nginz cannon additional cors domains (multi-domain backend)

[supersven]

We're adding CORS headers with nginx rules. This PR extends the map rule for CORS headers to support multi domain (multi-ingress) configurations.

Rendered for nginz:

map $http_origin $cors_header {                                                                      
    default "";                                                                                      
    "https://webapp.mobtown-test.mobtown.wire.link" "$http_origin";                                    
    "https://webapp.red.mobtown.wire.link" "$http_origin";                                             
    "https://webapp.green.mobtown.wire.link" "$http_origin";                                           
    "https://webapp.blue.mobtown.wire.link" "$http_origin";                                            
    "https://webapp.ernie.mobtown.wire.systems" "$http_origin";                                        
    "https://webapp.bert.mobtown.wire.systems" "$http_origin";                                         
    "https://webapp.kermit.mobtown.wire.systems" "$http_origin";                                       

    "https://teams.mobtown-test.mobtown.wire.link" "$http_origin";                                     
    "https://teams.red.mobtown.wire.link" "$http_origin";                                              
    "https://teams.green.mobtown.wire.link" "$http_origin";                                            
    "https://teams.blue.mobtown.wire.link" "$http_origin";                                             
    "https://teams.ernie.mobtown.wire.systems" "$http_origin";                                         
    "https://teams.bert.mobtown.wire.systems" "$http_origin";                                          
    "https://teams.kermit.mobtown.wire.systems" "$http_origin";                                        

    "https://account.mobtown-test.mobtown.wire.link" "$http_origin";                                   
    "https://account.red.mobtown.wire.link" "$http_origin";                                            
    "https://account.green.mobtown.wire.link" "$http_origin";                                          
    "https://account.blue.mobtown.wire.link" "$http_origin";                                           
    "https://account.ernie.mobtown.wire.systems" "$http_origin";                                       
    "https://account.bert.mobtown.wire.systems" "$http_origin";                                        
    "https://account.kermit.mobtown.wire.systems" "$http_origin";                                      



    # Allow additional origins at random ports. This is useful for testing with an HTTP proxy.         
    # It should not be used in production.                                                             
} 

Rendered for cannon:

map $http_origin $cors_header {                                                                      
    default "";                                                                                      
    "https://webapp." "$http_origin";                                                                  
    "https://webapp.red.mobtown.wire.link" "$http_origin";                                             
    "https://webapp.green.mobtown.wire.link" "$http_origin";                                           
    "https://webapp.blue.mobtown.wire.link" "$http_origin";                                            
    "https://webapp.ernie.mobtown.wire.systems" "$http_origin";                                        
    "https://webapp.bert.mobtown.wire.systems" "$http_origin";                                         
    "https://webapp.kermit.mobtown.wire.systems" "$http_origin";                                       

    "https://teams." "$http_origin";                                                                   
    "https://teams.red.mobtown.wire.link" "$http_origin";                                              
    "https://teams.green.mobtown.wire.link" "$http_origin";                                            
    "https://teams.blue.mobtown.wire.link" "$http_origin";                                             
    "https://teams.ernie.mobtown.wire.systems" "$http_origin";                                         
    "https://teams.bert.mobtown.wire.systems" "$http_origin";                                          
    "https://teams.kermit.mobtown.wire.systems" "$http_origin";                                        

    "https://account." "$http_origin";                                                                 
    "https://account.red.mobtown.wire.link" "$http_origin";                                            
    "https://account.green.mobtown.wire.link" "$http_origin";                                          
    "https://account.blue.mobtown.wire.link" "$http_origin";                                           
    "https://account.ernie.mobtown.wire.systems" "$http_origin";                                       
    "https://account.bert.mobtown.wire.systems" "$http_origin";                                        
    "https://account.kermit.mobtown.wire.systems" "$http_origin";                                      



    # Allow additional origins at random ports. This is useful for testing with an HTTP proxy.         
    # It should not be used in production.                                                             

}                                                                                                   

Jira Issue: WPB-1137

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[jschaul]

Looks fine; can you test once that, if additional_external_env_domains is empty, that there is no difference to before?

[supersven]

Looks fine; can you test once that, if additional_external_env_domains is empty, that there is no difference to before?

Yes, sure.

[supersven]

@jschaul , the default case (additional_external_env_domains not set):

map $http_origin $cors_header {                                                                      
    default "";                                                                                      
    "https://webapp.sven-test.wire.link" "$http_origin";                                               

    "https://teams.sven-test.wire.link" "$http_origin";                                                

    "https://account.sven-test.wire.link" "$http_origin";                                              



    # Allow additional origins at random ports. This is useful for testing with an HTTP proxy.         
    # It should not be used in production.                                                             

}                                                                                                   

I did this on sven-test as multi-ingress stuff isn't (and hasn't been) configured on this env.

[supersven]

Now, that I see this in comparison: "https://account." "$http_origin"; looks strange. Will check and investigate.

[supersven]

Now, that I see this in comparison: "https://account." "$http_origin"; looks strange. Will check and investigate.

That was a red herring 🐟 . The staging config renders like

map $http_origin $cors_header {                                                                                                                                                                                 
    default "";                                                                                                                                                                                                 

    "https://wire-teams-staging." "$http_origin";                                                                                                                                                               

    "https://wire-teams-dev." "$http_origin";                                                                                                                                                                   

    "https://wire-teams-ey." "$http_origin";                                                                                                                                                                    

    "https://wire-account-staging." "$http_origin";                                                                                                                                                             

    "https://wire-webapp-edge." "$http_origin";                                                                                                                                                                 

    "https://wire-webapp-master." "$http_origin";                                                                                                                                                               

    "https://wire-webapp-mls." "$http_origin";                                                                                                                                                                  

    "https://wire-webapp-dev." "$http_origin";                                                                                                                                                                  

    "https://wire-webapp-qa." "$http_origin";                                                                                                                                                                   

    "https://wire-calling-testtool-staging." "$http_origin";                                                                                                                                                    

    "https://secure-alert-console.integrations." "$http_origin";                                                                                                                                                

    "https://wire-ealarming-staging." "$http_origin";                                                                                                                                                           

    "https://outlook.integrations." "$http_origin";                                                                                                                                                             


    # Allow additional origins at random ports. This is useful for testing with an HTTP proxy.                                                                                                                    
    # It should not be used in production.                                                                                                                                                                        

    "~^https?://localhost(:[0-9]{2,5})?$" "$http_origin";                                                                                                                                                       

    "~^https?://local.zinfra.io(:[0-9]{2,5})?$" "$http_origin";                                                                                                                                                 

}