Merge pull request #1252 from GSA/maintenance-page

Maintenance page

Makefile

@@ -60,6 +60,8 @@ validate-proxy:
 	sed -i 's#{{env "S3_URL"}}#http://test.com#g' proxy/nginx-common.conf
 	sed -i 's#{{env "S3_BUCKET"}}#somebucket#g' proxy/nginx-common.conf
 	sed -i 's#{{env "DENY_PACKAGE_CREATE"}}#truetodeny#g' proxy/nginx-common.conf
+	sed -i 's#{{env "CATALOG_WEB_MODE"}}#webmaintenance#g' proxy/nginx.conf
+	sed -i 's#{{env "CATALOG_ADMIN_MODE"}}#adminmaintenance#g' proxy/nginx.conf
 	docker run --rm -e nameservers=127.0.0.1 -v $(shell pwd)/proxy:/proxy nginx nginx -t -c /proxy/nginx.conf
 	sed -i 's/127.0.0.1/{{nameservers}}/g' proxy/nginx.conf
 	sed -i 's/127.0.0.2/{{env "EXTERNAL_ROUTE"}}/g' proxy/nginx.conf proxy/nginx-cloudfront.conf
@@ -72,6 +74,8 @@ validate-proxy:
 	sed -i 's#http://test.com#{{env "S3_URL"}}#g' proxy/nginx-common.conf
 	sed -i 's#somebucket#{{env "S3_BUCKET"}}#g' proxy/nginx-common.conf
 	sed -i 's/truetodeny/{{env "DENY_PACKAGE_CREATE"}}/g' proxy/nginx-common.conf
+	sed -i 's/webmaintenance/{{env "CATALOG_WEB_MODE"}}/g' proxy/nginx.conf
+	sed -i 's/adminmaintenance/{{env "CATALOG_ADMIN_MODE"}}/g' proxy/nginx.conf
 
 quick-bat-test:
 	# if local environment is already build and running

README.md

@@ -241,3 +241,8 @@ You can log into your instance with you login.gov user.
 Continuous Integration via [GitHub Actions](https://github.com/GSA/catalog.data.gov/actions/workflows/commit.yml).
 
 Continuous Deployment via [GitHub Actions](https://github.com/GSA/catalog.data.gov/actions/workflows/publish.yml).
+
+
+## Put site into maintenance mode
+
+To block access to the catalog apps (`catalog-web`, `catalog-admin`), set the environment variables (`CATALOG_WEB_MODE`, `CATALOG_ADMIN_MODE`) in the `catalog-proxy` app. Use 'MAINTENANCE' for scheduled downtime, 'DOWN' for unscheduled downtime. Any other value will resume normal operation.

proxy/nginx-common.conf

@@ -76,10 +76,13 @@ location /sitemap {
   proxy_pass https://${s3_url}/${s3_bucket}$request_uri;
 }
 
-error_page 500 502 503 504 /500.html;
+proxy_intercept_errors on;
+error_page 500 502 504 /500.html;
 location = /500.html {
   root ./public;
 }
+# NGINX searches for a URI that starts with /static-assets/ in the ./public/static-assets/ directory
+location /static-assets/ {}
 
 # prevent users from accessing: '/dataset/new' route, 'package_create' and 'resource_create' API routes
 location ~ ^/(dataset\/new|api\/action\/package_create|api\/action\/resource_create)/?$ {
@@ -103,3 +106,4 @@ location /maptiles {
   proxy_redirect off;
   proxy_pass https://tile.openstreetmap.org/;
 }
+

proxy/nginx-maintenance.conf

@@ -0,0 +1,42 @@
+## This will put the site into maintenance mode depending on the environment variable.
+
+# $operation_mode is set from {{env "CATALOG_WEB_MODE"}} or {{env "CATALOG_ADMIN_MODE"}}
+# from previous nginx configuration
+# it is '' if the environment variable is not set
+set $takedown "0";
+if ($operation_mode = 'MAINTENANCE') {
+  set $takedown "1";
+}
+if ($operation_mode = 'DOWN') {
+  set $takedown "2";
+}
+# Allow access to the following paths
+if ($uri = "/api/action/status_show") {
+  set $takedown "0";
+}
+if ($uri = "/user/saml2login") {
+  set $takedown "0";
+}
+if ($uri ~* "/static-assets/") {
+  set $takedown "0";
+}
+
+if ($takedown != "0") {
+  return 503;
+}
+error_page 503 @maintenance;
+location @maintenance {
+  if ($takedown = "1") {
+    rewrite ^(.*)$ /maintenance.html break;
+  }
+  if ($takedown = "2") {
+    rewrite ^(.*)$ /sitedown.html break;
+  }
+  rewrite ^(.*)$ /500.html break;
+}
+location = /maintenance.html {
+  root ./public;
+}
+location = /sitedown.html {
+  root ./public;
+}

proxy/nginx.conf

@@ -41,6 +41,8 @@ http {
     include nginx-badbot403.conf;
     include nginx-goodbot200.conf;
     include nginx-common.conf;
+    set $operation_mode '{{env "CATALOG_WEB_MODE"}}';
+    include nginx-maintenance.conf;
   }
 
   server {
@@ -49,6 +51,8 @@ http {
 
     include nginx-authy.conf;
     include nginx-common.conf;
+    set $operation_mode '{{env "CATALOG_ADMIN_MODE"}}';
+    include nginx-maintenance.conf;
   }
 }