How to deal with ingress version ?

[alexandrecuer]

Ingress can work out of home assistant

HTTP headers

cf https://en.wikipedia.org/wiki/List_of_HTTP_header_fields

Field Name	Description
X-Forwarded-Host	the domain name of the forwarded server
X-Forwarded-For	method to identify the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer.
X-Real-IP	originating IP address
X-Forwarded-Scheme	originating protocol
X-Forwarded-Proto	originating protocol
X-Ingress-Path	location, for exemple /obm/emoncms/ in the following example

ingress use case

Suppose you have a sort of supervisor to manage configuration files and to view the containers logs

• the supervisor runs on port 3000
• emoncms runs on port 8099

You want emoncms to be accessible in the supervisor user interface.

The solution is to use a reverse proxy listening on port 443, exposed to the outside as port 3443.

The web application operating in ingress mode will rewrite the emoncms urls, for example, https://localhost:8099/vis/list will become https://localhost:3443/obm/emoncms/vis/list. The proxy will decode the rewriten urls and route them internally to the web application and vice versa.

nginx reverse proxy

Here is a nginx.conf file :

events {
  worker_connections 1024;
}
http {
  server {
    listen 443 ssl;
    ssl_certificate /data/certificates/cert.pem;
    ssl_certificate_key /data/certificates/privkey.pem;
    #add_header Strict-Transport-Security "max-age=16070400; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy "same-origin";
    add_header Permissions-Policy "accelerometer=(), geolocation=(), fullscreen=(), microphone=(), camera=(), display-capture=()";
    location / {
       proxy_pass  http://themis:3000;
    }
    location /obm/emoncms/ {
       client_max_body_size 0;
       proxy_set_header X-Ingress-Path /obm/emoncms; 
       proxy_set_header Host $host;
       proxy_set_header X-Forwarded-Host $host:3443;
       proxy_set_header X-Forwarded-Scheme $scheme;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_pass http://themis:8099/;
    }
  }
}

Please note that trailing slashes are fundamental : cf https://stackoverflow.com/questions/58452321/nginx-reverse-proxy-everything-after-location-specification

It will not work if you use /obm/emoncms instead of /obm/emoncms/ and http://themis:8099 instead of http://themis:8099/

the nginx container acting as the reverse proxy runs the following parameters :

nginx:
    image: nginx:latest
    volumes:
      - /data/certificates:/data/certificates
      - ./conf/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - admin
    ports:
      - 3443:443
    restart: always

apache reverse proxy

something similar can be achieved with apache.

For an alpine server running apache2, to install the proxy tools : apk add apache2-proxy

SSLProxyEngine One
ProxyPass /obm/emoncms http://themis:8099
ProxyPassReverse /obm/emoncms http://themis:8099

In the virtualhost on port 8099

SetEnv HTTP_X_INGRESS_PATH /obm/emoncms

notes

https://www.nginx.com/resources/wiki/start/topics/examples/likeapache/