default.conf

# =========================
# Frontend (443) - Vouch + Reports API + MCP endpoints
# =========================
server {
    listen 443 ssl http2;
    server_name $host;

    # --- allow larger request headers/cookies ---
    client_header_buffer_size 16k;
    large_client_header_buffers 8 64k;
    # -------------------------------------------

    root /var/www/html/;

    # TLS
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_certificate     /etc/ssl/public.pem;
    ssl_certificate_key /etc/ssl/private.pem;
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Size/time limits
    client_max_body_size 64m;
    proxy_read_timeout   1800s;
    proxy_send_timeout   1800s;
    proxy_connect_timeout 180s;
    send_timeout         1800s;

    # Forwarded headers for all proxied requests
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host  $host;
    proxy_set_header X-Forwarded-Port  $server_port;

    # POST /mcp (tool calls)
    location = /mcp {
        proxy_pass http://fabric-api-mcp:5000;
        proxy_pass_request_body on;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Content-Length     $content_length;
        proxy_set_header Content-Type      $http_content_type;

        add_header Access-Control-Allow-Origin "https://api-mcp.fabric-testbed.net" always;
        add_header Access-Control-Allow-Credentials "true" always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "DNT, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Authorization" always;
    }

    # =============================================
    # Vouch Proxy — CILogon OIDC auth for Grafana
    # =============================================

    # Internal validation endpoint
    location = /validate {
        internal;
        proxy_pass http://fabric-api-vouch:9090/validate;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Internal proxy: Core API /whoami (authenticated via vouch cookie)
    location = /_core_api_whoami {
        internal;
        proxy_pass https://uis.fabric-testbed.net/whoami;
        proxy_set_header Host uis.fabric-testbed.net;
        proxy_set_header Cookie $http_cookie;
        proxy_ssl_server_name on;
        proxy_ssl_verify off;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
    }

    # Internal proxy: Core API /people/{uuid} (authenticated via vouch cookie)
    location ~ ^/_core_api_people/(?<person_uuid>[^/]+) {
        internal;
        set $core_api_url https://uis.fabric-testbed.net/people/$person_uuid$is_args$args;
        proxy_pass $core_api_url;
        proxy_set_header Host uis.fabric-testbed.net;
        proxy_set_header Cookie $http_cookie;
        proxy_ssl_server_name on;
        proxy_ssl_verify off;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
    }

    # Vouch callback / login / logout
    location /auth {
        proxy_pass http://fabric-api-vouch:9090/auth;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /login {
        proxy_pass http://fabric-api-vouch:9090/login;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /logout {
        proxy_pass http://fabric-api-vouch:9090/logout;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Redirect 401 to vouch login
    error_page 401 = @error401;
    location @error401 {
        return 302 https://$http_host/login?url=https://$http_host$request_uri;
    }

    # Grafana (served at /grafana/) — protected by Vouch + Core API role check
    location /grafana/ {
        auth_request /validate;

        # Lua: forward vouch cookie to Core API to check user roles
        access_by_lua_block {
            -- Check cache first (keyed by cookie hash, 5-min TTL)
            local cookie = ngx.var.http_cookie or ""
            if cookie == "" then
                ngx.log(ngx.ERR, "No cookies in request")
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local cache = ngx.shared.role_cache
            local cache_key = "role:" .. ngx.md5(cookie)
            local cached = cache:get(cache_key)
            if cached == "allow" then
                return  -- authorized, proceed
            elseif cached == "deny" then
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            -- Step 1: GET /whoami to get user UUID (vouch cookie forwarded automatically)
            local res = ngx.location.capture("/_core_api_whoami")
            if not res or res.status ~= 200 then
                ngx.log(ngx.ERR, "Core API /whoami failed: status=", res and res.status or "nil",
                    " body=", string.sub(res.body or "", 1, 300))
                cache:set(cache_key, "deny", 60)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local cjson = require("cjson.safe")
            local whoami = cjson.decode(res.body)
            local uuid = whoami and whoami["results"] and whoami["results"][1] and whoami["results"][1]["uuid"]
            if not uuid then
                ngx.log(ngx.ERR, "Core API /whoami: no uuid in response")
                cache:set(cache_key, "deny", 60)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            -- Step 2: GET /people/{uuid}?as_self=true to get roles
            local res2 = ngx.location.capture("/_core_api_people/" .. uuid .. "?as_self=true")
            if not res2 or res2.status ~= 200 then
                ngx.log(ngx.ERR, "Core API /people/", uuid, " failed: status=", res2 and res2.status or "nil")
                cache:set(cache_key, "deny", 60)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local user_info = cjson.decode(res2.body)
            local results = user_info and user_info["results"]
            local person = results and results[1]
            local roles = person and person["roles"]

            if not roles or type(roles) ~= "table" then
                ngx.log(ngx.WARN, "No roles for user ", uuid)
                cache:set(cache_key, "deny", 300)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local allowed = false
            for _, role in ipairs(roles) do
                local rname = ""
                if type(role) == "table" then
                    rname = role["name"] or ""
                elseif type(role) == "string" then
                    rname = role
                end
                if rname == "facility-operators" or rname == "facility-viewers" then
                    allowed = true
                    break
                end
            end

            if allowed then
                cache:set(cache_key, "allow", 300)
            else
                ngx.log(ngx.WARN, "User ", uuid, " lacks facility-operators/facility-viewers role")
                cache:set(cache_key, "deny", 300)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end
        }

        proxy_pass http://fabric-api-grafana:3000/grafana/;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Grafana WebSocket (live updates) — protected by Vouch + Core API role check
    location /grafana/api/live/ {
        auth_request /validate;

        # Lua: same role check (cached, so typically instant after first hit)
        access_by_lua_block {
            local cookie = ngx.var.http_cookie or ""
            if cookie == "" then
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local cache = ngx.shared.role_cache
            local cache_key = "role:" .. ngx.md5(cookie)
            local cached = cache:get(cache_key)
            if cached == "allow" then
                return
            elseif cached == "deny" then
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local res = ngx.location.capture("/_core_api_whoami")
            if not res or res.status ~= 200 then
                cache:set(cache_key, "deny", 60)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local cjson = require("cjson.safe")
            local whoami = cjson.decode(res.body)
            local uuid = whoami and whoami["results"] and whoami["results"][1] and whoami["results"][1]["uuid"]
            if not uuid then
                cache:set(cache_key, "deny", 60)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local res2 = ngx.location.capture("/_core_api_people/" .. uuid .. "?as_self=true")
            if not res2 or res2.status ~= 200 then
                cache:set(cache_key, "deny", 60)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local user_info = cjson.decode(res2.body)
            local results = user_info and user_info["results"]
            local person = results and results[1]
            local roles = person and person["roles"]

            if not roles or type(roles) ~= "table" then
                cache:set(cache_key, "deny", 300)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end

            local allowed = false
            for _, role in ipairs(roles) do
                local rname = ""
                if type(role) == "table" then
                    rname = role["name"] or ""
                elseif type(role) == "string" then
                    rname = role
                end
                if rname == "facility-operators" or rname == "facility-viewers" then
                    allowed = true
                    break
                end
            end

            if allowed then
                cache:set(cache_key, "allow", 300)
            else
                cache:set(cache_key, "deny", 300)
                return ngx.exit(ngx.HTTP_FORBIDDEN)
            end
        }

        proxy_pass http://fabric-api-grafana:3000/grafana/api/live/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host       $host;
    }
}