Nginx batch issues

[bwbroersma]

~Issues with current docker batch configuration (and overhaul of the access control):~ Update: Keep the current (pre-docker) situation:

• _BASIC_AUTH / ALLOW_LIST should do nothing in batch mode_
• _Have BATCH_AUTH on / if ENABLE_BATCH (because mixing basic auth's will not work, and the dashboard is linking to the /api/ results)._
• ~Some parts should be always accessible, even if BASIC_AUTH is set:~
  • ~OpenAPI spec: /api/batch/openapi.yaml.~
  • ~Test results: /(site|mail)/[domain]/[id]/.~
  • ~Pages /test-(site|mail), /faqs (and all below), /disclosure, /privacy, /copyright, /accessibility and /about (note some pages need BRANDING).~
• /api - Currently (on dev-docker.batch) this does not have BATCH_AUTH like the old batch config (note /api in both cases is '404'-ish).
• /api/batch/ - Currently is a 401 (from Django?), should be an alias for /api/batch/v2/ (and have auth).
• /api/batch/openapi.yaml
  • is served as Content-Type: application/octet-stream, should be served as the newly defined application/yaml (see assigned mime-types / the draft RFC), this should be added to the nginx conf/mime.types types), BTW the non-docker https://batch.internet.nl/static/openapi.yaml had no content-type (in combination with nosniff);
  • should stay without auth.
• ~The current behavior of BASIC_AUTH and ALLOW_LIST are correct in shielding all resources.~

Nice to have:

• Add more info in the basic realm (e.g. add [Access|API|Monitoring]), currently the same prompts are used: https://github.com/internetstandards/Internet.nl/blob/118b8b87fa9d1b6f0898bf16de9027012d403347/docker/webserver/authentication.sh#L4 https://github.com/internetstandards/Internet.nl/blob/118b8b87fa9d1b6f0898bf16de9027012d403347/docker/webserver/nginx_templates/app.conf.template#L250-L251 https://github.com/internetstandards/Internet.nl/blob/118b8b87fa9d1b6f0898bf16de9027012d403347/docker/webserver/nginx_templates/app.conf.template#L264-L265 https://github.com/internetstandards/Internet.nl/blob/118b8b87fa9d1b6f0898bf16de9027012d403347/docker/webserver/nginx_templates/app.conf.template#L269-L270

  Update: modern browsers don't show this (see this question on SO and MDN: "Some clients show this value to the user to inform them about which particular credentials are required — though most browsers stopped doing so to counter phishing."), but it's still useful for debugging when using curl.

[mxsasha]

On https://batch.internet.nl/api/batch/ I get the same response as https://dev-docker.batch.internet.nl/api/batch/ ?

[mxsasha]

The latest changes make it incomprehensible to me. My understanding of our discussion is, as the full description of desired behaviour in the context of nginx for docker batch as intended by this issue:

• The content-type for openapi.yaml must be application/yaml
• Security.txt and openapi.yaml are always accessible.
• We will have a single list of users and passwords in a htpasswd file, editable through the commands we recently added.
• There are three modes:
  • single test open (enable_batch=False, so no batch URLs available) has no auth at all
  • batch mode (enable_batch=True) has auth on all URLs except result reports
  • single test closed (auth_all_urls=True, enable_batch=False) has auth on all URLs.
• The settings BASIC_AUTH and BASIC_AUTH_RAW are removed.
• Monitoring is out of scope