67 lines
2.8 KiB
Plaintext
67 lines
2.8 KiB
Plaintext
|
# nginx gateway terpadu — docker-socket-proxy + config-agent dalam SATU port.
|
||
|
|
#
|
||
|
|
# Template: docker-entrypoint nginx men-substitute ${GATEWAY_API_KEY} saat start
|
||
|
|
# (variabel nginx seperti $http_x_api_key TIDAK ikut diganti), lalu menulis hasil
|
||
|
|
# ke /etc/nginx/conf.d/default.conf.
|
||
|
|
#
|
||
|
|
# Kebijakan:
|
||
|
|
# * Semua request WAJIB membawa header `X-Api-Key` == GATEWAY_API_KEY (401 bila
|
||
|
|
# salah/kosong), SEBELUM diproses location mana pun.
|
||
|
|
# * Allowlist path ketat:
|
||
|
|
# - /_ping /version /info /events /containers/* → docker-proxy:2375
|
||
|
|
# - /healthz /env /dbt /ca /catalog(/<name>) /opa/data /services/scan → config-agent:8080
|
||
|
|
# Selain daftar → 403.
|
||
|
|
# * Aksi container restart/start/stop hanya POST (selainnya 405).
|
||
|
|
# * Katalog (cart agent) mengizinkan GET/PUT/DELETE.
|
||
|
|
#
|
||
|
|
# Lihat: docs/desain-host-gateway-terpadu.md
|
||
|
|
|
||
|
|
server {
|
||
|
|
listen 80 default_server;
|
||
|
|
server_name _;
|
||
|
|
|
||
|
|
# ==== API-key check (sebelum location mana pun) ====
|
||
|
|
if ($http_x_api_key != "${GATEWAY_API_KEY}") {
|
||
|
|
return 401;
|
||
|
|
}
|
||
|
|
|
||
|
|
# ==== config-agent (konfigurasi platform) ====
|
||
|
|
location = /healthz { proxy_pass http://config-agent:8080; }
|
||
|
|
location = /env { proxy_pass http://config-agent:8080; }
|
||
|
|
location = /dbt { proxy_pass http://config-agent:8080; }
|
||
|
|
location = /ca { proxy_pass http://config-agent:8080; }
|
||
|
|
location = /catalog { proxy_pass http://config-agent:8080; }
|
||
|
|
# GET/PUT/DELETE satu katalog (tanpa slash tambahan di nama).
|
||
|
|
location ~ ^/catalog/[^/]+$ { proxy_pass http://config-agent:8080; }
|
||
|
|
# Dokumen data OPA (menu Authorization) — baca sekarang, tulis menyusul.
|
||
|
|
location = /opa/data { proxy_pass http://config-agent:8080; }
|
||
|
|
# Scan service (panel-driven) — memindai container host lewat docker-proxy.
|
||
|
|
location = /services/scan { proxy_pass http://config-agent:8080; }
|
||
|
|
|
||
|
|
# ==== docker-socket-proxy (Docker Engine API) ====
|
||
|
|
location = /_ping { proxy_pass http://docker-proxy:2375; }
|
||
|
|
location = /version { proxy_pass http://docker-proxy:2375; }
|
||
|
|
location = /info { proxy_pass http://docker-proxy:2375; }
|
||
|
|
location = /events { proxy_pass http://docker-proxy:2375; }
|
||
|
|
|
||
|
|
location = /containers/json { proxy_pass http://docker-proxy:2375; }
|
||
|
|
|
||
|
|
location ~ ^/containers/[^/]+/json$ { proxy_pass http://docker-proxy:2375; }
|
||
|
|
location ~ ^/containers/[^/]+/logs$ { proxy_pass http://docker-proxy:2375; }
|
||
|
|
location ~ ^/containers/[^/]+/stats$ { proxy_pass http://docker-proxy:2375; }
|
||
|
|
location ~ ^/containers/[^/]+/top$ { proxy_pass http://docker-proxy:2375; }
|
||
|
|
|
||
|
|
# Aksi tulis container — hanya POST.
|
||
|
|
location ~ ^/containers/[^/]+/(restart|start|stop)$ {
|
||
|
|
if ($request_method != POST) {
|
||
|
|
return 405;
|
||
|
|
}
|
||
|
|
proxy_pass http://docker-proxy:2375;
|
||
|
|
}
|
||
|
|
|
||
|
|
# ==== selain allowlist → tolak ====
|
||
|
|
location / {
|
||
|
|
return 403;
|
||
|
|
}
|
||
|
|
}
|