Add Nginx Proxy & Use 'cvmanager' Schema#13
Add Nginx Proxy & Use 'cvmanager' Schema#13dmccoystephenson wants to merge 49 commits intowydot-deployment-2026from
Conversation
… in docker-compose files
…eaders, and buffering settings
…e and adjust dependencies
…me and adjust Keycloak proxy settings
…sh and set PG_SSL_REQUIRED to False
…_REQUIRED environment variable
…Y environment variable
…e and adjust Keycloak healthcheck URL
…and add local testing documentation for NGINX SSL proxy
… settings for Keycloak and webapp routes
…ict HTTPS and set default log level
…k service in docker-compose-addons
There was a problem hiding this comment.
Pull request overview
This pull request introduces significant infrastructure and database changes to the CV Manager project to support the WYDOT deployment environment. The changes include adding an NGINX SSL proxy for centralized traffic management and migrating the database from a single-schema to a multi-schema architecture.
Key Changes
- Addition of an NGINX reverse proxy service with SSL/TLS termination, rate limiting, and unified routing for webapp, API, and Keycloak services
- Migration of all database tables and sequences from the
publicschema to a dedicatedcvmanagerschema, with Keycloak isolated in its ownkeycloakschema - Introduction of SSL support for PostgreSQL connections with configurable SSL verification
Reviewed changes
Copilot reviewed 70 out of 71 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| docker-compose.yml | Added nginx_proxy service, updated Keycloak configuration for proxy support, removed direct port mappings for webapp and API |
| resources/nginx/* | New NGINX configuration files, Dockerfile, SSL certificate generation scripts, and documentation |
| services/common/pgquery.py | Added SSL context handling for PostgreSQL connections |
| services/api/src/middleware.py | Added configurable Keycloak SSL verification |
| resources/sql_scripts/* | Updated all CREATE/ALTER statements to use cvmanager schema |
| services/*/**.py | Updated all SQL queries to reference cvmanager schema instead of public |
| sample.env | Updated endpoints to use HTTPS and consolidated routing through NGINX proxy |
| resources/keycloak/realm.json | Updated SSL requirement to 'all' and redirect URIs to HTTPS |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # We mount the config in docker-compose, but we can also copy it here as a default. | ||
|
|
||
| # Ensure we have openssl for dhparam generation if needed by the script | ||
| RUN apk add --no-network --no-cache openssl || apk add --no-cache openssl |
There was a problem hiding this comment.
Using --no-network with apk add and then falling back to a regular apk add will likely fail in most cases. The --no-network flag is not a standard apk option. This should be simplified to just RUN apk add --no-cache openssl to ensure openssl is installed from the Alpine package repository.
| RUN apk add --no-network --no-cache openssl || apk add --no-cache openssl | |
| RUN apk add --no-cache openssl |
| keycloak_verify = os.getenv("KEYCLOAK_VERIFY", "True") | ||
| if keycloak_verify.lower() == "true": | ||
| keycloak_verify = True | ||
| elif keycloak_verify.lower() == "false": | ||
| keycloak_verify = False | ||
|
|
||
| keycloak_openid = KeycloakOpenID( | ||
| server_url=os.getenv("KEYCLOAK_ENDPOINT"), | ||
| realm_name=os.getenv("KEYCLOAK_REALM"), | ||
| client_id=os.getenv("KEYCLOAK_API_CLIENT_ID"), | ||
| client_secret_key=os.getenv("KEYCLOAK_API_CLIENT_SECRET_KEY"), | ||
| verify=keycloak_verify, |
There was a problem hiding this comment.
The KEYCLOAK_VERIFY environment variable is set to a file path (/etc/ssl/certs/server.crt), but when used with the KeycloakOpenID library, the verify parameter expects either a boolean or a path to a CA bundle. Since this is a self-signed certificate path, it should point to the CA certificate that signed it, not the server certificate itself. For self-signed certificates in development, this should typically be set to False for development or to a proper CA bundle path.
| CREATE TABLE IF NOT EXISTS cvmanager.manufacturers | ||
| ( | ||
| manufacturer_id integer NOT NULL DEFAULT nextval('manufacturers_manufacturer_id_seq'::regclass), | ||
| manufacturer_id integer NOT NULL DEFAULT nextval('cvmanager.manufacturers_manufacturer_id_seq'::regclass), |
There was a problem hiding this comment.
The sequence names in the DEFAULT clause still reference the old unqualified names (e.g., nextval('manufacturers_manufacturer_id_seq'::regclass)), but they should be schema-qualified to match the new schema structure (e.g., nextval('cvmanager.manufacturers_manufacturer_id_seq'::regclass)). This could cause issues if the search_path is not properly configured.
| KC_HOSTNAME: ${KEYCLOAK_DOMAIN} | ||
| KC_HOSTNAME_PORT: 443 | ||
| KC_HOSTNAME_STRICT_HTTPS: 'true' | ||
| KC_HOSTNAME_STRICT: 'false' |
There was a problem hiding this comment.
The KC_HOSTNAME_STRICT is set to 'false' which disables hostname verification. This is a security risk in production environments as it allows requests with any hostname to be accepted. This should be set to 'true' for production deployments and only set to 'false' in development environments if necessary.
| KC_HOSTNAME_STRICT: 'false' | |
| KC_HOSTNAME_STRICT: 'true' |
… PostgreSQL setup
…eate_engine` call
…d notification proxies
…ove related documentation
…new path structure
… simplified path structure
New Base Branch
The
wydot-deployment-2026branch was created using the 2.0.1 release tag as a base. The following changes were made using the previous changes in thewydot-deploymentbranch as a reference.Changes
This pull request enhances the CV Manager's infrastructure by introducing a centralized NGINX proxy and migrating the database to a multi-schema architecture. These changes were made in order to tailor the CV Manager project for the WYDOT deployment environment.
NGINX SSL Proxy Integration
A new cvmanager_nginx_proxy service has been added to handle all incoming traffic, providing:
Multi-Schema Database Migration
To improve data isolation and management, the PostgreSQL database has been refactored:
Security & Maintenance Updates