not
4edcf00267
nginx resolves a variable `proxy_pass` upstream itself, using only the `resolver` directive and never the search domains in /etc/resolv.conf. That cost two workarounds in one script: rewriting the resolver address for rootless podman (Docker's 127.0.0.11 is wrong there), and injecting a full FQDN so the bare `bff` name could resolve on Kubernetes at all. Caddy dials its upstream per request through the system resolver, which reads nameserver *and* search domains, so `reverse_proxy bff:8080` resolves on every engine with no per-engine configuration — and it still starts before the BFF exists and picks up its restarts. Both workarounds are deleted with the script. Routing uses mutually-exclusive `handle` blocks, not a bare `try_files`: Caddy sorts rewrites *before* reverse_proxy, so a top-level SPA fallback would rewrite every API path to /index.html before the proxy saw it.
21 lines
938 B
YAML
21 lines
938 B
YAML
# Overlay: make the CI compose stack usable from a HOST browser.
|
|
# Same two mechanisms infra/docker-compose.local.yml already uses — pin Keycloak's issuer to the
|
|
# host-published address, and point each portal's runtime config.json at it. The BFF needs no
|
|
# change: it discovers metadata over keycloak:8080 and the discovered issuer is the pinned
|
|
# localhost:8180, which is what browser tokens carry.
|
|
services:
|
|
keycloak:
|
|
environment:
|
|
KC_HOSTNAME: http://localhost:8180
|
|
KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
|
|
self-service:
|
|
volumes:
|
|
- ./local-config/self-service.config.json:/usr/share/caddy/config.json:ro,z
|
|
behandel:
|
|
volumes:
|
|
- ./local-config/behandel.config.json:/usr/share/caddy/config.json:ro,z
|
|
# beheer is the same medewerker realm as behandel, so it reuses behandel's config verbatim.
|
|
beheer:
|
|
volumes:
|
|
- ./local-config/behandel.config.json:/usr/share/caddy/config.json:ro,z
|