functional deployment without SSO for trade-hub

roles/trade_hub/README.md

@@ -61,7 +61,8 @@ node environment, then to the development default `sc_inventory_dev`.
 | `trade_hub_network` | `sc-inventory` | Podman network name |
 | `trade_hub_volume` | `sc-inventory-data` | PostgreSQL data volume |
 | `trade_hub_frontend_bind` | `0.0.0.0` | Address the frontend publishes on |
-| `trade_hub_frontend_port` | `8080` | Host port for the frontend |
+| `trade_hub_frontend_port` | `8071` | Host publish and container listen port for the frontend |
+| `trade_hub_frontend_ip` | `10.10.0.5` | Static address on the shared `npm_internal` proxy network |
 | `trade_hub_cookie_secure` | `false` | Mark session cookies `Secure` (enable behind TLS) |
 | `trade_hub_healthcheck_url` | `http://127.0.0.1:<port>/healthz` | Post-deploy check |
 | `trade_hub_remove_legacy_apache` | `false` | Remove a container named `my-apache-server` |
@@ -77,6 +78,18 @@ existing installation is upgraded in place.
 ansible-playbook site.yml --tags trade_hub -e trade_hub_postgres_password='...'
 ```
 
-The role verifies `http://127.0.0.1:8080/healthz` after starting the containers.
+The role verifies `http://127.0.0.1:8071/healthz` after starting the containers.
 Only the frontend publishes a port; the database and backend stay on the
 internal podman network.
+
+## Proxy manager
+
+The frontend is pinned to `10.10.0.5` on the shared `npm_internal` podman
+network, which also hosts Nginx Proxy Manager (10.10.0.19). Configure the proxy
+host upstream as `http://10.10.0.5:8071`.
+
+The `network` role must run before this one so `npm_internal` exists:
+
+```bash
+ansible-playbook -i inventory.ini ansible-playbook.yml --tags "network,trade_hub"
+```

roles/trade_hub/defaults/main.yml

@@ -15,6 +15,16 @@ trade_hub_postgres_image: docker.io/library/postgres:16-alpine
 trade_hub_build_images: true
 trade_hub_force_rebuild: false
 
+# Directories created under trade_hub_app_dir before the source is staged.
+# ansible.builtin.copy does NOT create parent directories for single-file
+# sources, so every directory a staged file lands in must exist first.
+trade_hub_app_subdirs:
+  - backend
+  - backend/app
+  - backend/scripts
+  - frontend
+  - frontend/src
+
 # Container names. Kept compatible with the previous standalone playbook so an
 # existing installation is upgraded in place.
 trade_hub_db_container: sc-inventory-db
@@ -24,7 +34,7 @@ trade_hub_frontend_container: sc-inventory-frontend
 # Database.
 trade_hub_postgres_user: sc_inventory
 trade_hub_postgres_db: sc_inventory
-trade_hub_postgres_password: "{{ lookup('env', 'POSTGRES_PASSWORD') | default('sc_inventory_dev', true) }}"
+trade_hub_postgres_password: "{{ lookup('env', 'POSTGRES_PASSWORD') | default(trade_hub_postgres_pw, true) }}"
 trade_hub_database_url: "postgresql+psycopg://{{ trade_hub_postgres_user }}:{{ trade_hub_postgres_password }}@db:5432/{{ trade_hub_postgres_db }}"
 trade_hub_db_wait_seconds: 60
 
@@ -32,7 +42,12 @@ trade_hub_db_wait_seconds: 60
 trade_hub_network: sc-inventory
 trade_hub_volume: sc-inventory-data
 trade_hub_frontend_bind: 0.0.0.0
-trade_hub_frontend_port: 8080
+# Published on the host and used as the container's nginx listen port. Nginx
+# Proxy Manager proxies to http://<trade_hub_frontend_ip>:<trade_hub_frontend_port>.
+trade_hub_frontend_port: 8071
+# Static address for the frontend on the shared npm_internal proxy network
+# (created by the "network" role), so the proxy-manager upstream never changes.
+trade_hub_frontend_ip: "10.10.0.5"
 # Set to true (or "true") once the site is served over TLS.
 trade_hub_cookie_secure: "false"
 

roles/trade_hub/files/trade-hub/frontend/Dockerfile

@@ -3,4 +3,4 @@ FROM docker.io/library/nginx:1.27-alpine
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY src/ /usr/share/nginx/html/
 
-EXPOSE 80
+EXPOSE 8071

roles/trade_hub/files/trade-hub/frontend/nginx.conf

@@ -1,5 +1,5 @@
 server {
-    listen 80;
+    listen 8071;
     server_name _;
 
     gzip on;
@@ -14,7 +14,7 @@ server {
     location /api/ {
         proxy_pass http://backend:8000;
         # $http_host keeps the client's port, which the backend's Origin check
-        # compares against; $host would drop ":8080" and reject real browsers.
+        # compares against; $host would drop the port and reject real browsers.
         proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

roles/trade_hub/files/trade-hub/podman-compose.yml

@@ -29,7 +29,7 @@ services:
     build: ./frontend
     image: localhost/sc-inventory-frontend:latest
     ports:
-      - "8080:80"
+      - "8071:8071"
     depends_on:
       - backend
     restart: unless-stopped

roles/trade_hub/tasks/main.yml

@@ -45,6 +45,13 @@
     state: directory
     mode: "0755"
 
+- name: Create the application source directories
+  ansible.builtin.file:
+    path: "{{ trade_hub_app_dir }}/{{ item }}"
+    state: directory
+    mode: "0755"
+  loop: "{{ trade_hub_app_subdirs }}"
+
 - name: Stage the application build context
   ansible.builtin.copy:
     src: "{{ role_path }}/files/trade-hub/{{ item.src }}"
@@ -144,6 +151,23 @@
     name: "{{ trade_hub_network }}"
     state: present
 
+- name: Check whether the shared proxy network exists
+  ansible.builtin.command: podman network exists npm_internal
+  register: trade_hub_npm_network_check
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Require the shared proxy network to exist
+  ansible.builtin.assert:
+    that:
+      - trade_hub_npm_network_check.rc == 0
+    fail_msg: >-
+      The npm_internal podman network does not exist on {{ inventory_hostname }}.
+      Run the network role first, e.g.
+      ansible-playbook -i inventory.ini ansible-playbook.yml --tags "network,trade_hub".
+    quiet: true
+
 - name: Create the PostgreSQL data volume
   containers.podman.podman_volume:
     name: "{{ trade_hub_volume }}"
@@ -192,9 +216,13 @@
     image: "{{ trade_hub_frontend_image }}:{{ trade_hub_image_tag }}"
     state: started
     recreate: "{{ trade_hub_recreate_containers | bool }}"
-    network: "{{ trade_hub_network }}"
+    # Keep sc-inventory for the "backend" DNS alias and join the shared proxy
+    # network with a fixed address so the proxy-manager upstream never changes.
+    network:
+      - "{{ trade_hub_network }}"
+      - "npm_internal:ip={{ trade_hub_frontend_ip }}"
     ports:
-      - "{{ trade_hub_frontend_bind }}:{{ trade_hub_frontend_port }}:80"
+      - "{{ trade_hub_frontend_bind }}:{{ trade_hub_frontend_port }}:{{ trade_hub_frontend_port }}"
     restart_policy: unless-stopped
   when: not ansible_check_mode