Repository navigation
feat(gateway): serve the monitoring UIs from sub-paths of the single gateway port (#93) - #169
Merged
Merged
Conversation
… X-Forwarded-Proto
# Conflicts: # frontend/CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #93.
OP_GATEWAY_SUBPATHS (default false) makes the Cropwright nginx the one published port: /grafana/, /prometheus/, /dashboards/ and /mlflow/ are proxied (Grafana Live websocket included) while the UIs stay on loopback; /docs, /redoc, /openapi.json and /docs-assets/ stay at the root. The API serves path-relative resource_links in gateway mode (explicit OP_*_URL still wins; host:port derivation unchanged when off), and the MLflow run link follows.
Design notes: no new compose profile, the cropwright service is the gateway. A shared entrypoint wrapper (x-gateway-wrap) sets each UI's sub-path settings only when the switch is on and is a plain exec otherwise. Deviation from the issue: MLflow is NOT started with --static-prefix, because that moves /health and /api and breaks the in-network tracking URI, healthcheck and reachability probe; nginx strips /mlflow/ and sends Host: $proxy_host so MLflow 3's allowed-hosts guard passes. Fail closed: with the switch on, the UIs refuse to start when published beyond loopback, and Grafana refuses the default or empty admin password. Also: absolute_redirect off, and 404 for the four sub-paths when the switch is off (found live: they served the SPA shell).
Verified live in an isolated stack (127.0.0.1 only, no GPU): every link renders through the gateway port, Grafana websocket 101, MLflow 200 not 403, Prometheus query UI, Dashboards home; gateway OFF (the default) starts all four UIs through the wrapper and serves them on their own ports; both refusal paths exit 1; teardown proven. Frontend: check 0 errors, lint, 4391 vitest, build, 238 e2e. Backend: full suite 7094 passed, contracts in sync, pre-commit all hooks.
Not done: an installer/CLI flag (set OP_GATEWAY_SUBPATHS=true in .env); Grafana's session cookie has no Secure flag behind TLS (GF_SECURITY_COOKIE_SECURE=true would address it); the X-Forwarded-Proto reaching each upstream was checked in nginx config tests only.