From 449942288ae17eed53d8438cfcd04f28921edc45 Mon Sep 17 00:00:00 2001
From: Rhys Bartels-Waller <rhys.bartelswaller@iohk.io>
Date: Tue, 16 Mar 2021 14:13:43 +1100
Subject: [PATCH] fix: disable CORS in Hasura graphql-engine

Hasura is considered a private service in this stack. CORS is configured with
either the cardano-graphql server, or a reverse proxy if the former is not public.

Closes #392
---
 nix/nixos/graphql-engine-service.nix                       | 3 ++-
 packages/api-cardano-db-hasura/hasura/docker-entrypoint.sh | 5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/nix/nixos/graphql-engine-service.nix b/nix/nixos/graphql-engine-service.nix
index c0b3c46b..e3a8c8e2 100644
--- a/nix/nixos/graphql-engine-service.nix
+++ b/nix/nixos/graphql-engine-service.nix
@@ -79,7 +79,8 @@ in {
           --port ${toString cfg.dbPort} \
           serve \
           --server-port ${toString cfg.enginePort} \
-          --enable-telemetry=false
+          --enable-telemetry=false \
+          --disable-cors
       '';
     };
   };
diff --git a/packages/api-cardano-db-hasura/hasura/docker-entrypoint.sh b/packages/api-cardano-db-hasura/hasura/docker-entrypoint.sh
index 97cfb473..24ed509e 100755
--- a/packages/api-cardano-db-hasura/hasura/docker-entrypoint.sh
+++ b/packages/api-cardano-db-hasura/hasura/docker-entrypoint.sh
@@ -8,4 +8,7 @@ POSTGRES_USER=${POSTGRES_USER:-$(cat ${SECRET_DIR}/postgres_user)}
 POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-$(cat ${SECRET_DIR}/postgres_password)}
 HASURA_GRAPHQL_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}
 
-exec graphql-engine --database-url $HASURA_GRAPHQL_DATABASE_URL serve
+exec graphql-engine \
+  --disable-cors \
+  --database-url $HASURA_GRAPHQL_DATABASE_URL \
+  serve