5449cd3d8d
Signing in now starts at the sign-in screen and one button that hands the browser to Go Loose, which returns to the welcome page. Nothing redirects to the identity provider on its own any more: that fired on every anonymous visit and read as a redirect loop rather than as a choice to sign in. The password form remains only where the API reports that Go Loose login is not configured for the host, because otherwise the application is unreachable on a bare localhost. A person's picture is carried through from the Go Loose identity and rendered in the account menu and on the profile page, with their initials as the fallback. Two things make that fallback necessary rather than decorative: Go Loose retires a picture key when a picture is replaced, so a link cached in a browser can be dead, and most people have not uploaded one. The URL is deliberately not persisted locally, since a stored key would keep failing after the picture changed. The account menu is a disclosure rather than a hover menu: a real button with aria-expanded, Escape and outside clicks closing it, and focus returning to the trigger. It is not an ARIA menu, because its actions are a link and a button and menuitem roles would strip the link semantics from one of them for no gain. The account URL of the Go Loose identity is resolved on each sign-in and is read from the live identity provider every time, which is also what makes it correct after a picture change. Depends on the Go Loose revision that serves avatar_url through /connect/userinfo, so the picture URL reaches this application at all.
2.3 KiB
Dedicated-server reverse proxy
Production exposes only the Go Guess application through Kubernetes NodePort
31374. PostgreSQL and RabbitMQ remain available only through their
cluster-internal services.
DNS
In one.com, create an A record for goguess.urpi.be pointing to the dedicated
server's public IPv4 address. Add an AAAA record only when the server and its
firewall are configured for public IPv6. Wait for:
dig +short goguess.urpi.be
to return the dedicated server address before requesting a certificate.
Nginx and Certbot
The included virtual host assumes Rancher runs in Docker on the Nginx server.
It reaches the embedded K3s NodePort through Rancher's Docker bridge address,
172.17.0.2:31374. Confirm that address with docker inspect rancher before
installing the configuration.
sudo install -m 0644 deploy/nginx/goguess.urpi.be.conf \
/etc/nginx/sites-available/goguess.urpi.be.conf
sudo ln -s /etc/nginx/sites-available/goguess.urpi.be.conf \
/etc/nginx/sites-enabled/goguess.urpi.be.conf
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d goguess.urpi.be
sudo certbot renew --dry-run
Certbot adds the HTTPS listener, certificate paths, and HTTP-to-HTTPS redirect
to this virtual host. Allow inbound TCP ports 80 and 443. Do not expose
NodePort 31374, PostgreSQL 5432, RabbitMQ 5672, or RabbitMQ management
ports to the public internet. If Rancher uses a different Docker address,
replace 172.17.0.2 in proxy_pass with the current Rancher container address.
Deploy and verify
Deploy the production profile:
make helm-deploy-production
kubectl -n go-guess-production get pods
kubectl -n go-guess-production get service go-guess
curl --fail http://172.17.0.2:31374/api/health
curl --fail https://goguess.urpi.be/api/health
The go-guess service should show 80:31374/TCP. The PostgreSQL and RabbitMQ
services should remain ClusterIP services without NodePorts.
Browser sign-in also calls Go Loose from the application pod, using
GO_LOOSE_AUTH_DOMAIN (auth-dev.urpi.be outside production, auth.urpi.be in
production) as https://<tenant>.<GO_LOOSE_AUTH_DOMAIN>. That address must be
reachable from the pod. The browser forwards browser authentication and API
requests without adding application credentials. Nginx does not add or strip
authorization headers.