31 lines
1.4 KiB
TypeScript
31 lines
1.4 KiB
TypeScript
import 'reflect-metadata';
|
|
import { NestFactory } from '@nestjs/core';
|
|
import { ValidationPipe } from '@nestjs/common';
|
|
import { AppModule } from './app.module.js';
|
|
import { APP_ROOT } from './common/app-root.js';
|
|
|
|
// Ops Console API (Plan-13). Binds loopback by default and refuses a non-loopback
|
|
// bind under CASAN_PROFILE=prod / CASAN_CP_STRICT=1 unless an authenticated reverse
|
|
// proxy is explicitly configured to overwrite identity headers.
|
|
async function bootstrap() {
|
|
const app = await NestFactory.create(AppModule, { cors: true });
|
|
app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
|
|
|
|
const port = Number(process.env.CP_PORT ?? 3010);
|
|
let host = process.env.CP_BIND ?? '127.0.0.1';
|
|
const strict = process.env.CASAN_PROFILE === 'prod' || process.env.CASAN_CP_STRICT === '1';
|
|
const authProxy = process.env.CASAN_CP_TRUST_AUTH_PROXY === '1';
|
|
if (strict && host !== '127.0.0.1' && host !== 'localhost' && !authProxy) {
|
|
// The console must not expose telemetry/management off-loopback without TLS/OIDC
|
|
// at the reverse proxy, which must overwrite X-CASAN-* identity headers.
|
|
// eslint-disable-next-line no-console
|
|
console.error(`CP_REFUSE_NONLOOPBACK host=${host} (set up TLS/OIDC per Plan-13 Track 4 first)`);
|
|
process.exit(2);
|
|
}
|
|
|
|
await app.listen(port, host);
|
|
// eslint-disable-next-line no-console
|
|
console.log(`CASAN Ops Console API http://${host}:${port}/api/v1 app_root=${APP_ROOT}`);
|
|
}
|
|
bootstrap();
|