feat: use mtls between frontend and backend

.gitignore

@@ -1,2 +1,6 @@
 .vscode
 damnit_proposals.json
+certs/
+*.crt
+*.key
+*.pem

api/Dockerfile

@@ -31,4 +31,4 @@ COPY ./README.md ./README.md
 
 EXPOSE 8000
 
-CMD ["poetry", "run", "uvicorn", "damnit_api.main:app", "--host", "0.0.0.0", "--port", "8000"]
+CMD ["poetry", "run", "python3", "-m", "damnit_api.main"]

api/compose.dev.yml

@@ -2,10 +2,11 @@ name: damnit-web-dev
 
 services:
   api:
-    userns_mode: keep-id
+    userns_mode: host
     ports:
       - 8123:8000
     volumes:
+      - ./certs:/certs
       - /gpfs/exfel/data/scratch/xdana/tmp/damnit-web:/var/tmp
       - /gpfs:/gpfs
       - /pnfs:/pnfs

api/compose.yml

@@ -6,6 +6,11 @@ services:
     env_file:
       - .env
     ports:
-      - 8000
+      - 8000:8000
+    environment:
+      DW_API_UVICORN__SSL_CERTFILE: /certs/server.crt
+      DW_API_UVICORN__SSL_KEYFILE: /certs/server.key
+      DW_API_UVICORN__SSL_CA_CERTS: /certs/root_ca.crt
     volumes:
       - ./tmp-damnit-web/:/tmp/damnit-web/
+      - ./certs:/certs

api/src/damnit_api/main.py

@@ -76,6 +76,11 @@ async def http_exception_handler(request: Request, exc: HTTPException):
 
     logger.info("Starting uvicorn with settings", **settings.uvicorn.model_dump())
 
+    if settings.uvicorn.ssl_cert_reqs != 2:
+        logger.warning(
+            "Not configured to require mTLS. This is not recommended for production."
+        )
+
     uvicorn.run(
         "damnit_api.main:create_app",
         **settings.uvicorn.model_dump(),

api/src/damnit_api/settings.py

@@ -1,13 +1,15 @@
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Annotated
 
 from pydantic import (
     BaseModel,
+    FilePath,
     HttpUrl,
     SecretStr,
     UrlConstraints,
     field_validator,
+    model_validator,
 )
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
@@ -24,6 +26,25 @@ class UvicornSettings(BaseModel):
     reload: bool = True
     factory: bool = True
 
+    ssl_keyfile: FilePath | None = None
+    ssl_certfile: FilePath | None = None
+    ssl_ca_certs: FilePath | None = None
+    ssl_cert_reqs: int | None = None
+
+    @model_validator(mode="after")
+    def ssl_all_if_one(self):
+        """Ensure all SSL settings are set if one is set."""
+        files = [self.ssl_keyfile, self.ssl_certfile, self.ssl_ca_certs]
+        if any(files) and not all(files):
+            msg = "ssl_keyfile, ssl_certfile, and ssl_ca_certs must all be set"
+            raise ValueError(msg)
+
+        if all(files):
+            # Default to 2 (require mTLS) if any SSL settings are set
+            self.ssl_cert_reqs = self.ssl_cert_reqs or 2
+
+        return self
+
     @field_validator("factory", mode="after")
     @classmethod
     def factory_must_be_true(cls, v, values):
@@ -52,7 +73,7 @@ class MyMdCCredentials(BaseSettings):
     base_url: HttpUrl
 
     _access_token: str = ""
-    _expires_at: datetime = datetime.fromisocalendar(1970, 1, 1).astimezone(timezone.utc)
+    _expires_at: datetime = datetime.fromisocalendar(1970, 1, 1).astimezone(UTC)
 
 
 class Settings(BaseSettings):

frontend/compose.dev.yml

@@ -6,6 +6,10 @@ networks:
 
 services:
   frontend:
+    environment:
+      - NODE_EXTRA_CA_CERTS=/certs/root_ca.crt
+    volumes:
+      - ./certs:/certs
     networks:
       - proxy
     labels:

frontend/vite.config.ts

@@ -1,46 +1,71 @@
 import { defineConfig, loadEnv } from "vite"
-import path from "path"
 import react from "@vitejs/plugin-react"
+import path from "path"
+import fs from "fs"
+import https from "https"
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd())
-  const baseUrl = (env.VITE_BASE_URL || "/").replace(/\/?$/, "/")
+
+  const { VITE_MTLS_KEY, VITE_MTLS_CERT, VITE_MTLS_CA, VITE_URL, VITE_API } =
+    env
+
+  if (!VITE_URL || !VITE_API) {
+    throw new Error(
+      "Missing required environment variables: VITE_URL and/or VITE_API",
+    )
+  }
+
+  const baseURL = new URL(VITE_URL)
+  const apiURL = new URL(VITE_API)
+
+  let sslConfig
+  if (VITE_MTLS_KEY && VITE_MTLS_CERT && VITE_MTLS_CA) {
+    sslConfig = {
+      key: fs.readFileSync(path.resolve(__dirname, VITE_MTLS_KEY)),
+      cert: fs.readFileSync(path.resolve(__dirname, VITE_MTLS_CERT)),
+      ca: fs.readFileSync(path.resolve(__dirname, VITE_MTLS_CA)),
+    }
+  } else if (VITE_MTLS_KEY || VITE_MTLS_CERT || VITE_MTLS_CA) {
+    // If partial mTLS variables are set, that's invalid.
+    throw new Error(
+      "mTLS configuration is incomplete. Please provide all three: key, cert, and ca.",
+    )
+  }
+
+  const httpsAgent = sslConfig ? new https.Agent(sslConfig) : undefined
+
+  // If the API server is HTTPS, mTLS configuration is required
+  if (apiURL.protocol === "https:" && !sslConfig) {
+    throw new Error("HTTPS API requires mTLS configuration")
+  }
+
+  const defaultProxyConfig = {
+    target: apiURL.origin,
+    secure: !!sslConfig,
+    changeOrigin: false,
+    configure: (proxy, options) => {
+      if (sslConfig) {
+        options.agent = httpsAgent
+      }
+    },
+  }
 
   return {
-    base: baseUrl,
+    base: baseURL.href,
     plugins: [react()],
     build: {
       outDir: "build",
     },
-    // REMOVEME: Use proxy to handle CORS for the meantime
     server: {
       host: true,
-      port: Number(env.VITE_PORT) || 5173,
+      port: baseURL.port ? Number(baseURL.port) : 5173,
       proxy: {
-        [`${baseUrl}graphql`]: {
-          target: `ws://${env.VITE_BACKEND_API}`,
-          changeOrigin: false,
-          secure: false,
-          ws: true,
-          rewriteWsOrigin: false,
-          // REMOVEME: The API will have a base path similar to the frontend at some point
-          rewrite: (path) => path.replace(new RegExp(`^${baseUrl}`), "/"),
-        },
-        [`${baseUrl}oauth`]: {
-          target: `http://${env.VITE_BACKEND_API}`,
-          changeOrigin: false,
-          secure: false,
-          // REMOVEME: The API will have a base path similar to the frontend at some point
-          rewrite: (path) => path.replace(new RegExp(`^${baseUrl}`), "/"),
-        },
-        [`${baseUrl}metadata`]: {
-          target: `http://${env.VITE_BACKEND_API}`,
-          changeOrigin: false,
-          secure: false,
-          // REMOVEME: The API will have a base path similar to the frontend at some point
-          rewrite: (path) => path.replace(new RegExp(`^${baseUrl}`), "/"),
-        },
+        "/graphql": { ...defaultProxyConfig, ws: true },
+        "/oauth": { ...defaultProxyConfig },
+        "/metadata": { ...defaultProxyConfig },
       },
+      https: sslConfig,
     },
     test: {
       globals: true,