Https with unleash proxy

[LukMas]

Hi!

I've seen that GitLab has the option to use Feature Flag for the development. Since I was already interested to test this way of working, I've tried to use this functionality in our new vue application.

Using unleash in the background I've read the documents and I've installed the unleash proxy.

After some testing I've managed to handle the features from Gitlab and use them within the vue application.

But, all this actually works locally on my development machine.

How can I configure the unleash proxy to run with https? Or behind a proxy that offers a https connection? Actually I've found something sparse here and there, but it's not really clear how this should be configured.

Another question: should I run a proxy for every combination of application and environment? 10 applications, 2 environment each, 20 instances of the proxy? Have I understood it correctly?

Any help is appreciated. Thanks!

[FredrikOseberg]

@LukMas

Hello! It sounds to me like you should look into unleash edge. The proxy was created before we added environments as a first class citizen in unleash, and as a result you'll need to run one proxy per environment. Edge can handle any combination of environments and only requires you to run a single instance. There should also be some documentation here on how to setup the TLS cert with edge.

Let me know if that answers your question.

All the best,
Fredrik

[LukMas]

@FredrikOseberg
Hi!
It looks that I should have gave a read to the first section of the Doc of Unleash Proxy.
So, if it works in the same way as the Proxy, as it looks, I suppose I've to gave a try to it.

Edge can handle any combination of environments and only requires you to run a single instance.

But also any application, right? I mean: I configure the Edge to interact with an Unleash server, and it is sharp enough to manage any application/environment (as long the server handles them). Is this right?

Another question: is this compatible with the GitLab implementation or should I take into consideration a different service? I've read about the tokens, but I don't know what changes between them.

Thank you for your answer!

[FredrikOseberg]

@LukMas

Apologies, I did some digging and edge unfortunately does not support gitlab currently. We'd love to support it, but it's out of our hands. We need gitlab to make some changes on their side in order to make edge compatible.

Gitlab is currently on an old version of unleash that does not support environments in the way that Unleash currently deals with environments. In v4 of unleash we built environments into unleash and built them into our API keys so that the API key could be used to resolve which feature toggle configuration to retrieve from the API. Before we added this capability directly in unleash, this was solved by passing in the environment as part of the context and building custom strategies (see custom strategies configuration file config option) in order to determine the rules.

In unleash today, you configure a new environment within unleash itself and create an API key for this environment.

With gitlab, due to their implementation, you'll have to use the proxy and build these custom strategies in order to segregate on environment. As far as I know you don't need to make any configuration to the proxy per application with gitlab, the proxy will automatically serve all feature flags unless you specify the projectName property.

As for SSL, the proxy does not support this natively. But here are at least two options:

(A) Install the proxy as a package in your own javascript express application, setup SSL and mount the proxy endpoints on the existing app:

// something like this ish (not tested)

mport express from 'express';
import https from 'https';
import fs from 'fs';
import path from 'path';

// Your existing setup
import { config } from './config';

const app = express();

// Your existing middleware and routes here

// Read the certificate files
const privateKey = fs.readFileSync(path.join(__dirname, './certs/your-private-key.pem'), 'utf8');
const certificate = fs.readFileSync(path.join(__dirname, './certs/your-certificate.pem'), 'utf8');
const ca = fs.readFileSync(path.join(__dirname, './certs/your-ca.pem'), 'utf8');

const credentials = {
  key: privateKey,
  cert: certificate,
  ca: ca
};

// Create an HTTPS server
const httpsServer = https.createServer(credentials, app);

// Use this server instead of the regular app.listen
httpsServer.listen(config.port, () => {
  console.log(`HTTPS Server running on port ${config.port}`);
});

B)

Setup a reverse proxy that sets up SSL and redirects to your application. This option is useful if you have several services that uses the same certificate. Example config (not tested):

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate /etc/nginx/ssl/yourdomain.com.crt;
    ssl_certificate_key /etc/nginx/ssl/yourdomain.com.key;

    location / {
        proxy_pass http://localhost:3000; # or whatever your application's port is
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

[LukMas]

No worries.
I've tried to configure the Edge, but I was blocked because I've not found what should be used as key/token. Now I understand: the actual version of GitLab is not compatible, that's why I was not able to find/configure the parameters correctly.

From your answer I suppose that I can use the parameter UNLEASH_PROXY_CLIENT_KEYS (now I use UNLEASH_PROXY_SECRETS, but the other one should be used) to configure several keys, hence the proxy answers to several different applications.
I'll give a try, if it works I just have to update the single proxy instance each time we create a new repository (application).

Thank you for the time you've invested for this. I appreciate it.