What

Added an NGINX server as a reverse proxy in front of the frontend and backend containers for improved load balancing and resource management.
Configured a restart policy for containers to automatically restart in case of failure or machine reboot, enhancing application reliability and uptime.
Enhanced container security by setting no-new-privileges=true, preventing any privilege escalation in the container.
Implemented JSON-RPC method filtering using nginx+lua to restrict access to sensitive Validator configuration methods when running in production:
- Added lua scripting support to the NGINX reverse proxy
- Created a lua script to inspect the JSON-RPC request body and filter requests based on the method name
- Configured NGINX to execute the lua filter script for POST requests to the backend JSON-RPC endpoint
- Blocked access to Validator config methods like sim_deleteAllValidators and sim_clearDbTables in production
  Why
To introduce NGINX for handling requests to the frontend and backend containers, which helps improve scalability and manage network traffic. It will listen on ports 80 (always redirects to port 443), 443 (frontend with TLS encryption enabled) and 8443 (backend)
To ensure that containers automatically restart if they fail or if the host machine is restarted, reducing downtime without manual intervention.
To increase security within the container environment by preventing privilege escalation, aligning with security best practices.
To enhance security of the Validator by preventing unauthorized modification of sensitive configuration via the JSON-RPC API when running in production environments. JSON-RPC method filtering allows blocking access to Validator config altering methods.
Testing Done
Verified that the NGINX server correctly routes traffic to the frontend and backend.
Tested the restart policy by simulating container and machine failures to confirm containers restart as expected.
Confirmed the no-new-privileges security flag is set and functioning as intended to prevent privilege escalation.
Tested the JSON-RPC method filter:
- Sent JSON-RPC requests for allowed methods and verified they were proxied to the backend
- Sent JSON-RPC requests for blocked configuration methods and confirmed the requests were rejected by NGINX with a 400 Forbidden status
  Decisions Made
Chose to use NGINX as the reverse proxy server for its compatibility and flexibility in handling web traffic.
Decided on a no-new-privileges security setting to align with security standards in containerized applications.
Used nginx+lua for JSON-RPC method filtering to leverage NGINX's built-in scripting capabilities and avoid adding another component. Lua provides good performance for inspecting request bodies.
Checks
[x] I have tested this code
[x] I have reviewed my own PR
[x] I have created an issue for this PR
[x] I have set a descriptive PR title compliant with conventional commits
Reviewing Tips
Reviewers should check the NGINX configuration to ensure correct routing between frontend and backend. Verify JSON-RPC requests are proxied to the backend service.
Ensure the restart policy works correctly across different environments and conditions.
Verify that no-new-privileges=true is applied correctly in container configuration.
Check the nginx lua script to confirm it properly filters JSON-RPC requests based on the method. Test with allowed and blocked methods.
User-Facing Release Notes
Added NGINX server for improved handling of requests to frontend and backend services.
Containers now automatically restart upon failure or machine reboot, minimizing downtime.
Improved container security by enforcing no privilege escalation with no-new-privileges=true.
Sensitive JSON-RPC methods for modifying Validator configuration are now blocked in production environments for enhanced security.

codecov[bot] commented 2 weeks ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 18.61%. Comparing base (af6baf7) to head (29387a5).

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #586 +/- ## ======================================= Coverage 18.61% 18.61% ======================================= Files 123 123 Lines 9618 9618 Branches 299 299 ======================================= Hits 1790 1790 Misses 7744 7744 Partials 84 84 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

🚨 Try these New Features: