st2-docker icon indicating copy to clipboard operation
st2-docker copied to clipboard

Please support monitoring when using https

Open greenmoss opened this issue 4 years ago • 1 comments

Is your feature request related to a problem? Please describe. Only becomes a problem if you enable SSL, and at that point it is a blocker

Describe the solution you'd like When starting with https, fix the web monitoring healthcheck script to use the correct curl invocation

Describe alternatives you've considered Works ok without https/SSL

greenmoss avatar Jan 13 '22 21:01 greenmoss

Here's a hacked version of the healthcheck script suitable as fuel for a legitimate PR:

diff --git a/scripts/st2web-healthcheck.sh b/scripts/st2web-healthcheck.sh
index 327a173..56aed6b 100755
--- a/scripts/st2web-healthcheck.sh
+++ b/scripts/st2web-healthcheck.sh
@@ -18,15 +18,15 @@ fi

 # Check each service through the nginx reverse proxy for a specific return code. If the curl request
 # fails to work through nginx, a stop signal will be sent to nginx, causing the container to restart.
-API_STATUS=$(curl --write-out "%{http_code}\n" --silent --output /dev/null http://localhost/api/v1/)
+API_STATUS=$(curl -k --write-out "%{http_code}\n" --silent --output /dev/null https://localhost/api/v1/)
 if [ "${API_STATUS}" != "401" ]; then
   echo "st2api nginx failure"; nginx -s stop;
 fi
-STREAM_STATUS=$(curl --write-out "%{http_code}\n" --silent --output /dev/null http://localhost/stream/v1/stream)
+STREAM_STATUS=$(curl -k --write-out "%{http_code}\n" --silent --output /dev/null https://localhost/stream/v1/stream)
 if [ "${STREAM_STATUS}" != "401" ]; then
   echo "st2stream nginx failure"; nginx -s stop;
 fi
-AUTH_STATUS=$(curl --write-out "%{http_code}\n" --silent --output /dev/null  http://localhost/auth/v1/)
+AUTH_STATUS=$(curl -k --write-out "%{http_code}\n" --silent --output /dev/null  https://localhost/auth/v1/)
 if [ "${AUTH_STATUS}" != "404" ]; then
   echo "st2auth nginx failure"; nginx -s stop;
 fi

Note it's a complete HACK, because I didn't retain compatibility with the old plain-text http monitoring method.

greenmoss avatar Jan 13 '22 21:01 greenmoss