fix: nginx deployment and docker secrets

.github/workflows/test_client_e2e.yaml

@@ -4,7 +4,7 @@ on: [push]
 
 env:
   VITE_SESSION_SECRET: ${{ secrets.VITE_SESSION_SECRET }}
-  DUCKDB_POOL_SIZE: 5
+  NODE_ENV: dev
 
 jobs:
   electron-run:

api/Dockerfile

@@ -14,4 +14,7 @@ RUN pip install --no-cache-dir --upgrade -r /api/requirements.txt
 
 COPY ./ /api/
 
-CMD ["uvicorn", "app:app", "--reload", "--port", "9090"]
+RUN --mount=type=secret,id=VITE_SESSION_SECRET \
+  cat /run/secrets/VITE_SESSION_SECRET
+
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--reload", "--port", "9090"]

api/app.py

@@ -274,7 +274,7 @@ def substrait_fiddle_openapi():
 
 
 app = FastAPI()
-app.include_router(router, prefix="/route")
+app.include_router(router, prefix="/api/route")
 app.openapi = substrait_fiddle_openapi
 app.add_middleware(
     TrustedHostMiddleware,

api/components/duckdb.py

@@ -6,7 +6,7 @@
 
 # Pool size is default at 5 for maintaining 
 # 5 concurrent DuckDB connection objects
-POOL_SIZE = int(os.environ.get("DUCKDB_POOL_SIZE"))
+POOL_SIZE = int(os.environ.get("DUCKDB_POOL_SIZE", 5))
 
 
 

api/test.py

@@ -29,7 +29,7 @@ def test_validate_json():
             "plan": plan,
             "override_levels": [2001, 1],
         }
-        response = client.post("/route/validate/", json=data, 
+        response = client.post("/api/route/validate/", json=data,
                                headers={"Host": "127.0.0.1"})
         assert response.status_code == 200
 
@@ -40,7 +40,7 @@ def test_validate_binary():
             file = file_stream.read()
 
         response = client.post(
-            "/route/validate/file/",
+            "/api/route/validate/file/",
             data={"override_levels": [1002, 2001]},
             files={"file": ("q1.bin", file, "application/octet-stream")},
             headers={"Host": "127.0.0.1"}
@@ -68,7 +68,7 @@ def test_add_schema():
                 }
         '''
         response = client.post(
-            "/route/add_schema/",
+            "/api/route/add_schema/",
             json={
                 "schema": schema
             },
@@ -86,7 +86,7 @@ def test_parse_to_substrait():
                            algorithm="HS256")
 
         response = client.post(
-            "/route/parse/",
+            "/api/route/parse/",
             json={
                 "query": "SELECT * FROM lineitem;",
             },
@@ -109,10 +109,12 @@ def test_save_plan_roundtrip():
             "json_string": json_string,
             "validator_overrides": [2001, 1],
         }
-        response = client.post("/route/save/", json=data, headers={"Host": "127.0.0.1"})
+        response = client.post("/api/route/save/",
+                               json=data,
+                               headers={"Host": "127.0.0.1"})
         assert response.status_code == 200
 
-        response = client.post("/route/fetch/?id=" + response.json(), 
+        response = client.post("/api/route/fetch/?id=" + response.json(),
                                headers={"Host": "127.0.0.1"})
         assert response.status_code == 200
         assert response.json()["json_string"] == json_string

client/Dockerfile

@@ -1,6 +1,8 @@
 FROM node:18-alpine as builder
 WORKDIR /app
 COPY . .
+RUN --mount=type=secret,id=VITE_SESSION_SECRET \
+  cat /run/secrets/VITE_SESSION_SECRET
 RUN npm ci
 RUN npm run build
 

client/nginx.conf

@@ -30,5 +30,14 @@ http {
         server_tokens off;
 
         root /app/static;
+
+        location /api/ {
+            proxy_pass http://api:9090;  # Use the service name instead of IP
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection 'upgrade';
+            proxy_set_header Host $host;
+            proxy_cache_bypass $http_upgrade;
+        }
     }
-}
+}

client/src/assets/js/validate.test.js

@@ -11,7 +11,7 @@ test("validate", async () => {
     "configured recursion limit for URI resolution has been reached",
   );
   return axios
-    .post(BASE_URL + "/route/validate/", {
+    .post(BASE_URL + "/api/route/validate/", {
       plan: plan,
       override_levels: [2001, 1],
     })

client/vite.config.js

@@ -1,12 +1,12 @@
 import { fileURLToPath, URL } from "node:url";
-
 import { defineConfig } from "vite";
 import vue from "@vitejs/plugin-vue";
 import inject from "@rollup/plugin-inject";
 
 const path = require("path");
 
 export default defineConfig({
+  base: '/',
   plugins: [
     vue(),
     inject({
@@ -29,10 +29,9 @@ export default defineConfig({
   server: {
     proxy: {
       "/api": {
-        target: "http://127.0.0.1:9090",
+        target: process.env.NODE_ENV === 'dev' ? "http://127.0.0.1:9090" : "http://api:9090",
         changeOrigin: true,
         secure: false,
-        rewrite: (path) => path.replace("/api", ""),
       },
     },
   },

docker-compose.yaml

@@ -1,12 +1,31 @@
 version: '3.8'
+
 services:
   api:
     build: ./api
     ports:
       - "9090:9090"
     environment:
-      - DUCKDB_POOL_SIZE=5
+     - DUCKDB_POOL_SIZE=5
+    networks:
+      - fiddle-network
+    secrets:
+       - vite_sess_secrt
+
   client:
     build: ./client
     ports:
-      - "80:8080"
+      - "8080:8080"
+    networks:
+      - fiddle-network
+    secrets:
+       - vite_sess_secrt
+
+networks:
+  fiddle-network:
+    driver: bridge
+
+secrets:
+  vite_sess_secrt:
+    external: true
+    name: "${secrets.VITE_SESSION_SECRET}"