added test env as a copy of staging but with flexible on (#3052)

* small changes to make demo/staging more alike, added test env as a copy of staging but with flexible on

* turn proxy on for demo

* turn redirects feature on for test and staging

* add test to deployable list

Author: orangewolf

.github/workflows/deploy.yaml

@@ -12,6 +12,7 @@ on:
           # - demo - pausing for accessibility testing
           - iiif
           - staging
+          - test
       debug_enabled:
         type: boolean
         description: "Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)"

ops/demo-deploy.tmpl.yaml

@@ -1,11 +1,13 @@
 replicaCount: 2
+
 resources:
   limits:
     memory: "4Gi"
     cpu: "1000m"
   requests:
     memory: "2Gi"
     cpu: "100m"
+
 livenessProbe:
   enabled: false
 readinessProbe:
@@ -193,6 +195,8 @@ extraEnvVars: &envVars
     value: $SOLR_ADMIN_PASSWORD
   - name: SOLR_COLLECTION_NAME
     value: hyku-demo
+  - name: SOLR_COLLECTION_REPLICAS
+    value: "2"
   - name: SOLR_CONFIGSET_NAME
     value: hyku-demo-2
   - name: SOLR_HOST
@@ -209,6 +213,7 @@ extraEnvVars: &envVars
     value: $SENTRY_ENVIRONMENT
   - name: VALKYRIE_TRANSITION
     value: "true"
+
 worker:
   resources:
     limits:
@@ -282,6 +287,123 @@ global:
   hyraxName: hyku-demo-hyrax
 
 nginx:
-  enabled: false
-  service:
-    port: 80
+  enabled: true
+  resources:
+    limits:
+      memory: "256Mi"
+      cpu: "100m"
+    requests:
+      memory: "128Mi"
+      cpu: "20m"
+  image:
+    registry: ghcr.io
+    repository: notch8/scripts/bitnamilegacy-nginx
+    tag: 1.21.6-debian-11-r21
+  serverBlock: |-
+    upstream rails_app {
+      server {{ .Values.global.hyraxName }};
+    }
+
+    map ${DOLLAR}status ${DOLLAR}loggable {
+        ~^444  0;
+        default 1;
+    }
+
+    log_format loki 'host=${DOLLAR}host ip=${DOLLAR}http_x_forwarded_for remote_user=${DOLLAR}remote_user [${DOLLAR}time_local] '
+                      'request="${DOLLAR}request" status=${DOLLAR}status bytes=${DOLLAR}body_bytes_sent '
+                      'referer="${DOLLAR}http_referer" agent="${DOLLAR}http_user_agent" request_time=${DOLLAR}request_time upstream_response_time=${DOLLAR}upstream_response_time upstream_response_length=${DOLLAR}upstream_response_length';
+
+    error_log  /opt/bitnami/nginx/logs/error.log warn;
+    #tcp_nopush     on;
+
+    # Cloudflare ips see for refresh
+    # https://support.cloudflare.com/hc/en-us/articles/200170786-Restoring-original-visitor-IPs-logging-visitor-IP-addresses
+    # update list https://www.cloudflare.com/ips/
+    set_real_ip_from 103.21.244.0/22;
+    set_real_ip_from 103.22.200.0/22;
+    set_real_ip_from 103.31.4.0/22;
+    set_real_ip_from 104.16.0.0/13;
+    set_real_ip_from 104.24.0.0/14;
+    set_real_ip_from 108.162.192.0/18;
+    set_real_ip_from 131.0.72.0/22;
+    set_real_ip_from 141.101.64.0/18;
+    set_real_ip_from 162.158.0.0/15;
+    set_real_ip_from 172.64.0.0/13;
+    set_real_ip_from 173.245.48.0/20;
+    set_real_ip_from 188.114.96.0/20;
+    set_real_ip_from 190.93.240.0/20;
+    set_real_ip_from 197.234.240.0/22;
+    set_real_ip_from 198.41.128.0/17;
+    set_real_ip_from 2400:cb00::/32;
+    set_real_ip_from 2606:4700::/32;
+    set_real_ip_from 2803:f800::/32;
+    set_real_ip_from 2405:b500::/32;
+    set_real_ip_from 2405:8100::/32;
+    set_real_ip_from 2a06:98c0::/29;
+    set_real_ip_from 2c0f:f248::/32;
+
+    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;
+    include /opt/bitnami/nginx/conf/conf.d/*.conf;
+    server {
+        listen 8080;
+        server_name _;
+        root /app/samvera/hyrax-webapp/public;
+        index index.html;
+
+        client_body_in_file_only clean;
+        client_body_buffer_size 32K;
+        client_max_body_size 0;
+        access_log /opt/bitnami/nginx/logs/access.log loki;
+        # if=${DOLLAR}loggable;
+
+        sendfile on;
+        send_timeout 300s;
+
+        include /opt/bitnami/nginx/conf/bots.d/ddos.conf;
+        include /opt/bitnami/nginx/conf/bots.d/blockbots.conf;
+
+        location ~ (\.php|\.aspx|\.asp) {
+        	return 404;
+        }
+
+        # deny requests for files that should never be accessed
+        location ~ /\. {
+          deny all;
+        }
+
+        location ~* ^.+\.(rb|log)${DOLLAR} {
+          deny all;
+        }
+
+        # serve static (compiled) assets directly if they exist (for rails production)
+        location ~ ^/(assets|packs|fonts|images|javascripts|stylesheets|swfs|system)/ {
+          try_files ${DOLLAR}uri @rails;
+
+          # access_log off;
+          gzip_static on; # to serve pre-gzipped version
+
+          expires max;
+          add_header Cache-Control public;
+
+          # Some browsers still send conditional-GET requests if there's a
+          # Last-Modified header or an ETag header even if they haven't
+          # reached the expiry date sent in the Expires header.
+          add_header Last-Modified "";
+          add_header ETag "";
+          break;
+        }
+
+        # send non-static file requests to the app server
+        location / {
+          try_files ${DOLLAR}uri @rails;
+        }
+
+        location @rails {
+          proxy_set_header  X-Real-IP  ${DOLLAR}remote_addr;
+          proxy_set_header  X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
+          proxy_set_header Host ${DOLLAR}http_host;
+          proxy_redirect off;
+          proxy_pass http://rails_app;
+        }
+    }

ops/staging-deploy.tmpl.yaml

@@ -89,8 +89,12 @@ extraEnvVars: &envVars
     value: "8080"
   - name: FCREPO_REST_PATH
     value: rest
+  - name: GOOGLE_ACCOUNT_JSON
+    value: $GOOGLE_ACCOUNT_JSON
   - name: GOOGLE_ANALYTICS_ID
     value: $GOOGLE_ANALYTICS_ID
+  - name: GOOGLE_ANALYTICS_PROPERTY_ID
+    value: $GOOGLE_ANALYTICS_PROPERTY_ID
   - name: GOOGLE_OAUTH_APP_NAME
     value: hyku-staging
   - name: GOOGLE_OAUTH_APP_VERSION
@@ -135,10 +139,18 @@ extraEnvVars: &envVars
     value: support@notch8.com
   - name: HYKU_FILE_ACL
     value: "false"
+  - name: HYRAX_ANALYTICS
+    value: "true"
+  - name: HYRAX_ANALYTICS_PROVIDER
+    value: "ga4"
+  - name: HYRAX_ANALYTICS_REPORTING
+    value: "true"
   - name: HYRAX_FITS_PATH
     value: /app/fits/fits.sh
   - name: HYRAX_FLEXIBLE
     value: "false"
+  - name: HYRAX_REDIRECTS_ENABLED
+    value: "true"
   - name: HYRAX_VALKYRIE
     value: "true"
   - name: HYKU_ADMIN_HOST
@@ -208,7 +220,7 @@ worker:
   resources:
     limits:
       memory: "4Gi"
-      cpu: "1000m"
+      cpu: "1250m"
     requests:
       memory: "2Gi"
       cpu: "100m"
@@ -233,6 +245,15 @@ leaseRelease:
 
 fcrepo:
   enabled: false
+fits:
+  enabled: true
+  resources:
+    limits:
+      memory: "2Gi"
+      cpu: "1000m"
+    requests:
+      memory: "1Gi"
+      cpu: "250m"
 postgresql:
   enabled: false
 redis:
@@ -248,6 +269,7 @@ redis:
   architecture: standalone
   auth:
     password: $REDIS_PASSWORD
+
 solr:
   enabled: false
 
@@ -263,15 +285,6 @@ externalSolrUser: admin
 externalSolrCollection: "hyku-staging"
 externalSolrPassword: $SOLR_ADMIN_PASSWORD
 
-fits:
-  enabled: true
-  resources:
-    limits:
-      memory: "2Gi"
-      cpu: "1000m"
-    requests:
-      memory: "1Gi"
-      cpu: "250m"
 global:
   hyraxName: hyku-staging-hyrax