julien/apf_portal
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat(infra): single-file toggle between apps-profile dev modes #265

Merged
julien merged 1 commits from feat/compose-mode-switching into main 2026-06-02 01:32:36 +02:00
Conversation 0 Commits 1 Files Changed 4
+83 -31
julien commented 2026-06-02 01:32:20 +02:00
Owner
Copy Link
Copy Source

Summary

Make the toggle between the two apps-profile access modes — localhost (VSCode Remote-SSH port forwarding) and HTTPS hostname (apf-portal.dev-XX.local via the mkcert team CA) — a single-file edit in infra/local/.env. Today the switch needs touching two files (the BFF's own .env for the four ENTRA_*_REDIRECT_URI, plus infra/local/.env for NX_SERVE_CONFIGURATION), with the extra cost that the BFF .env then carries mode-specific values and can drift from the localhost-friendly defaults that native nx serve (no Docker) expects.

After this PR:

  • apps/portal-bff/.env stays at localhost defaults always — native nx serve works untouched, no mode-aware editing of secrets-bearing files.
  • infra/local/.env is the only file a developer touches to flip between modes. Mode A is the default. Mode B is a five-line block to uncomment.

How

The four ENTRA_*_REDIRECT_URI values are added to the portal-bff service's environment: block in dev.compose.yml with Compose interpolation that defaults to localhost and accepts overrides from infra/local/.env:

ENTRA_REDIRECT_URI: ${ENTRA_REDIRECT_URI:-http://localhost:3000/api/auth/callback}
ENTRA_POST_LOGOUT_REDIRECT_URI: ${ENTRA_POST_LOGOUT_REDIRECT_URI:-http://localhost:4200/}
ENTRA_ADMIN_REDIRECT_URI: ${ENTRA_ADMIN_REDIRECT_URI:-http://localhost:3000/api/admin/auth/callback}
ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI: ${ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI:-http://localhost:4300/}

Compose's environment: block wins over env_file:, so the BFF inside the container always sees these — localhost when nothing is set in infra/local/.env, the HTTPS hostname values when Mode B is enabled. The BFF's own .env is irrelevant to the container's redirect URIs in either mode; it remains the canonical source for localhost-friendly defaults that native nx serve (running outside Docker) reads as before.

What lands

File Change
infra/local/dev.compose.yml Four ENTRA_*_REDIRECT_URI lines added to the portal-bff service's environment: block with ${VAR:-localhost-default} interpolation. Inline comment explains the mode-toggle intent and points at infra/README.md.
infra/local/.env.example The end-of-file "Apps" block is restructured into two clearly labelled profiles: Mode A — Localhost (DEFAULT) (an empty block — nothing to set) and Mode B — HTTPS hostname (a commented five-line template the developer uncomments).
apps/portal-bff/.env.example Comment block above the redirect-URI defaults updated: instead of telling the developer to override these values here, it now explains they stay at localhost regardless and points at the compose-level override in infra/local/.env.
infra/README.md New "Switching between dev modes — localhost vs hostname" subsection between "Dockerised app dev mode" and "HTTPS dev-server setup". Comparison table + step-by-step for Mode A + pointer to the HTTPS / mkcert subsections that follow for Mode B.

Test plan

  • Compose validates with no env overrides — the four ENTRA_*_REDIRECT_URI resolve to their localhost defaults (Mode A).
  • Compose validates with the four ENTRA_* plus NX_SERVE_CONFIGURATION=https set in the environment — the URIs resolve to the HTTPS hostname values (Mode B).
  • On vm-jg: starting from a fresh checkout, leave infra/local/.env at its .env.example defaults. ./infra/local/dev.sh up apps. Open http://localhost:4200/ via VSCode Remote-SSH port forwarding. Login succeeds — the BFF receives ENTRA_REDIRECT_URI=http://localhost:3000/api/auth/callback.
  • On vm-jg: uncomment the five Mode B lines in infra/local/.env (replacing dev-jg with the actual hostname). ./infra/local/dev.sh down && up apps. Open https://apf-portal.dev-jg.local:4200/. Login succeeds against the HTTPS URIs.
  • Native WSL nx serve (no Docker): unchanged — keeps reading apps/portal-bff/.env's localhost defaults; the compose override never runs in this path.

Related

  • ADR-0030 — dockerised dev mode this finishes for the toggle-between-modes case.
  • PR #263 (feat(spa): opt-in 'https' nx serve config) — provides the SPA-side TLS plumbing the Mode B switch enables.
  • PR #264 (docs(infra): document team mkcert CA on vm-gitlab) — documents the trust root that Mode B relies on.
## Summary Make the toggle between the two `apps`-profile access modes — `localhost` (VSCode Remote-SSH port forwarding) and HTTPS hostname (`apf-portal.dev-XX.local` via the mkcert team CA) — a **single-file edit** in `infra/local/.env`. Today the switch needs touching two files (the BFF's own `.env` for the four `ENTRA_*_REDIRECT_URI`, plus `infra/local/.env` for `NX_SERVE_CONFIGURATION`), with the extra cost that the BFF `.env` then carries mode-specific values and can drift from the `localhost`-friendly defaults that native `nx serve` (no Docker) expects. After this PR: - `apps/portal-bff/.env` stays at `localhost` defaults always — native `nx serve` works untouched, no mode-aware editing of secrets-bearing files. - `infra/local/.env` is the **only** file a developer touches to flip between modes. Mode A is the default. Mode B is a five-line block to uncomment. ## How The four `ENTRA_*_REDIRECT_URI` values are added to the `portal-bff` service's `environment:` block in `dev.compose.yml` with Compose interpolation that defaults to `localhost` and accepts overrides from `infra/local/.env`: ```yaml ENTRA_REDIRECT_URI: ${ENTRA_REDIRECT_URI:-http://localhost:3000/api/auth/callback} ENTRA_POST_LOGOUT_REDIRECT_URI: ${ENTRA_POST_LOGOUT_REDIRECT_URI:-http://localhost:4200/} ENTRA_ADMIN_REDIRECT_URI: ${ENTRA_ADMIN_REDIRECT_URI:-http://localhost:3000/api/admin/auth/callback} ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI: ${ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI:-http://localhost:4300/} ``` Compose's `environment:` block wins over `env_file:`, so the BFF inside the container always sees these — `localhost` when nothing is set in `infra/local/.env`, the HTTPS hostname values when Mode B is enabled. The BFF's own `.env` is irrelevant to the container's redirect URIs in either mode; it remains the canonical source for `localhost`-friendly defaults that native `nx serve` (running outside Docker) reads as before. ## What lands | File | Change | | --- | --- | | `infra/local/dev.compose.yml` | Four `ENTRA_*_REDIRECT_URI` lines added to the `portal-bff` service's `environment:` block with `${VAR:-localhost-default}` interpolation. Inline comment explains the mode-toggle intent and points at `infra/README.md`. | | `infra/local/.env.example` | The end-of-file "Apps" block is restructured into two clearly labelled profiles: **Mode A — Localhost (DEFAULT)** (an empty block — nothing to set) and **Mode B — HTTPS hostname** (a commented five-line template the developer uncomments). | | `apps/portal-bff/.env.example` | Comment block above the redirect-URI defaults updated: instead of telling the developer to override these values here, it now explains they stay at `localhost` regardless and points at the compose-level override in `infra/local/.env`. | | `infra/README.md` | New "**Switching between dev modes — `localhost` vs hostname**" subsection between "Dockerised app dev mode" and "HTTPS dev-server setup". Comparison table + step-by-step for Mode A + pointer to the HTTPS / mkcert subsections that follow for Mode B. | ## Test plan - [x] Compose validates with no env overrides — the four `ENTRA_*_REDIRECT_URI` resolve to their `localhost` defaults (Mode A). - [x] Compose validates with the four `ENTRA_*` plus `NX_SERVE_CONFIGURATION=https` set in the environment — the URIs resolve to the HTTPS hostname values (Mode B). - [ ] **On vm-jg**: starting from a fresh checkout, leave `infra/local/.env` at its `.env.example` defaults. `./infra/local/dev.sh up apps`. Open `http://localhost:4200/` via VSCode Remote-SSH port forwarding. Login succeeds — the BFF receives `ENTRA_REDIRECT_URI=http://localhost:3000/api/auth/callback`. - [ ] **On vm-jg**: uncomment the five Mode B lines in `infra/local/.env` (replacing `dev-jg` with the actual hostname). `./infra/local/dev.sh down && up apps`. Open `https://apf-portal.dev-jg.local:4200/`. Login succeeds against the HTTPS URIs. - [ ] **Native WSL `nx serve`** (no Docker): unchanged — keeps reading `apps/portal-bff/.env`'s `localhost` defaults; the compose override never runs in this path. ## Related - [ADR-0030](docs/decisions/0030-dockerised-dev-mode.md) — dockerised dev mode this finishes for the toggle-between-modes case. - PR #263 (`feat(spa): opt-in 'https' nx serve config`) — provides the SPA-side TLS plumbing the Mode B switch enables. - PR #264 (`docs(infra): document team mkcert CA on vm-gitlab`) — documents the trust root that Mode B relies on.
julien added 1 commit 2026-06-02 01:32:20 +02:00
feat(infra): single-file toggle between apps-profile dev modes
CI / scan (pull_request) Failing after 2m43s
Details
CI / commits (pull_request) Successful in 2m52s
Details
CI / check (pull_request) Successful in 3m3s
Details
CI / a11y (pull_request) Successful in 1m51s
Details
CI / perf (pull_request) Failing after 18m35s
Details
7aa2683750 
Reduce the apps-profile mode switch (localhost / VSCode tunnel vs
HTTPS hostname) to a single file: infra/local/.env. Today the
toggle requires editing both apps/portal-bff/.env (the four
ENTRA_*_REDIRECT_URI) and infra/local/.env (NX_SERVE_CONFIGURATION).
After this PR, apps/portal-bff/.env stays at its localhost defaults
regardless — native nx serve outside Docker keeps working untouched
— and infra/local/.env carries the entire mode-specific block.

- dev.compose.yml portal-bff service: the four ENTRA_*_REDIRECT_URI
  are added to the environment: block with
  ${VAR:-localhost-default} interpolation. Compose's environment:
  wins over env_file:, so the BFF inside the container sees the
  override when set and the localhost default otherwise.
- infra/local/.env.example: the trailing Apps block is restructured
  as two clearly-labelled profiles (Mode A — Localhost / DEFAULT;
  Mode B — HTTPS hostname, commented template).
- apps/portal-bff/.env.example: comment block above the redirect URI
  defaults now explains that they stay at localhost regardless and
  points at the compose-level override in infra/local/.env.
- infra/README.md: new "Switching between dev modes — localhost vs
  hostname" subsection between "Dockerised app dev mode" and
  "HTTPS dev-server setup" with a comparison table and per-mode
  step-by-step.
julien merged commit b427576d5e into main 2026-06-02 01:32:36 +02:00
julien deleted branch feat/compose-mode-switching 2026-06-02 01:32:38 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adastra-bot (AdAstra Bot) julien (Julien Gautier)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: julien/apf_portal#265
Delete Branch "feat/compose-mode-switching"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?