build: deploy pixel-driller API to staging (#254)

* build: deploy pixel-driller API to staging

Add pixel-driller to the nginx config and the staging docker-compose file.

* Add env vars, use hyphenated name

* Add missing semicolon

---------

Co-authored-by: Fred Thomas <fred.thomas@eci.ox.ac.uk>

deploy/etc/nginx/sites-available/jamaica.infrastructureresilience.org

@@ -25,6 +25,10 @@ upstream raster_tileserver {
         server 127.0.0.1:3003;
 }
 
+upstream pixel_driller {
+        server 127.0.0.1:3004;
+}
+
 # Set up rate limit
 limit_req_zone $binary_remote_addr zone=slow:10m rate=50r/s;
 
@@ -148,6 +152,25 @@ server {
 		add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
 	}
 
+	location /pixel {
+		# basic authentication - use htpasswd to add users
+		auth_basic "Access restricted";
+		auth_basic_user_file /etc/nginx/.htpasswd;
+
+		proxy_pass http://pixel_driller;
+		rewrite ^/pixel/(.+) /$1 break;
+		proxy_set_header Host $host/pixel;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+
+		# allow CORS with auth
+		add_header Access-Control-Allow-Origin "$http_origin" always;
+		add_header 'Access-Control-Allow-Credentials' 'true' always;
+		add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+		add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+	}
+
 	listen [::]:443 ssl ipv6only=on; # managed by Certbot
 	listen 443 ssl; # managed by Certbot
 	ssl_certificate /etc/letsencrypt/live/jamaica.infrastructureresilience.org/fullchain.pem; # managed by Certbot

docker-compose.stage.yml

@@ -1,7 +1,7 @@
 # Staging environment - as production except for domain
 services:
   frontend:
-    image: ghcr.io/nismod/jsrat-frontend:0.4.21
+    image: ghcr.io/nismod/jsrat-frontend:canary
     platform: linux/amd64
     build: ./frontend
     ports:
@@ -52,3 +52,15 @@ services:
       - TC_RESAMPLING_METHOD=nearest
       - TC_REPROJECTION_METHOD=nearest
       - TC_PNG_COMPRESS_LEVEL=1
+
+  pixel-driller:
+    image: ghcr.io/nismod/jsrat-pixel-driller:canary
+    platform: linux/amd64
+    build: ./pixel_driller
+    ports:
+      - "3004:80"
+    volumes:
+      - ./tileserver/stacks:/data
+    environment:
+      - PIXEL_STACK_DATA_DIR=/data
+      - LAYER_METADATA_PATH=/data/hazard_layers.csv