Conversation
added 30 commits
May 4, 2026 12:58
Introduces platforms/ directory with per-platform manifests and per-environment config files (dev/qa/prd) for idegeo, sedema, and conafor. Adds .gitignore exception so platforms/*/env/*.env files are tracked. Includes PROPUESTA_MIGRACION.md explaining the multi-platform design to CentroGeo.
New usage: ./sigic_install.sh <platform> <environment> Reads platforms/<platform>/platform.json and env/<environment>.env, merges overrides with base flavor, and calls create-envfile.py. Original flavor mode (./sigic_install.sh <flavor> <https_mode>) unchanged.
These files contain auto-generated secrets and are regenerated on every install run, so they should not be tracked in version control.
- Add ports object to each platform.json (nginx, frontend_admin, frontend_app) - Make frontend container ports configurable in docker-compose.yml via env vars - Export COMPOSE_PROJECT_NAME and port vars in sigic_install.sh for container namespacing - Add MULTIPLATFORM.md with full documentation of changes and architecture - Add apache-vhosts-multiplatform.conf as reference config for infra team
- Update MULTIPLATFORM.md: correct Phase 2 description to reflect overlay mechanism via Docker BuildKit (no submodule forks needed); add scope table distinguishing config vs code differences per phase - Add PROXY_SETUP.md: step-by-step guide for Nginx system proxy setup on 10.2.102.228, including rationale for co-located proxy in dev/QA and why certbot is not needed on our server
- proxy/docker-compose.yml: nginx-proxy container (port 80/443) + certbot container (certbot profile, for prd only) - proxy/conf.d/00-default.conf: static default server block handling ACME challenge globally and dropping unknown hosts - docker-compose.platform.yml: compose override for platform mode — removes host port bindings from nginx/frontends, adds sigic-proxy network to nginx, adds extra_hosts to all application services so containers resolve the platform domain via host-gateway (hairpin fix) - sigic_install.sh: in platform mode, creates sigic-proxy network, generates proxy/conf.d/<platform>-<env>.conf dynamically (port 443 block added only when https_mode=externalhttps), writes PLATFORM_HOST to .env, uses docker-compose.platform.yml override, reloads proxy - platforms/idegeo/env/dev.env: update hostname to new subdomain pattern idegeo.geosuite-dev.centrogeo.org.mx confirmed with Mario - PROXY_ARCHITECTURE.md: full technical documentation of proxy design, hairpin DNS problem, SSL strategy per environment, and Jaime comparison
- sigic_install.sh: move --profile flag to correct position before
docker compose subcommand (was incorrectly placed after run)
- sigic_install.sh: replace hardcoded keycloak4sigic and django4sigic
with keycloak4${COMPOSE_PROJECT_NAME} and django4${COMPOSE_PROJECT_NAME}
so keycloak import and fixtures work correctly in platform mode
- docker-compose.platform.yml: remove ports:[] override — Docker Compose
concatenates port lists so empty list has no effect; platform nginx
keeps its host ports (8001/8002/8003) on the internal Nimbus network
- docker-compose.platform.yml: remove unnecessary default: network entry,
explicitly reference sigicnetwork to ensure correct merge with base
…onflicts In platform mode, service containers (nginx, frontends) don't need host port bindings — nginx-proxy reaches them via the sigic-proxy Docker network by container name. Exporting empty HTTP_PORT/HTTPS_PORT/FRONTEND_* and patching .env after generation ensures no conflict with nginx-proxy's ports 80/443, whether running through sigic_install.sh or docker compose directly. Also removes the ports block from platform.json since it is no longer needed.
**En docker-compose.yml: "${GEOSERVER_PORT:-8080}:8080" "${DB_PORT:-5432}:5432"
**En sigic_install.sh se agregan dos sed adicionales en el bloque de modo plataforma para vaciar DB_PORT y GEOSERVER_PORT.
En modo clásico los puertos siguen siendo 80, 443, 5432, 8080 (sin cambio de comportamiento). En modo plataforma quedan vacíos y Docker asigna puertos random sin conflictos.
- Cambia hostnames de dev y qa a patrón <plataforma>-<env>.geosuitemp.centrogeo.org.mx - Un solo wildcard *.geosuitemp.centrogeo.org.mx cubre todos los entornos - Elimina bloque ports de conafor y sedema platform.json (no necesario en modo proxy)
…con COMPOSE_PROJECT_NAME
…ntend a .env.sample
… de init-keycloak-db
…m-environment Para los cambios en sigic_install.sh — este es el cambio arquitectural que permite correr idegeo-dev e idegeo-qa simultáneamente.
… en runtime @nuxt/image requiere ipx como peer dependency pero Nitro no lo bundlea de forma confiable en builds frescos. El override elimina el npm run clean del build y agrega ipx explícitamente en la etapa final.
…nitro.baseURL se baja en tiempo de compilación; sin este arg el servidor Nitro queda montado en / y no reconoce las rutas /admin/ ni /app/. Imágenes separadas por servicio para evitar conflicto entre base paths
Los frontends no necesitan hairpin NAT , Mario está en IP interna(10.2.7.26) accesible directamente. El extra_hosts apuntaba a host-gateway:443 que no existe, rompiendo las conexiones OAuth a Keycloak.
…de @sidebase/nuxt-auth
En modo plataforma el servidor Nitro llamaba a la URL externa del admin
(/admin/api/auth/session) para verificar la sesión en SSR, lo cual pasaba
por nginx-proxy → nginx4idegeo-qa → mismo contenedor frontend → loop.
Esto causaba OOM (4GB heap en ~2 min).
Fix: NUXT_PUBLIC_AUTH_BASE_URL=http://localhost:3000/{admin|app}/api/auth
para que las llamadas de sesión SSR vayan directo al puerto 3000 del
mismo contenedor, sin pasar por nginx. NUXT_AUTH_ORIGIN se setea a
NGINX_BASE_URL (URL externa real) para que el redirect_uri enviado a
Keycloak sea correcto.
…tección de recursión SSR
NUXT_AUTH_ORIGIN=http://localhost:3000 hace que @sidebase/nuxt-auth detecte
recursión cuando el check de sesión llega desde localhost:3000 y responde con
{} vacío, lo que dispara un loop reactivo → OOM. Usando el nombre del servicio
Docker (frontend-admin / frontend-app) como host del baseURL, la petición llega
con Host distinto a localhost, la detección no dispara y la sesión se procesa
normalmente
Fix/e2 ac08 full setup suite
…different projects
…y getting default value
…incrementa timeout Keycloak 30 min, revert --ignore-scripts en build stage
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sube
client_max_body_sizede 100M a 500M enoverrides/nginx/z-frontend-app.confyoverrides/nginx/z-frontend-admin.conf, para permitir cargar archivos de hasta 500 MB enCatálogo > Carga de archivos.
Debe unirse junto con estas ramas (mismo ticket, otros repos)
Este cambio es solo la capa de nginx. Para que el límite de 500 MB funcione de punta a punta,
necesita desplegarse junto con:
geosuite-nuxt-frontend@feat/e1-ac02-validacion-limite-tamano-archivos(
LIMITE_CARGA_ARCHIVOS_MIB100 → 500)geosuite-geonode-wrapper@feat/e1-ac02-validacion-limite-back(
_MAX_FILE_SIZEensigic_data_importer/views.py, 50 MB → 500 MB)Sin esas dos ramas, subir a 500M aquí no tiene efecto completo (el frontend seguiría cortando en
100 MiB, o el backend de tabulares en 50 MB)