first commit

2026-10-09 02:48:31 +07:00
commit 8db22bfaa6
17 changed files with 1722 additions and 0 deletions
@@ -0,0 +1,66 @@
+# nginx gateway terpadu — docker-socket-proxy + config-agent dalam SATU port.
+#
+# Template: docker-entrypoint nginx men-substitute ${GATEWAY_API_KEY} saat start
+# (variabel nginx seperti $http_x_api_key TIDAK ikut diganti), lalu menulis hasil
+# ke /etc/nginx/conf.d/default.conf.
+#
+# Kebijakan:
+#   * Semua request WAJIB membawa header `X-Api-Key` == GATEWAY_API_KEY (401 bila
+#     salah/kosong), SEBELUM diproses location mana pun.
+#   * Allowlist path ketat:
+#       - /_ping /version /info /events /containers/*   → docker-proxy:2375
+#       - /healthz /env /dbt /ca /catalog(/<name>) /opa/data /services/scan → config-agent:8080
+#     Selain daftar → 403.
+#   * Aksi container restart/start/stop hanya POST (selainnya 405).
+#   * Katalog (cart agent) mengizinkan GET/PUT/DELETE.
+#
+# Lihat: docs/desain-host-gateway-terpadu.md
+
+server {
+    listen 80 default_server;
+    server_name _;
+
+    # ==== API-key check (sebelum location mana pun) ====
+    if ($http_x_api_key != "${GATEWAY_API_KEY}") {
+        return 401;
+    }
+
+    # ==== config-agent (konfigurasi platform) ====
+    location = /healthz { proxy_pass http://config-agent:8080; }
+    location = /env     { proxy_pass http://config-agent:8080; }
+    location = /dbt     { proxy_pass http://config-agent:8080; }
+    location = /ca      { proxy_pass http://config-agent:8080; }
+    location = /catalog { proxy_pass http://config-agent:8080; }
+    # GET/PUT/DELETE satu katalog (tanpa slash tambahan di nama).
+    location ~ ^/catalog/[^/]+$ { proxy_pass http://config-agent:8080; }
+    # Dokumen data OPA (menu Authorization) — baca sekarang, tulis menyusul.
+    location = /opa/data { proxy_pass http://config-agent:8080; }
+    # Scan service (panel-driven) — memindai container host lewat docker-proxy.
+    location = /services/scan { proxy_pass http://config-agent:8080; }
+
+    # ==== docker-socket-proxy (Docker Engine API) ====
+    location = /_ping   { proxy_pass http://docker-proxy:2375; }
+    location = /version { proxy_pass http://docker-proxy:2375; }
+    location = /info    { proxy_pass http://docker-proxy:2375; }
+    location = /events  { proxy_pass http://docker-proxy:2375; }
+
+    location = /containers/json { proxy_pass http://docker-proxy:2375; }
+
+    location ~ ^/containers/[^/]+/json$  { proxy_pass http://docker-proxy:2375; }
+    location ~ ^/containers/[^/]+/logs$  { proxy_pass http://docker-proxy:2375; }
+    location ~ ^/containers/[^/]+/stats$ { proxy_pass http://docker-proxy:2375; }
+    location ~ ^/containers/[^/]+/top$   { proxy_pass http://docker-proxy:2375; }
+
+    # Aksi tulis container — hanya POST.
+    location ~ ^/containers/[^/]+/(restart|start|stop)$ {
+        if ($request_method != POST) {
+            return 405;
+        }
+        proxy_pass http://docker-proxy:2375;
+    }
+
+    # ==== selain allowlist → tolak ====
+    location / {
+        return 403;
+    }
+}