OAuth2 Proxy Support

Dockerfile

@@ -1,23 +1,33 @@
-
-
 FROM node:18-alpine as build
 WORKDIR /app
 RUN apk add --no-cache openssh git
 COPY package* ./
 RUN npm install --omit=dev
 COPY dist ./
 
+FROM golang:latest as go
+RUN go install -v github.com/oauth2-proxy/oauth2-proxy/v7@latest
+
 FROM node:18-alpine
+# https://stackoverflow.com/questions/66963068/docker-alpine-executable-binary-not-found-even-if-in-path
+RUN apk add --no-cache libc6-compat curl
 ARG BUILD_VERSION
 ARG LOG_LEVEL=info
 ARG LOG_LABEL=bull-monitor
+ARG ALTERNATE_PORT=8081
 ARG PORT=3000
+ARG OAUTH2_PROXY_SKIP_AUTH_ROUTES='/metrics,/health,/docs'
 WORKDIR /app
+COPY --from=go /go/bin/oauth2-proxy ./
 COPY --from=build /app ./
+COPY docker-entrypoint.sh .
 ENV NODE_ENV="production" \
+    ALTERNATE_PORT=$ALTERNATE_PORT \
     PORT=$PORT \
     LOG_LEVEL=$LOG_LEVEL \
     LOG_LABEL=$LOG_LABEL \
+    OAUTH2_PROXY_SKIP_AUTH_ROUTES=$OAUTH2_PROXY_SKIP_AUTH_ROUTES \
     VERSION=$BUILD_VERSION
 EXPOSE 3000
-ENTRYPOINT ["node", "daemon.js"]
+HEALTHCHECK --interval=15s --timeout=30s --start-period=5s --retries=3 CMD curl --fail http://localhost:3000/health || exit 1
+ENTRYPOINT ["sh", "docker-entrypoint.sh"]

README.md

@@ -14,6 +14,7 @@ This is an all-in-one tool to help you visualize and report on bull! It runs as
 - Configurable UI support to visualize bull queues (supported: [`arena`](https://github.com/bee-queue/arena#readme), [`bull-board`](https://github.com/felixmosh/bull-board), [`bull-master`](https://github.com/hans-lizihan/bull-master))
 - Sentry error reporting (just pass `SENTRY_DSN` environment variable)
 - [Elastic ECS](https://www.elastic.co/what-is/ecs) logging when `NODE_ENV` is set to `production`
+- Bundled `oauth2_proxy` if you want to restrict access (disabled by default)
 
 You can test it out with docker by running (if you want to access something running on your host machine and not within the docker network you can use the special hostname [`host.docker.internal`](https://docs.docker.com/docker-for-mac/networking/#use-cases-and-workarounds)):
 
@@ -61,6 +62,7 @@ The following environment variables are supported:
 
 | Environment Variable                     | Required | Default Value  | Description                                                                                                                                                              |
 | ---------------------------------------- | -------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `ALTERNATE_PORT`                         |          | `8081`         | If oauth2 proxy is enabled bull monitor will run on this port instead                                                                                                    |
 | `REDIS_HOST`                             | x        | `null`         | Redis host (**IMPORTANT** must be same redis instance that stores bull jobs!)                                                                                            |
 | `REDIS_PORT`                             | x        | `null`         | Redis port                                                                                                                                                               |
 | `REDIS_PASSWORD`                         |          | `null`         | Redis password                                                                                                                                                           |
@@ -73,8 +75,10 @@ The following environment variables are supported:
 | `LOG_LABEL`                              |          | `bull-monitor` | Log label to use                                                                                                                                                         |
 | `LOG_LEVEL`                              |          | `info`         | Log level to use (supported: `debug`, `error`, `info`, `warn`)                                                                                                           |
 | `NODE_ENV`                               |          | `production`   | Node environment (use `development` for colorized logging)                                                                                                               |
+| `OAUTH2_PROXY_*`                         |          | `null`         | See [OAuth2 Proxy docs](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview/#environment-variables) for more details                                 |
 | `PORT`                                   |          | `3000`         | Port to use                                                                                                                                                              |
 | `SENTRY_DSN`                             |          | `null`         | Sentry DSN to send errors to (disabled if not provided)                                                                                                                  |
+| `USE_OAUTH2_PROXY`                       |          | `0`            | Enable oauth2 proxy (anything other than `1` will disable)                                                                                                               |
 
 ## getting started
 
@@ -191,24 +195,35 @@ You can now go to: http://localhost:3001/dashboard/import and load dashboards:
 
 There are 3 options currently available for UIs: `bull-board`, `arena`, and `bull-master`.
 
-## bull-board
+### bull-board
 
 From: https://github.com/felixmosh/bull-board#readme. This is the default UI. If you want to be explicit just set `UI` environment variable to `bull-board`.
 
 ![](screenshots/bull-board-ui.png)
 
-## bull-master
+### bull-master
 
 From: https://github.com/hans-lizihan/bull-master. To use this UI you'll need to set the `UI` environment variable to `bull-master`.
 
 ![](screenshots/bull-master-ui.png)
 
-## bull-arena
+### bull-arena
 
 From: https://github.com/bee-queue/arena. To use this UI you'll need to set the `UI` environment variable to `arena`.
 
 ![](screenshots/arena-ui.png)
 
+## OAuth2 Proxy
+
+You can restrict access to bull monitor using the built in OAuth2 proxy. To enable you'll need the following environment variables at a minimum:
+
+- `USE_OAUTH2_PROXY` (must be set to `1`)
+- `OAUTH2_PROXY_REDIRECT_URL` (this is what the oauth provider will be redirecting to)
+- `OAUTH2_PROXY_CLIENT_ID`
+- `OAUTH2_PROXY_SECRET_ID`
+
+Many other configuration options are possible. See the [OAuth2 Proxy documentation](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview/#environment-variables) for more information.
+
 ## Security Considerations
 
 - This is intended as a back office monitoring solution. You should not make expose this publicly

docker-compose.yml

@@ -14,6 +14,14 @@ services:
     depends_on:
       - redis
     environment:
+      USE_OAUTH2_PROXY: '0'
+      OAUTH2_PROXY_PROVIDER: 'github'
+      OAUTH2_PROXY_CLIENT_ID: ''
+      OAUTH2_PROXY_CLIENT_SECRET: ''
+      OAUTH2_PROXY_REDIRECT_URL: 'http://localhost:3000'
+      OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: '1'
+      OAUTH2_PROXY_EMAIL_DOMAINS: '*'
+      OAUTH2_PROXY_SCOPE: 'user:email'
       UI: bull-board
       REDIS_HOST: redis
       REDIS_PORT: 6379

docker-entrypoint.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+
+CONFIG_FILE=oauth2_proxy.cfg
+STARTUP_COMMAND="node daemon.js"
+OAUTH2_PROXY="./oauth2-proxy"
+LOG_TRANSFORMER="node transform_logs.js"
+
+# https://serverfault.com/questions/599103/make-a-docker-application-write-to-stdout
+DOCKER_STDOUT="/proc/1/fd/1"
+
+# enable prod logging if NODE_ENV is production
+if [[ "$NODE_ENV" = "production" ]]; then
+  LOG_TRANSFORMER="$LOG_TRANSFORMER --production"
+fi
+
+if [[ -z "$ALTERNATE_PORT" ]]; then
+    echo "Environment variable not defined: ALTERNATE_PORT"
+    exit 1
+fi
+
+if [[ "$USE_OAUTH2_PROXY" == "1" ]]; then
+    echo "OAuth2 Proxy Enabled"
+    # https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview#environment-variables
+    export OAUTH2_PROXY_COOKIE_SECRET=$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo)
+    export OAUTH2_PROXY_COOKIE_NAME="oauth2_proxy"
+    export OAUTH2_PROXY_HTTP_ADDRESS="http://0.0.0.0:${PORT}"
+    export OAUTH2_PROXY_UPSTREAMS="http://0.0.0.0:${ALTERNATE_PORT}"
+
+    # https://serverfault.com/questions/599103/make-a-docker-application-write-to-stdout
+    $OAUTH2_PROXY 2>&1 | $LOG_TRANSFORMER  > $DOCKER_STDOUT &
+
+    # need to run service on a different port to make room for proxy
+    PORT=$ALTERNATE_PORT $STARTUP_COMMAND
+else
+    echo "OAuth2 Proxy Disabled"
+    $STARTUP_COMMAND
+fi

package.json

@@ -34,7 +34,8 @@
     "test:watch": "dotenv -e environments/test.env -e environments/local.env -- jest --watch",
     "test:cov": "dotenv -e environments/test.env -e environments/local.env -- jest --coverage",
     "test:debug": "dotenv -e environments/test.env -e environments/local.env -- node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
-    "test:e2e": "dotenv -e environments/test.env -e environments/local.env -- jest --rootDir . --testRegex '.e2e-spec.ts$' --detectOpenHandles --forceExit"
+    "test:e2e": "dotenv -e environments/test.env -e environments/local.env -- jest --rootDir . --testRegex '.e2e-spec.ts$' --detectOpenHandles --forceExit",
+    "transform_logs": "ts-node -r tsconfig-paths/register src/transform_logs.ts"
   },
   "dependencies": {
     "@bull-board/api": "^4.0.0",
@@ -52,6 +53,7 @@
     "bull-master": "^1.0.5",
     "bull-prom": "ejhayes/bull-prom#master",
     "bullmq": "^1.86.2",
+    "commander": "^9.3.0",
     "envalid": "^7.3.1",
     "forever-monitor": "^3.0.3",
     "nestjs-redis": "1.2.6",
@@ -111,6 +113,14 @@
       "ts"
     ],
     "rootDir": ".",
+    "coveragePathIgnorePatterns": [
+      "interfaces",
+      "enums",
+      "<rootDir>/src/app.module.ts",
+      "<rootDir>/src/daemon.ts",
+      "<rootDir>/src/main.ts",
+      "<rootDir>/src/transform_logs.ts"
+    ],
     "testRegex": ".*\\.spec\\.ts$",
     "transform": {
       "^.+\\.(t|j)s$": "ts-jest"

src/metrics/metrics.module.spec.ts

@@ -0,0 +1,40 @@
+import { Test } from '@nestjs/testing';
+import { METRICS_MODULE_OPTIONS } from './common';
+import { MetricsController } from './metrics.controller';
+import { MetricsModule } from './metrics.module';
+import { MetricsService } from './metrics.service';
+
+describe(MetricsModule, () => {
+  let metricsController: MetricsController;
+  let metricsService: MetricsService;
+
+  beforeEach(async () => {
+    const moduleRef = await Test.createTestingModule({
+      controllers: [MetricsController],
+      providers: [
+        MetricsService,
+        {
+          provide: METRICS_MODULE_OPTIONS,
+          useValue: {},
+        },
+      ],
+    }).compile();
+
+    metricsController = moduleRef.get<MetricsController>(MetricsController);
+    metricsService = moduleRef.get<MetricsService>(MetricsService);
+  });
+
+  it('returns empty metrics', async () => {
+    const metrics = await metricsController.getMetrics();
+    expect(metrics.trim()).toBe('');
+  });
+
+  it('creates a metric', async () => {
+    const counterMetric = metricsService.createCounter({
+      name: 'test',
+      help: 'test',
+    });
+
+    expect(counterMetric.inc).toBeDefined();
+  });
+});

src/openapi/openapi.module.spec.ts

@@ -0,0 +1,12 @@
+import { Test } from '@nestjs/testing';
+import { OpenAPIModule } from './openapi.module';
+
+describe(OpenAPIModule, () => {
+  it('works', async () => {
+    await Test.createTestingModule({
+      imports: [OpenAPIModule],
+    }).compile();
+
+    expect(true).toBe(true);
+  });
+});

src/transform_logs.ts

@@ -0,0 +1,71 @@
+import { LoggerService } from '@app/logger';
+import { program } from 'commander';
+import { Environments, LOG_LEVELS } from './logger/common';
+import {} from 'stream';
+
+const DEFAULT_CONTEXT = 'http-context';
+const DEFAULT_LOG_LABEL = 'transform-logs';
+const DEFAULT_LOG_LEVEL = LOG_LEVELS.INFO;
+const VERSION = '1.0.0';
+
+// https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview#standard-log-format
+const DEFAULT_REGEX = /.+\s.+\s(?<context>.+:\d+):\s(?<message>.+$)/;
+
+interface ITransformerOptions {
+  //context: string;
+  label: string;
+  level: LOG_LEVELS;
+  production: boolean;
+  regex?: string;
+}
+
+interface IParsedMessage {
+  [key: string]: string;
+  context: string;
+  message: string;
+}
+
+program
+  .option(
+    '--default-context <context>',
+    'Context to use for logs',
+    DEFAULT_CONTEXT,
+  )
+  .option('--label', 'Log label', DEFAULT_LOG_LABEL)
+  .option('--level <level>', 'Log level to capture', DEFAULT_LOG_LEVEL)
+  .option('--production', 'Enables production specific logging')
+  .option('--regex <regex>', 'Regex to parse messages')
+  .version(VERSION);
+
+program.parse();
+
+const opts = program.opts() as ITransformerOptions;
+
+const logger = new LoggerService({
+  env: opts.production ? Environments.PRODUCTION : Environments.DEVELOPMENT,
+  label: opts.label,
+  level: opts.level,
+});
+
+const regexParser = opts.regex ? new RegExp(opts.regex) : DEFAULT_REGEX;
+
+process.stdin.on('data', (data) => {
+  for (const msg of data
+    .toString()
+    .split('\n')
+    .filter((el) => el)) {
+    try {
+      const parsed = msg.match(regexParser).groups as IParsedMessage;
+      logger.setContext(parsed.context);
+      if (parsed.message.search(/^ERROR/) >= 0) {
+        logger.error(parsed.message);
+      } else {
+        logger.log(parsed.message);
+      }
+    } catch (err) {
+      //logger.error(err);
+      logger.setContext(DEFAULT_CONTEXT);
+      logger.log(msg);
+    }
+  }
+});

tsconfig.json

@@ -13,7 +13,7 @@
     "incremental": true,
     "esModuleInterop": true,
     "paths": {
-      "@app/*": ["*"]
+      "@app/*": ["*", "src/*"]
     }
   },
   "include": ["src/**/*", "test/**/*", "bull_generator.ts"]