not
4edcf00267
nginx resolves a variable `proxy_pass` upstream itself, using only the `resolver` directive and never the search domains in /etc/resolv.conf. That cost two workarounds in one script: rewriting the resolver address for rootless podman (Docker's 127.0.0.11 is wrong there), and injecting a full FQDN so the bare `bff` name could resolve on Kubernetes at all. Caddy dials its upstream per request through the system resolver, which reads nameserver *and* search domains, so `reverse_proxy bff:8080` resolves on every engine with no per-engine configuration — and it still starts before the BFF exists and picks up its restarts. Both workarounds are deleted with the script. Routing uses mutually-exclusive `handle` blocks, not a bare `try_files`: Caddy sorts rewrites *before* reverse_proxy, so a top-level SPA fallback would rewrite every API path to /index.html before the proxy saw it.
40 lines
1.7 KiB
TypeScript
40 lines
1.7 KiB
TypeScript
import { provideHttpClient, withInterceptors } from '@angular/common/http';
|
|
import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core';
|
|
import { provideRouter } from '@angular/router';
|
|
import { authInterceptor, provideMedewerkerAuth } from 'auth';
|
|
import { appRoutes } from './app.routes';
|
|
|
|
/** Environment-specific settings fetched from /config.json at startup (see main.ts). */
|
|
export interface RuntimeConfig {
|
|
/** The Keycloak `medewerker` realm issuer as the browser reaches it (dev: localhost; compose: keycloak:8080). */
|
|
authority: string;
|
|
}
|
|
|
|
/**
|
|
* Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs
|
|
* the api-client actually calls (same-origin via the Caddy proxy) — the interceptor matches on
|
|
* `req.url`, which stays relative, so an absolute origin would never match and the token would go
|
|
* unattached. Only `/behandel/` is secured; the app calls no other endpoint group.
|
|
*/
|
|
export const SECURE_API_ROUTES = ['/behandel/'];
|
|
|
|
/**
|
|
* Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak
|
|
* redirects back). `secureRoutes` uses {@link SECURE_API_ROUTES} — relative prefixes, not the origin.
|
|
*/
|
|
export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
|
|
const origin = typeof window !== 'undefined' ? window.location.origin : '/';
|
|
return {
|
|
providers: [
|
|
provideBrowserGlobalErrorListeners(),
|
|
provideRouter(appRoutes),
|
|
provideHttpClient(withInterceptors([authInterceptor()])),
|
|
provideMedewerkerAuth({
|
|
authority: runtime.authority,
|
|
redirectUrl: origin,
|
|
secureRoutes: SECURE_API_ROUTES,
|
|
}),
|
|
],
|
|
};
|
|
}
|