Skip to content

Commit d48a369

Browse files
kaanyagcikaanyagci
authored
Merge pull request #6 from Makepad-fr/codex/makepad-landing-proxy
feat: add makepad landing proxy
2 parents 5522bd9 + f14df36 commit d48a369

6 files changed

Lines changed: 120 additions & 3 deletions

File tree

‎.github/workflows/manual-deploy.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,16 @@ jobs:
4242
MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK: ${{ secrets.MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK }}
4343
MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK: ${{ secrets.MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK }}
4444
MAKEPAD_PROXY_VIF_APP_NETWORK: ${{ secrets.MAKEPAD_PROXY_VIF_APP_NETWORK }}
45+
MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK: ${{ secrets.MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK }}
4546
run: |
4647
set -euo pipefail
4748
for required_network in \
4849
MAKEPAD_PROXY_PROD_APP_NETWORK \
4950
MAKEPAD_PROXY_CANARY_APP_NETWORK \
5051
MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK \
5152
MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK \
52-
MAKEPAD_PROXY_VIF_APP_NETWORK; do
53+
MAKEPAD_PROXY_VIF_APP_NETWORK \
54+
MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK; do
5355
if [[ -z "${!required_network}" ]]; then
5456
echo "::error::Missing required production secret: ${required_network}" >&2
5557
exit 1
@@ -67,12 +69,14 @@ jobs:
6769
cp sites/alerteconso-prod.conf.template "${bundle_root}/sites/alerteconso-prod.conf.template"
6870
cp sites/le-petit-coin-prod.conf.template "${bundle_root}/sites/le-petit-coin-prod.conf.template"
6971
cp sites/vif-prod.conf.template "${bundle_root}/sites/vif-prod.conf.template"
72+
cp sites/makepad-landing-prod.conf.template "${bundle_root}/sites/makepad-landing-prod.conf.template"
7073
{
7174
echo "MAKEPAD_PROXY_PROD_APP_NETWORK=${MAKEPAD_PROXY_PROD_APP_NETWORK}"
7275
echo "MAKEPAD_PROXY_CANARY_APP_NETWORK=${MAKEPAD_PROXY_CANARY_APP_NETWORK}"
7376
echo "MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK=${MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK}"
7477
echo "MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK=${MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK}"
7578
echo "MAKEPAD_PROXY_VIF_APP_NETWORK=${MAKEPAD_PROXY_VIF_APP_NETWORK}"
79+
echo "MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK=${MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK}"
7680
} > "${bundle_root}/envs/production/.env.deploy"
7781
7882
- name: Deploy via Docker Swarm
@@ -107,6 +111,7 @@ jobs:
107111
scp "${scp_opts[@]}" "${bundle_root}/sites/alerteconso-prod.conf.template" "${remote_target}:${REMOTE_DIR}/sites/alerteconso-prod.conf.template"
108112
scp "${scp_opts[@]}" "${bundle_root}/sites/le-petit-coin-prod.conf.template" "${remote_target}:${REMOTE_DIR}/sites/le-petit-coin-prod.conf.template"
109113
scp "${scp_opts[@]}" "${bundle_root}/sites/vif-prod.conf.template" "${remote_target}:${REMOTE_DIR}/sites/vif-prod.conf.template"
114+
scp "${scp_opts[@]}" "${bundle_root}/sites/makepad-landing-prod.conf.template" "${remote_target}:${REMOTE_DIR}/sites/makepad-landing-prod.conf.template"
110115
111116
ssh "${ssh_opts[@]}" "${remote_target}" bash -se -- "${REMOTE_DIR}" "${STACK_NAME}" <<'EOF'
112117
set -euo pipefail
@@ -119,7 +124,8 @@ jobs:
119124
"$(grep '^MAKEPAD_PROXY_CANARY_APP_NETWORK=' "${env_deploy}" | tail -n 1 | cut -d= -f2-)" \
120125
"$(grep '^MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK=' "${env_deploy}" | tail -n 1 | cut -d= -f2-)" \
121126
"$(grep '^MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK=' "${env_deploy}" | tail -n 1 | cut -d= -f2-)" \
122-
"$(grep '^MAKEPAD_PROXY_VIF_APP_NETWORK=' "${env_deploy}" | tail -n 1 | cut -d= -f2-)"; do
127+
"$(grep '^MAKEPAD_PROXY_VIF_APP_NETWORK=' "${env_deploy}" | tail -n 1 | cut -d= -f2-)" \
128+
"$(grep '^MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK=' "${env_deploy}" | tail -n 1 | cut -d= -f2-)"; do
123129
docker network inspect "${app_network}" >/dev/null 2>&1 \
124130
|| docker network create --driver overlay --attachable "${app_network}"
125131
done

‎README.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ This repository owns the shared proxy stack for application VMs. Application rep
1010
- `sites/catwlk-*.conf.template`: Catwlk virtual host templates
1111
- `sites/alerteconso-prod.conf.template`: Alerte Conso virtual host template
1212
- `sites/le-petit-coin-prod.conf.template`: au petit coin backend virtual host template
13+
- `sites/vif-prod.conf.template`: Vif virtual host template
14+
- `sites/makepad-landing-prod.conf.template`: Makepad landing site virtual host template
1315
- `envs/production/compose.yml`: production Swarm overrides
1416
- `envs/production/.env.proxy`: production proxy settings
1517

@@ -21,8 +23,10 @@ The proxy joins shared external overlay networks:
2123
- `${MAKEPAD_PROXY_CANARY_APP_NETWORK}`
2224
- `${MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK}`
2325
- `${MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK}`
26+
- `${MAKEPAD_PROXY_VIF_APP_NETWORK}`
27+
- `${MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK}`
2428

25-
Each application stack attaches to its corresponding shared network and exposes a stable DNS alias there. `aupetitcoin.makepad.fr` proxies to `LE_PETIT_COIN_PROD_UPSTREAM`, which defaults to `http://le-petit-coin-backend:8080` to match the backend stack's production `LE_PETIT_COIN_BACKEND_ALIAS`.
29+
Each application stack attaches to its corresponding shared network and exposes a stable DNS alias there. `aupetitcoin.makepad.fr` proxies to `LE_PETIT_COIN_PROD_UPSTREAM`, which defaults to `http://le-petit-coin-backend:8080` to match the backend stack's production `LE_PETIT_COIN_BACKEND_ALIAS`. `makepad.fr` proxies to `MAKEPAD_LANDING_PROD_UPSTREAM`, which defaults to `http://makepad-landing-prod-app:8080`; `www.makepad.fr` redirects permanently to `makepad.fr`.
2630

2731
## Node Labels
2832

@@ -48,6 +52,8 @@ Required environment secrets:
4852
- `MAKEPAD_PROXY_CANARY_APP_NETWORK`
4953
- `MAKEPAD_PROXY_ALERTECONSO_APP_NETWORK`
5054
- `MAKEPAD_PROXY_LE_PETIT_COIN_APP_NETWORK`
55+
- `MAKEPAD_PROXY_VIF_APP_NETWORK`
56+
- `MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK`
5157

5258
The workflow deploys only the proxy stack. If the shared application network does not exist yet, it is created on the manager before deployment.
5359

@@ -59,3 +65,8 @@ For `aupetitcoin.makepad.fr`, the production proxy expects:
5965

6066
- `/etc/letsencrypt/live/aupetitcoin.makepad.fr/fullchain.pem`
6167
- `/etc/letsencrypt/live/aupetitcoin.makepad.fr/privkey.pem`
68+
69+
For `makepad.fr` and `www.makepad.fr`, the production proxy expects a certificate that covers both names:
70+
71+
- `/etc/letsencrypt/live/makepad.fr/fullchain.pem`
72+
- `/etc/letsencrypt/live/makepad.fr/privkey.pem`

‎compose.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ configs:
1111
file: ./sites/le-petit-coin-prod.conf.template
1212
vif_prod_conf:
1313
file: ./sites/vif-prod.conf.template
14+
makepad_landing_prod_conf:
15+
file: ./sites/makepad-landing-prod.conf.template
1416

1517
services:
1618
nginx:
@@ -23,6 +25,9 @@ services:
2325
LE_PETIT_COIN_PROD_UPSTREAM: ${LE_PETIT_COIN_PROD_UPSTREAM:-http://le-petit-coin-backend:8080}
2426
VIF_PROD_SERVER_NAME: ${VIF_PROD_SERVER_NAME:-vif.localhost}
2527
VIF_PROD_UPSTREAM: ${VIF_PROD_UPSTREAM:-http://vif-apisix:9080}
28+
MAKEPAD_LANDING_PROD_SERVER_NAME: ${MAKEPAD_LANDING_PROD_SERVER_NAME:-makepad.localhost}
29+
MAKEPAD_LANDING_WWW_SERVER_NAME: ${MAKEPAD_LANDING_WWW_SERVER_NAME:-www.makepad.localhost}
30+
MAKEPAD_LANDING_PROD_UPSTREAM: ${MAKEPAD_LANDING_PROD_UPSTREAM:-http://makepad-landing-prod-app:8080}
2631
CATWLK_TLS_CERT_FILE: ${CATWLK_TLS_CERT_FILE:-/etc/letsencrypt/live/localhost/fullchain.pem}
2732
CATWLK_TLS_KEY_FILE: ${CATWLK_TLS_KEY_FILE:-/etc/letsencrypt/live/localhost/privkey.pem}
2833
ALERTECONSO_TLS_CERT_FILE: ${ALERTECONSO_TLS_CERT_FILE:-/etc/letsencrypt/live/localhost/fullchain.pem}
@@ -31,6 +36,8 @@ services:
3136
LE_PETIT_COIN_TLS_KEY_FILE: ${LE_PETIT_COIN_TLS_KEY_FILE:-/etc/letsencrypt/live/localhost/privkey.pem}
3237
VIF_TLS_CERT_FILE: ${VIF_TLS_CERT_FILE:-/etc/letsencrypt/live/localhost/fullchain.pem}
3338
VIF_TLS_KEY_FILE: ${VIF_TLS_KEY_FILE:-/etc/letsencrypt/live/localhost/privkey.pem}
39+
MAKEPAD_LANDING_TLS_CERT_FILE: ${MAKEPAD_LANDING_TLS_CERT_FILE:-/etc/letsencrypt/live/localhost/fullchain.pem}
40+
MAKEPAD_LANDING_TLS_KEY_FILE: ${MAKEPAD_LANDING_TLS_KEY_FILE:-/etc/letsencrypt/live/localhost/privkey.pem}
3441
CATWLK_ACME_WEBROOT: ${CATWLK_ACME_WEBROOT:-/var/lib/letsencrypt}
3542
configs:
3643
- source: common_conf
@@ -45,16 +52,20 @@ services:
4552
target: /etc/nginx/templates/le-petit-coin-prod.conf.template
4653
- source: vif_prod_conf
4754
target: /etc/nginx/templates/vif-prod.conf.template
55+
- source: makepad_landing_prod_conf
56+
target: /etc/nginx/templates/makepad-landing-prod.conf.template
4857
networks:
4958
- prod_app
5059
- canary_app
5160
- alerteconso_prod_app
5261
- le_petit_coin_prod_app
5362
- vif_prod_app
63+
- makepad_landing_prod_app
5464

5565
networks:
5666
prod_app:
5767
canary_app:
5868
alerteconso_prod_app:
5969
le_petit_coin_prod_app:
6070
vif_prod_app:
71+
makepad_landing_prod_app:

‎envs/production/.env.proxy‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ LE_PETIT_COIN_PROD_SERVER_NAME=aupetitcoin.makepad.fr
99
LE_PETIT_COIN_PROD_UPSTREAM=http://le-petit-coin-backend:8080
1010
VIF_PROD_SERVER_NAME=vif.io
1111
VIF_PROD_UPSTREAM=http://vif-apisix:9080
12+
MAKEPAD_LANDING_PROD_SERVER_NAME=makepad.fr
13+
MAKEPAD_LANDING_WWW_SERVER_NAME=www.makepad.fr
14+
MAKEPAD_LANDING_PROD_UPSTREAM=http://makepad-landing-prod-app:8080
1215
CATWLK_PROXY_LETSENCRYPT_HOST_PATH=/etc/letsencrypt
1316
CATWLK_PROXY_ACME_WEBROOT_HOST_PATH=/var/lib/letsencrypt
1417
CATWLK_ACME_WEBROOT=/var/lib/letsencrypt
@@ -20,3 +23,5 @@ LE_PETIT_COIN_TLS_CERT_FILE=/etc/letsencrypt/live/aupetitcoin.makepad.fr/fullcha
2023
LE_PETIT_COIN_TLS_KEY_FILE=/etc/letsencrypt/live/aupetitcoin.makepad.fr/privkey.pem
2124
VIF_TLS_CERT_FILE=/etc/letsencrypt/live/vif.io/fullchain.pem
2225
VIF_TLS_KEY_FILE=/etc/letsencrypt/live/vif.io/privkey.pem
26+
MAKEPAD_LANDING_TLS_CERT_FILE=/etc/letsencrypt/live/makepad.fr/fullchain.pem
27+
MAKEPAD_LANDING_TLS_KEY_FILE=/etc/letsencrypt/live/makepad.fr/privkey.pem

‎envs/production/compose.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,6 @@ networks:
4646
vif_prod_app:
4747
external: true
4848
name: ${MAKEPAD_PROXY_VIF_APP_NETWORK}
49+
makepad_landing_prod_app:
50+
external: true
51+
name: ${MAKEPAD_PROXY_MAKEPAD_LANDING_APP_NETWORK}

‎sites/makepad-landing-prod.conf.template‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
server {
2+
listen 80;
3+
listen [::]:80;
4+
server_name ${MAKEPAD_LANDING_PROD_SERVER_NAME};
5+
6+
location /.well-known/acme-challenge/ {
7+
root ${CATWLK_ACME_WEBROOT};
8+
default_type text/plain;
9+
}
10+
11+
location / {
12+
return 301 https://$host$request_uri;
13+
}
14+
}
15+
16+
server {
17+
listen 80;
18+
listen [::]:80;
19+
server_name ${MAKEPAD_LANDING_WWW_SERVER_NAME};
20+
21+
location /.well-known/acme-challenge/ {
22+
root ${CATWLK_ACME_WEBROOT};
23+
default_type text/plain;
24+
}
25+
26+
location / {
27+
return 301 https://${MAKEPAD_LANDING_PROD_SERVER_NAME}$request_uri;
28+
}
29+
}
30+
31+
server {
32+
listen 443 ssl;
33+
listen [::]:443 ssl;
34+
http2 on;
35+
server_name ${MAKEPAD_LANDING_WWW_SERVER_NAME};
36+
37+
ssl_certificate ${MAKEPAD_LANDING_TLS_CERT_FILE};
38+
ssl_certificate_key ${MAKEPAD_LANDING_TLS_KEY_FILE};
39+
ssl_session_timeout 1d;
40+
ssl_session_cache shared:SSL:10m;
41+
ssl_session_tickets off;
42+
ssl_protocols TLSv1.2 TLSv1.3;
43+
ssl_prefer_server_ciphers off;
44+
45+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
46+
47+
location / {
48+
return 301 https://${MAKEPAD_LANDING_PROD_SERVER_NAME}$request_uri;
49+
}
50+
}
51+
52+
server {
53+
listen 443 ssl;
54+
listen [::]:443 ssl;
55+
http2 on;
56+
server_name ${MAKEPAD_LANDING_PROD_SERVER_NAME};
57+
resolver 127.0.0.11 valid=10s ipv6=off;
58+
59+
ssl_certificate ${MAKEPAD_LANDING_TLS_CERT_FILE};
60+
ssl_certificate_key ${MAKEPAD_LANDING_TLS_KEY_FILE};
61+
ssl_session_timeout 1d;
62+
ssl_session_cache shared:SSL:10m;
63+
ssl_session_tickets off;
64+
ssl_protocols TLSv1.2 TLSv1.3;
65+
ssl_prefer_server_ciphers off;
66+
67+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
68+
69+
location / {
70+
set $makepad_landing_prod_upstream ${MAKEPAD_LANDING_PROD_UPSTREAM};
71+
proxy_pass $makepad_landing_prod_upstream;
72+
proxy_http_version 1.1;
73+
proxy_set_header Connection $connection_upgrade;
74+
proxy_set_header Host $host;
75+
proxy_set_header Upgrade $http_upgrade;
76+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
77+
proxy_set_header X-Forwarded-Host $host;
78+
proxy_set_header X-Forwarded-Proto https;
79+
proxy_set_header X-Real-IP $remote_addr;
80+
}
81+
}

0 commit comments

Comments
 (0)