refs #741 #742: reorganize repository by application

deploy/ai-web-agent-console/nginx/hmm-portal-auth.locations.conf

@@ -0,0 +1,41 @@
+location = /auth/check {
+    internal;
+    proxy_pass http://127.0.0.1:8621/auth/check;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    proxy_set_header Cookie $http_cookie;
+    proxy_set_header X-Real-IP $remote_addr;
+}
+
+location /auth/ {
+    proxy_pass http://127.0.0.1:8621;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
+location @hmm_portal_login {
+    return 302 /auth/login;
+}
+
+location / {
+    auth_request /auth/check;
+    error_page 401 = @hmm_portal_login;
+    auth_request_set $hmm_auth_user $upstream_http_x_auth_user;
+    auth_request_set $hmm_auth_expires $upstream_http_x_auth_expires;
+
+    proxy_pass http://127.0.0.1:8622;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-HMM-Authenticated-User $hmm_auth_user;
+    proxy_set_header X-HMM-Auth-Expires $hmm_auth_expires;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_read_timeout 300;
+    proxy_send_timeout 300;
+}

deploy/ai-web-agent-console/systemd/ai-web-agent-console-audit.conf

@@ -0,0 +1,2 @@
+[Service]
+EnvironmentFile=/etc/hmm-poc4-audit.env

deploy/ai-web-agent-console/systemd/hmm-portal-auth.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=HMM Portal HttpOnly Cookie Authentication
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=opc
+Group=opc
+WorkingDirectory=/opt/hmm-poc4
+Environment=PYTHONUNBUFFERED=1
+EnvironmentFile=/opt/hmm-poc4/.env
+ExecStart=/opt/hmm-poc4/.venv/bin/python -m ai_web_agent_console.auth_gateway
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+RestrictAddressFamilies=AF_INET AF_INET6
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target