feat: use mtls between frontend and backend

.gitignore

@@ -1,2 +1,6 @@
 .vscode
 damnit_proposals.json
+certs/
+*.crt
+*.key
+*.pem

api/Dockerfile

@@ -31,4 +31,4 @@ COPY ./README.md ./README.md
 
 EXPOSE 8000
 
-CMD ["poetry", "run", "uvicorn", "damnit_api.main:app", "--host", "0.0.0.0", "--port", "8000"]
+CMD ["poetry", "run", "python3", "-m", "damnit_api.main"]

api/compose.dev.yml

@@ -2,10 +2,11 @@ name: damnit-web-dev
 
 services:
   api:
-    userns_mode: keep-id
+    userns_mode: host
     ports:
       - 8123:8000
     volumes:
+      - ./certs:/certs
       - /gpfs/exfel/data/scratch/xdana/tmp/damnit-web:/var/tmp
       - /gpfs:/gpfs
       - /pnfs:/pnfs

api/compose.yml

@@ -6,6 +6,11 @@ services:
     env_file:
       - .env
     ports:
-      - 8000
+      - 8000:8000
+    environment:
+      DW_API_MTLS__CLIENT_CERT: /certs/server.crt
+      DW_API_MTLS__CLIENT_KEY: /certs/server.key
+      DW_API_MTLS__ROOT_CERT: /certs/root_ca.crt
     volumes:
       - ./tmp-damnit-web/:/tmp/damnit-web/
+      - ./certs:/certs

api/src/damnit_api/main.py

@@ -76,6 +76,11 @@ async def http_exception_handler(request: Request, exc: HTTPException):
 
     logger.info("Starting uvicorn with settings", **settings.uvicorn.model_dump())
 
+    if settings.uvicorn.ssl_cert_reqs != 2:
+        logger.warning(
+            "Not configured to require mTLS. This is not recommended for production."
+        )
+
     uvicorn.run(
         "damnit_api.main:create_app",
         **settings.uvicorn.model_dump(),

api/src/damnit_api/settings.py

@@ -8,6 +8,7 @@
     SecretStr,
     UrlConstraints,
     field_validator,
+    model_validator,
 )
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -24,6 +25,25 @@ class UvicornSettings(BaseModel):
     reload: bool = True
     factory: bool = True
 
+    ssl_keyfile: Path | None = None
+    ssl_certfile: Path | None = None
+    ssl_ca_certs: Path | None = None
+    ssl_cert_reqs: int | None = None
+
+    @model_validator(mode="after")
+    def ssl_all_if_one(self):
+        """Ensure all SSL settings are set if one is set."""
+        files = [self.ssl_keyfile, self.ssl_certfile, self.ssl_ca_certs]
+        if any(files) and not all(files):
+            msg = "ssl_keyfile, ssl_certfile, and ssl_ca_certs must all be set"
+            raise ValueError(msg)
+
+        if all(files):
+            # Default to 2 (require mTLS) if any SSL settings are set
+            self.ssl_cert_reqs = self.ssl_cert_reqs or 2
+
+        return self
+
     @field_validator("factory", mode="after")
     @classmethod
     def factory_must_be_true(cls, v, values):

frontend/compose.dev.yml

@@ -6,6 +6,10 @@ networks:
 
 services:
   frontend:
+    environment:
+      - NODE_EXTRA_CA_CERTS=/certs/root_ca.crt
+    volumes:
+      - ./certs:/certs
     networks:
       - proxy
     labels:

frontend/vite.config.ts

@@ -1,11 +1,45 @@
 import { defineConfig, loadEnv } from "vite"
 import path from "path"
 import react from "@vitejs/plugin-react"
+import fs from "fs"
+import https from 'https';
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd())
   const baseUrl = (env.VITE_BASE_URL || "/").replace(/\/?$/, "/")
 
+  let sslConfig = null
+  if (env.VITE_MTLS_KEY && env.VITE_MTLS_CLIENT && env.VITE_MTLS_CA) {
+    const keyPath = path.resolve(__dirname, env.VITE_MTLS_KEY)
+    const certPath = path.resolve(__dirname, env.VITE_MTLS_CLIENT)
+    const caPath = path.resolve(__dirname, env.VITE_MTLS_CA)
+
+    if (fs.existsSync(keyPath) && fs.existsSync(certPath) && fs.existsSync(caPath)) {
+      sslConfig = {
+        key: fs.readFileSync(keyPath),
+        cert: fs.readFileSync(certPath),
+        ca: fs.readFileSync(caPath),
+      }
+    }
+  }
+
+  function createProxyConfig(overrides){
+    const defaults = {
+      target: `https://${env.VITE_BACKEND_API}`,
+      changeOrigin: false,
+      rewrite: (path) => path.replace(new RegExp(`^${baseUrl}`), "/"),
+      secure: sslConfig ? true : false,
+      configure: (proxy, _options) => {
+        if (sslConfig) {
+          const httpsAgent = new https.Agent(sslConfig);
+          _options.agent = httpsAgent;
+        }
+      },
+    }
+
+    return {...defaults, ...overrides}
+  }
+
   return {
     base: baseUrl,
     plugins: [react()],
@@ -17,29 +51,9 @@ export default defineConfig(({ mode }) => {
       host: true,
       port: Number(env.VITE_PORT) || 5173,
       proxy: {
-        [`${baseUrl}graphql`]: {
-          target: `ws://${env.VITE_BACKEND_API}`,
-          changeOrigin: false,
-          secure: false,
-          ws: true,
-          rewriteWsOrigin: false,
-          // REMOVEME: The API will have a base path similar to the frontend at some point
-          rewrite: (path) => path.replace(new RegExp(`^${baseUrl}`), "/"),
-        },
-        [`${baseUrl}oauth`]: {
-          target: `http://${env.VITE_BACKEND_API}`,
-          changeOrigin: false,
-          secure: false,
-          // REMOVEME: The API will have a base path similar to the frontend at some point
-          rewrite: (path) => path.replace(new RegExp(`^${baseUrl}`), "/"),
-        },
-        [`${baseUrl}metadata`]: {
-          target: `http://${env.VITE_BACKEND_API}`,
-          changeOrigin: false,
-          secure: false,
-          // REMOVEME: The API will have a base path similar to the frontend at some point
-          rewrite: (path) => path.replace(new RegExp(`^${baseUrl}`), "/"),
-        },
+        [`${baseUrl}graphql`]: createProxyConfig({ws: true}),
+        [`${baseUrl}oauth`]: createProxyConfig({}),
+        [`${baseUrl}metadata`]: createProxyConfig({}),
       },
     },
     test: {