dnoulet/go-guess
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
go-guess/deploy/nginx/README.md
Daniel Noulet ca5765b988 feat: integrate tenant SSO and remote toggle 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-10-03 00:46:27 +02:00

2.3 KiB
Raw Blame History

Dedicated-server reverse proxy

Production exposes only the Go Guess application through Kubernetes NodePort 31374. PostgreSQL and RabbitMQ remain available only through their cluster-internal services.

DNS

In one.com, create an A record for goguess.urpi.be pointing to the dedicated server's public IPv4 address. Add an AAAA record only when the server and its firewall are configured for public IPv6. Wait for:

dig +short goguess.urpi.be

to return the dedicated server address before requesting a certificate.

Nginx and Certbot

The included virtual host assumes Rancher runs in Docker on the Nginx server. It reaches the embedded K3s NodePort through Rancher's Docker bridge address, 172.17.0.2:31374. Confirm that address with docker inspect rancher before installing the configuration.

sudo install -m 0644 deploy/nginx/goguess.urpi.be.conf \
  /etc/nginx/sites-available/goguess.urpi.be.conf
sudo ln -s /etc/nginx/sites-available/goguess.urpi.be.conf \
  /etc/nginx/sites-enabled/goguess.urpi.be.conf
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d goguess.urpi.be
sudo certbot renew --dry-run

Certbot adds the HTTPS listener, certificate paths, and HTTP-to-HTTPS redirect to this virtual host. Allow inbound TCP ports 80 and 443. Do not expose NodePort 31374, PostgreSQL 5432, RabbitMQ 5672, or RabbitMQ management ports to the public internet. If Rancher uses a different Docker address, replace 172.17.0.2 in proxy_pass with the current Rancher container address.

Deploy and verify

Deploy the production profile:

make helm-deploy-production
kubectl -n go-guess-production get pods
kubectl -n go-guess-production get service go-guess
curl --fail http://172.17.0.2:31374/api/health
curl --fail https://goguess.urpi.be/api/health

The go-guess service should show 80:31374/TCP. The PostgreSQL and RabbitMQ services should remain ClusterIP services without NodePorts.

Protected interviewer routes also call Go Loose from the application pod, using app.goLooseBaseURL (default https://%s.auth.dev, where %s is the request tenant). That address must be reachable from the cluster. The browser forwards browser authentication and API requests without adding application credentials. Nginx does not add or strip authorization headers.