proxy api through web hostname

apps/web/server.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""Same-origin static web server with a narrow internal API reverse proxy."""
+from __future__ import annotations
+
+import http.client
+import os
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+from urllib.parse import urlsplit
+
+MAX_PROXY_BODY = 5 * 1024 * 1024
+UPSTREAM_HOST = os.environ.get("API_UPSTREAM_HOST", "api")
+UPSTREAM_PORT = int(os.environ.get("API_UPSTREAM_PORT", "8000"))
+
+
+class ProxyStaticHandler(SimpleHTTPRequestHandler):
+    proxy_api = True
+
+    def _proxy_request(self) -> None:
+        parsed = urlsplit(self.path)
+        if parsed.path == "/api" or parsed.path.startswith("/api/"):
+            target = self.path
+        else:
+            self.send_error(404)
+            return
+        try:
+            length = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            self.send_error(400, "invalid content length")
+            return
+        if length > MAX_PROXY_BODY:
+            self.send_error(413, "request body too large")
+            return
+        body = self.rfile.read(length) if length else None
+        headers = {
+            key: value
+            for key, value in self.headers.items()
+            if key.lower() in {"accept", "content-type", "cookie", "user-agent", "x-request-id"}
+        }
+        headers["Host"] = f"{UPSTREAM_HOST}:{UPSTREAM_PORT}"
+        connection = http.client.HTTPConnection(UPSTREAM_HOST, UPSTREAM_PORT, timeout=15)
+        try:
+            connection.request(self.command, target, body=body, headers=headers)
+            response = connection.getresponse()
+            payload = response.read(MAX_PROXY_BODY + 1)
+            if len(payload) > MAX_PROXY_BODY:
+                self.send_error(502, "upstream response too large")
+                return
+            self.send_response(response.status, response.reason)
+            for key, value in response.getheaders():
+                if key.lower() in {"content-type", "content-length", "cache-control", "location", "set-cookie"}:
+                    self.send_header(key, value)
+            self.end_headers()
+            self.wfile.write(payload)
+        except (OSError, http.client.HTTPException) as exc:
+            self.send_error(502, f"api upstream unavailable: {exc}")
+        finally:
+            connection.close()
+
+    def do_GET(self):
+        if self.path.startswith("/api"):
+            return self._proxy_request()
+        return super().do_GET()
+
+    def do_POST(self):
+        if self.path.startswith("/api"):
+            return self._proxy_request()
+        return self.send_error(405)
+
+    def do_PATCH(self):
+        if self.path.startswith("/api"):
+            return self._proxy_request()
+        return self.send_error(405)
+
+    def do_DELETE(self):
+        if self.path.startswith("/api"):
+            return self._proxy_request()
+        return self.send_error(405)
+
+    def do_OPTIONS(self):
+        if self.path.startswith("/api"):
+            return self._proxy_request()
+        return super().do_OPTIONS()
+
+    def log_message(self, format, *args):
+        # Keep request logs useful without echoing cookies or bodies.
+        super().log_message(format, *args)
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("WEB_PORT", "8080"))
+    server = ThreadingHTTPServer(("0.0.0.0", port), ProxyStaticHandler)
+    print(f"ProspectOS web server listening on http://0.0.0.0:{port}", flush=True)
+    server.serve_forever()