UAhHVthE47LRSWGYz2v
+h8njwsu/AoGAWFl8xCXd6Qbxx76moLbMFCuPYpKty98HlD1qVq2BdnEdEQJ/Elpu
+62tkPvj6MZdD3m4WPfrmdnJYtl8h/XMt2+3tt5xlISEaWuG0G01G/uHVP42sDfyK
+G2qakmC/0jWa6YVkCYPfxSbGOCd7hAt0Dcb4WIibo2XwnK5Sjp3D7X4=
+-----END RSA PRIVATE KEY-----

tools/docker/nginx/certs/wildcard.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgsCFEN41HM9hrSSTS5IOapA3C2FJqZCMA0GCSqGSIb3DQEBCwUAME4x
+CzAJBgNVBAYTAlVTMRUwEwYDVQQHDAxEZWZhdWx0IENpdHkxHDAaBgNVBAoME0Rl
+ZmF1bHQgQ29tcGFueSBMdGQxCjAIBgNVBAMMASowHhcNMjQwOTI3MTA1NDM0WhcN
+MjUwOTI3MTA1NDM0WjBOMQswCQYDVQQGEwJVUzEVMBMGA1UEBwwMRGVmYXVsdCBD
+aXR5MRwwGgYDVQQKDBNEZWZhdWx0IENvbXBhbnkgTHRkMQowCAYDVQQDDAEqMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvyrc0qtNdlf3r/hQeibzxc5o
+JMjGNPIAP6nJhIj20l2ovBbn5UBMuZYYLNYfxOS+RHez1V7osVnlMh56hqzjJRK3
+hfBKo09T8SoPe4P3q8JVxhtPLrckSEf/IgipTBFbCUywv3PdnFE7E+xrcpGMbPXS
+WQ+dcc+pddc73xwwwlVFyUa24GYzEfbi9uH7BQIxHqd+dfF/i+ciUmTM198m3/iK
+nuijYWamA2D1eBXw3stBkVqbrFaHx/oeefowcP0+r9a/p8j9I3ulgNut19NupoA6
+4l2aIDa8lIKVxEfIXn+o8sbQW/Md6rMQ5lHQE7HmtMxTiPtWOmfO/+ePo45ynwID
+AQABMA0GCSqGSIb3DQEBCwUAA4IBAQBxmBLBRDXVqHsDUUzj2fA9lJFVMpXIzHd2
+bw9eJB/dx6QDa9PrV1ffLpjqixep4PHTemJDJ8uGyJvAVEJSeUlZtcKclF5JrOkc
+S/ScWC5fTlFrXcWFtZHk4EwawTpOi3fIK0Crpj46lEwehZ1W2A57LsvPQ7YYnq4d
+sj+uj4L6rbtzS+OhT2sFHNO6q0hljMQ4Isu7w+aEhmr+AnlLlC7m7hAvfX0Tri6A
+6vCxTB6R6FWuCMd0CwAYeKc7ECAxWlIqt1a2IUIAYBgiHmHsnvE1RMsL5t7DGjDz
+5lCEAJg4baGQHVRSUBwf9o2Rf/0PhoJA0NO/OlSE8QHBrVIMRjFx
+-----END CERTIFICATE-----

tools/docker/nginx/certs/wildcard.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAvyrc0qtNdlf3r/hQeibzxc5oJMjGNPIAP6nJhIj20l2ovBbn
+5UBMuZYYLNYfxOS+RHez1V7osVnlMh56hqzjJRK3hfBKo09T8SoPe4P3q8JVxhtP
+LrckSEf/IgipTBFbCUywv3PdnFE7E+xrcpGMbPXSWQ+dcc+pddc73xwwwlVFyUa2
+4GYzEfbi9uH7BQIxHqd+dfF/i+ciUmTM198m3/iKnuijYWamA2D1eBXw3stBkVqb
+rFaHx/oeefowcP0+r9a/p8j9I3ulgNut19NupoA64l2aIDa8lIKVxEfIXn+o8sbQ
+W/Md6rMQ5lHQE7HmtMxTiPtWOmfO/+ePo45ynwIDAQABAoIBAGlAfTJUdKLKzimJ
+qy2GEsN+4GIYVODDuRVUMwqQqmyqeoOMjQLwww2PMSJGhllOo99olI/O4Ij8+K7+
+jvFlcO5xfq/02/NMcugeA0Y7I3ri1Xzsfk03MnfFhBhF8ohaKehV3B6c+Y/ePYu7
+qHD85/b55WV5rnMCJcgmx+UQTVxAyMfKiq5WSbj2jTRFUuZbeXGO+sLC7x1S9NNt
+INOcl7PTU6OeCpB+WT18gBxv3aGQj33kbR2DhrIxE4Zax/URkKlfwRtWzXWuIsAr
+U+udE5Vs345exRjxb292m1kEAtYT80gv8TjGG9sMJxtq2yjm0V7qQq+Pz7OghJo7
+/FahNNkCgYEA620O1ZWmD1+l3/14QvMtoFX70Lmrx3L0ngfbnlO7DJbLyDpu6MgO
+zOSfI6N8ClpPeZDR9J3jCosGNAbnu4klmHxLgWUOjwsBMfk6ojWV2X/kUlnXhAxj
+/sNiKpdxpp3gQlzJF6CcZq4IN5o3Bbl9R2X5+JRxbc9pJLCYMCqlaMUCgYEAz9+n
+RXwmywKl/cveNOIAf2iY+YCNBbSDdFUUOQ+SPUnTzVGc4dJ03+k2/9yXDEIwVAG5
+7sN4Ht9ubhbv/PZ5o3hlQva8qpUCINhqnva9NXBkJpqDhY8wqo4sUzKS1QICaZ1I
+bSy3t8ZrR1qp0QtgO1g/A6fR0YUjLFnvDr5rvBMCgYEAjx9z30Dk/X+mde/ARuNT
+n5/mQNQ/rDcko1Yfm7dHhbW/GXD8sCO/a6ypWp8u75RLsJnsKgw6VNSD5ukzw/zy
+kCswM+/d0/Rau6jKjoaJHPr1MWNQ9AQcXmslqML84tAj3/RMhEKuEnZGpJbqUF6d
+3OQP/aEw/BMV1qpNOysR+AkCgYEAlKBqrsnHytsH5+C97b2xcWdOCQaazft1CdZS
+8UFq5BtHLsQtkWCyY+4RfvsvnHoup8HcORTVa+2AvYH08T8hVXodnLVhy+1iai2S
+fjoYqn7DfL55TyNEPo4Mrye3yEj5hJ4KTNTuPp3F0mzGgkrJ8WR1GZ4B7PZuYaWj
+wTzxNrUCgYALXC7D9jL1Z9IPTnFNmAv7d5RSw0xV2br7nK+594vMkaBM29ki2P5D
+5QZx/itY1N35Gv6SwouZkWdXHqaJE0SQwWfd+LX968lFAVCoY5zWdFkvfIMWZWG8
+a5cGbYUHJCpaJMpNrOwTo8pYU+omd2ukno4rKtglKm6vEWfBSUMRig==
+-----END RSA PRIVATE KEY-----

tools/docker/nginx/default.conf.template

@@ -0,0 +1,68 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+    server_tokens off;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name _;
+    server_tokens off;
+
+    ssl_certificate ${SSL_CERTIFICATE};
+    ssl_certificate_key ${SSL_CERTIFICATE_KEY};
+    ssl_client_certificate ${SSL_CLIENT_CERTIFICATE};
+    ssl_verify_client optional;
+
+    access_log off;
+    # error_log off;
+
+    autoindex off;
+
+    include mime.types;
+    types {
+        application/manifest+json webmanifest;
+    }
+
+    sendfile on;
+
+    root /usr/share/nginx/html;
+
+    location ~ ^/api/eda/ {
+        proxy_pass $EDA_SERVER;
+        proxy_set_header Origin $EDA_SERVER;
+    }
+
+    location /mtls/$EDA_SERVER_UUID/ {
+        if ( $ssl_client_verify != "SUCCESS" ) {
+            return 403;
+        }
+        proxy_pass $EDA_WEBHOOK_SERVER/;
+        proxy_set_header Origin $EDA_WEBHOOK_SERVER;
+        proxy_set_header Subject $ssl_client_s_dn;
+    }
+
+    location /$EDA_SERVER_UUID/ {
+        proxy_pass $EDA_WEBHOOK_SERVER/;
+        proxy_set_header Origin $EDA_WEBHOOK_SERVER;
+    }
+
+    location ~ /api/eda/ws/[0-9a-z-]+ {
+        proxy_pass $EDA_SERVER;
+        proxy_set_header Origin $EDA_SERVER;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
+    }
+
+    location ^~ /static/ {
+        alias /staticfiles/;
+    }
+
+    location / {
+        return 301 https://$host/api/eda/v1/docs;
+    }
+}