From a79988b35c40e809d60ccf2a122ba0b8d1bfb744 Mon Sep 17 00:00:00 2001 From: Bastian Wagner Date: Wed, 15 Jul 2026 15:19:15 +0200 Subject: [PATCH] docker --- .env.example | 4 ++-- Dockerfile | 4 ++-- README.md | 10 ++++---- apps/web/src/config.js | 2 +- apps/web/src/main.ts | 2 +- docker-compose.yml | 1 - docker/single-container.nginx.conf | 37 ++++++++++++++++++++++++++++++ docker/start-single-container.sh | 2 +- 8 files changed, 48 insertions(+), 14 deletions(-) diff --git a/.env.example b/.env.example index bc86ce4..5e9c677 100644 --- a/.env.example +++ b/.env.example @@ -3,7 +3,7 @@ NODE_ENV=development API_PORT=3000 WEB_PORT=4200 PUBLIC_WEB_URL=http://localhost:4200 -API_BASE_URL=http://localhost:3000 +API_BASE_URL= DATABASE_URL=mysql://ldap_portal:change-me@mysql.example.com:3306/ldap_portal DATABASE_SSL=false @@ -24,7 +24,7 @@ SMTP_USER=portal@example.com SMTP_PASS=change-me SMTP_FROM="LDAP Portal " -OIDC_ISSUER=http://localhost:3000 +OIDC_ISSUER=http://localhost:8080 OIDC_COOKIE_SECRET=change-me-long-random-oidc-cookie-secret OIDC_ADMIN_GROUP=client_manager OIDC_ADMIN_GROUP_UUID=89aa3d8d-fcbd-3ec9-b99d-901a0cfc405e diff --git a/Dockerfile b/Dockerfile index c9d3e61..3148140 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,7 +17,7 @@ WORKDIR /app ENV NODE_ENV=production ENV API_PORT=3000 ENV WEB_PORT=8080 -ENV API_BASE_URL=http://localhost:3000 +ENV API_BASE_URL= RUN apk add --no-cache nginx @@ -30,5 +30,5 @@ COPY docker/start-single-container.sh /usr/local/bin/start-ldap-portal RUN chmod +x /usr/local/bin/start-ldap-portal \ && mkdir -p /run/nginx /var/log/nginx -EXPOSE 3000 8080 +EXPOSE 8080 CMD ["start-ldap-portal"] diff --git a/README.md b/README.md index 31cbc98..b39318f 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ npm run start:api npm run start:web ``` -Die API laeuft standardmaessig auf `http://localhost:3000`, das Frontend auf `http://localhost:4200`. +In der lokalen Entwicklung laeuft die API standardmaessig auf `http://localhost:3000`, das Frontend auf `http://localhost:4200`. ## Docker Compose @@ -39,8 +39,8 @@ Fuer OIDC muessen zusaetzlich `OIDC_ISSUER`, `OIDC_COOKIE_SECRET`, `OIDC_ADMIN_G Das Root-`Dockerfile` baut API und Angular in ein einzelnes Image. Der Container startet: -- NestJS API / IdP auf Port `3000` -- Nginx Web-UI auf Port `8080` +- Nginx Web-UI und Reverse Proxy auf Port `8080` +- NestJS API / IdP nur intern auf Port `3000` Build und Push: @@ -54,13 +54,11 @@ Start: ```bash docker run -d --name ldap-portal-idp \ --env-file .env \ - -e API_BASE_URL=https://id.example.com \ - -p 3000:3000 \ -p 8080:8080 \ registry.example.com/ldap-portal/idp:latest ``` -`API_BASE_URL` wird beim Containerstart in `/config.js` geschrieben und vom Angular-Frontend gelesen. Setze es auf die aus Browser-Sicht erreichbare API-/IdP-URL. +Standardmaessig bleibt `API_BASE_URL` leer. Das Frontend nutzt dadurch relative URLs und Nginx routet API-/OIDC-Pfade intern zur NestJS-API. Setze `API_BASE_URL` nur, wenn das Frontend bewusst eine andere API-Origin verwenden soll. ## Externe Dienste diff --git a/apps/web/src/config.js b/apps/web/src/config.js index 9f68964..f3fd954 100644 --- a/apps/web/src/config.js +++ b/apps/web/src/config.js @@ -1,3 +1,3 @@ window.__LDAP_PORTAL_CONFIG__ = { - apiBaseUrl: 'http://localhost:3000' + apiBaseUrl: '' }; diff --git a/apps/web/src/main.ts b/apps/web/src/main.ts index 4874eaf..307098f 100644 --- a/apps/web/src/main.ts +++ b/apps/web/src/main.ts @@ -66,6 +66,6 @@ bootstrapApplication(AppComponent, { provideRouter(routes), provideHttpClient(withInterceptors([authInterceptor])), AuthService, - { provide: API_BASE_URL, useValue: window.__LDAP_PORTAL_CONFIG__?.apiBaseUrl ?? 'http://localhost:3000' }, + { provide: API_BASE_URL, useValue: window.__LDAP_PORTAL_CONFIG__?.apiBaseUrl ?? '' }, ], }).catch((error) => console.error(error)); diff --git a/docker-compose.yml b/docker-compose.yml index c20ccfc..ea21a84 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -6,5 +6,4 @@ services: env_file: - .env ports: - - "3000:3000" - "8080:8080" diff --git a/docker/single-container.nginx.conf b/docker/single-container.nginx.conf index 9e4e49c..cbbbb07 100644 --- a/docker/single-container.nginx.conf +++ b/docker/single-container.nginx.conf @@ -4,11 +4,48 @@ server { root /usr/share/nginx/html; index index.html; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + location = /config.js { add_header Cache-Control "no-store"; try_files $uri =404; } + location /.well-known/ { + proxy_pass http://127.0.0.1:3000; + } + + location /oidc/ { + proxy_pass http://127.0.0.1:3000; + } + + location /interaction/ { + proxy_pass http://127.0.0.1:3000; + } + + location /auth/ { + proxy_pass http://127.0.0.1:3000; + } + + location /account/ { + proxy_pass http://127.0.0.1:3000; + } + + location /admin/ { + proxy_pass http://127.0.0.1:3000; + } + + location /password/ { + proxy_pass http://127.0.0.1:3000; + } + + location /registration/ { + proxy_pass http://127.0.0.1:3000; + } + location / { try_files $uri $uri/ /index.html; } diff --git a/docker/start-single-container.sh b/docker/start-single-container.sh index d949236..f92301f 100644 --- a/docker/start-single-container.sh +++ b/docker/start-single-container.sh @@ -3,7 +3,7 @@ set -eu cat >/usr/share/nginx/html/config.js <