use caddy as private proxy for node

DaMandal0rian commented 2 days ago

PR Type

enhancement

Description

Updated docker-compose.yml to modify port mappings for the Caddy service, removing unnecessary external ports and simplifying the configuration.
Changed the ports directive to expose for subquery nodes to streamline internal network communication.
Simplified the Caddyfile by consolidating multiple endpoint configurations into a single configuration, reducing complexity and potential errors.
Removed the basic authentication and multiple endpoint configurations from the Caddyfile, focusing on a single port (8000) for proxying.

Changes walkthrough 📝

Relevant files

Configuration changes

docker-compose.yml `Update service configurations and port mappings` docker-compose.yml Updated port mappings for Caddy service. Removed environment variable for DOMAIN. Changed `ports` to `expose` for subquery nodes. Added dependencies for hasura and postgres.	+9/-15
Caddyfile `Simplify and consolidate Caddyfile configuration` indexers/Caddyfile Simplified Caddyfile configuration. Removed multiple endpoint configurations. Consolidated to a single port 8000.	+1/-307

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

netlify[bot] commented 2 days ago

Deploy Preview for dev-astral canceled.

Name	Link
Latest commit	226c2053b4d6f73f8e16e5f61422471787cd54d8
Latest deploy log	https://app.netlify.com/sites/dev-astral/deploys/673361fe0c6e280008c9c1f1

github-actions[bot] commented 2 days ago

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review

Dependency Management
The addition of new dependencies ('hasura', 'postgres') under the 'caddy' service should be validated to ensure they are necessary and properly configured. Port Exposure
The change from 'ports' to 'expose' in various services reduces external access but should be reviewed to ensure it aligns with the intended network security policies. Configuration Simplification
The simplification of the Caddyfile by removing multiple endpoint configurations and basic authentication needs a thorough review to ensure that no necessary configurations are omitted, especially in terms of security and functionality.

github-actions[bot] commented 2 days ago

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Best practice	Implement health checks for all dependent services to enhance system reliability ___ Add health check configurations for the 'hasura' and 'postgres' services to ensure they are ready before dependent services start. [docker-compose.yml [24-28]](https://github.com/autonomys/astral/pull/938/files#diff-e45e45baeda1c1e73482975a664062aa56f20c03dd9d64a827aba57775bed0d3R24-R28) ```diff depends_on: - - node - - hasura - - postgres + "node": + condition: service_healthy + "hasura": + condition: service_healthy + "postgres": + condition: service_healthy ``` Suggestion importance[1-10]: 8 Why: Adding health checks for dependent services like 'hasura' and 'postgres' can significantly increase the reliability of the system by ensuring services are ready before they are used.	8
Best practice	Use a specific version of the Caddy image to ensure consistent deployments ___ Consider specifying a version for the Caddy image instead of using 'latest' to ensure consistent behavior across deployments. [docker-compose.yml [17]](https://github.com/autonomys/astral/pull/938/files#diff-e45e45baeda1c1e73482975a664062aa56f20c03dd9d64a827aba57775bed0d3R17-R17) ```diff -image: caddy:latest +image: caddy:2.4.6 ``` Suggestion importance[1-10]: 7 Why: Using a specific version instead of 'latest' can prevent unexpected changes due to updates, enhancing stability and predictability.	7
Security	Verify and secure the new port mapping to prevent unauthorized access ___ Ensure that the new port mapping '8000:9944' does not conflict with existing services and is properly secured, especially if exposed to the internet. [docker-compose.yml [19]](https://github.com/autonomys/astral/pull/938/files#diff-e45e45baeda1c1e73482975a664062aa56f20c03dd9d64a827aba57775bed0d3R19-R19) ```diff -- "8000:9944" # Map external 8000 +- "8000:9944" # Map external 8000, ensure firewall rules and security settings are configured ``` Suggestion importance[1-10]: 6 Why: Ensuring security for new port mappings is crucial, especially if exposed to the internet, to prevent unauthorized access.	6
Possible issue	Clarify or modify the network exposure settings for subquery nodes based on the intended access requirements ___ Replace the 'expose' directive with 'ports' for the subquery nodes if external access is required, or ensure it's intended only for internal communication. [docker-compose.yml [198-199]](https://github.com/autonomys/astral/pull/938/files#diff-e45e45baeda1c1e73482975a664062aa56f20c03dd9d64a827aba57775bed0d3R198-R199) ```diff -expose: - - "3001" +ports: + - "3001:3001" ``` Suggestion importance[1-10]: 5 Why: It's important to ensure that the exposure settings ('expose' vs 'ports') align with the intended access requirements, whether internal or external.	5

autonomys / astral