From 904be49ac9cf9a6a6a1b8c21f135aca2041d99bb Mon Sep 17 00:00:00 2001
From: talksik <patel.arjun50@gmai.com>
Date: Mon, 14 Aug 2023 13:53:24 -0700
Subject: [PATCH] fixing config to just route within network and not expose
 ports of services

---
 docker-compose.yaml |  8 +++-----
 nginx.conf          | 34 +++++++++++++++++++++++++++++++++-
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/docker-compose.yaml b/docker-compose.yaml
index 870e239..a6b4889 100644
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@@ -25,17 +25,15 @@ services:
     image: registry:2
     restart: unless-stopped
     container_name: registry
-    ports:
-      - 5001:5001 # using different port simply because nginx container needs the 5000 port
     volumes:
       - /mnt/registry:/var/lib/registry
     networks:
       - nginx
+
   rancher:
     image: rancher/rancher:latest
     restart: unless-stopped
     container_name: rancher
-    ports:
-      - 2000:80
-      - 2001:443
     privileged: true
+    networks:
+      - nginx
diff --git a/nginx.conf b/nginx.conf
index 41367bd..4623503 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -12,11 +12,12 @@ http {
         }
     }
 
+    # container registry
     server {
         listen 5000;
 
         location / {
-          proxy_pass http://localhost:5001;
+          proxy_pass http://registry:5000;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -24,6 +25,33 @@ http {
         }
     }
 
+    # rancher http
+    server {
+        listen 2000;
+
+        location / {
+          proxy_pass http://rancher:80;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # rancher https: the destination container will handle tls
+    server {
+        listen 2001;
+
+        location / {
+          proxy_pass https://rancher:443;
+          proxy_set_header Host $host;
+          proxy_set_header X-Real-IP $remote_addr;
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # kubernetes cluster hello world
     server {
         listen 80;
 
@@ -38,21 +66,25 @@ http {
 }
 
 stream {
+    # kubernetes cluster api
     server {
         listen 3080;
         proxy_pass localhost:33360; # TODO: change to NodePort of api within kubernetes
     }
 
+    # k8s audio relay
     server {
         listen 6000 udp;
         proxy_pass localhost:33600;  # TODO: change to NodePort of udp deployment service
     }
 
+    # k8s video relay
     server {
         listen 6001 udp;
         proxy_pass localhost:33600;  # TODO: change to NodePort of udp deployment service
     }
 
+    # k8s presence heartbeat
     server {
         listen 6002;
         proxy_pass localhost:33600;  # TODO: change to NodePort of tcp presence deployment service