docker-compose.yml

secrets:
  owner_cert_password:
    file: ./secrets/owner_cert_password.txt
  secretary_cert_password:
    file: ./secrets/secretary_cert_password.txt
  client_truststore_password:
    file: ./secrets/client_truststore_password.txt
  # openai_api_key:
  #   file: ./secrets/openai_api_key.txt
  # google_client_id:
  #   file: ./secrets/google/client_id.txt
  # google_client_secret:
  #   file: ./secrets/google/client_secret.txt
  # orcid_client_id:
  #   file: ./secrets/orcid/client_id.txt
  # orcid_client_secret:
  #   file: ./secrets/orcid/client_secret.txt
  # credentials:
  #   file: ./secrets/credentials.trig
volumes:
  varnish_frontend_cache:
  varnish_end_user_cache:
services:
  nginx:
    image: nginx:1.31.1
    mem_limit: 128m
    configs:
      - source: nginx_conf
        target: /etc/nginx/nginx.conf
    depends_on:
      linkeddatahub:
        condition: service_healthy
    ports:
      - ${HTTP_PORT}:8080 # allow Tomcat to do HTTP to HTTPS redirect
      - ${HTTPS_PORT}:8443 # HTTPS
      - ${HTTPS_CLIENT_CERT_PORT:-5443}:9443 # HTTPS client cert
    volumes:
      - ./ssl/server:/etc/nginx/ssl:ro
  linkeddatahub:
    user: root # otherwise the ldh user does not have permissions to the mounted folder which is owner by root
    build: .
    mem_limit: 2048m
    depends_on:
      - fuseki
      - sef-compiler
      - egress
    environment:
    #  - JPDA_ADDRESS=*:8000 # debugger host - performance hit when enabled
      - CATALINA_OPTS=-XX:+UseContainerSupport -XX:MaxRAMPercentage=75 --add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED # heap will use up to 75% of container's RAM
      - TZ="Europe/Copenhagen"
      #- CATALINA_OPTS="-Duser.timezone=Europe/Copenhagen"
      - PROXY_HOST=nginx
      - PROXY_PORT=9443
      - FRONTEND_PROXY=http://varnish-frontend:6060/
      - BACKEND_PROXY_ADMIN=http://varnish-admin/
      - BACKEND_PROXY_END_USER=http://varnish-end-user/
      - PROTOCOL=${PROTOCOL}
      - HOST=${HOST}
      - HTTP_SCHEME=https
      - HTTP_PORT=7070
      - HTTP_PROXY_NAME=${HOST}
      - HTTP_PROXY_PORT=${HTTPS_PORT}
      - HTTP_REDIRECT_PORT=${HTTPS_PORT}
      - HTTPS_PROXY_PORT=${HTTPS_PORT}
      - HTTPS=false
      - SELF_SIGNED_CERT=true # only on localhost
      - SIGN_UP_CERT_VALIDITY=180
      - MAX_CONTENT_LENGTH=${MAX_CONTENT_LENGTH:-2097152}
      - MAX_UPLOAD_LENGTH=${MAX_UPLOAD_LENGTH:-} # file uploads (multipart bodies); MAX_CONTENT_LENGTH unless set
      - MAX_QUERY_RESPONSE_LENGTH=${MAX_QUERY_RESPONSE_LENGTH:-} # 5 MiB unless set (Application.DEFAULT_MAX_QUERY_RESPONSE_LENGTH)
      - ALLOW_INTERNAL_URLS=${ALLOW_INTERNAL_URLS:-}
      - ENABLE_SITEMAP=${ENABLE_SITEMAP:-} # opt-in: /sitemap.xml queries every public document of the dataspace
      - COMPOSE_PROFILES=${COMPOSE_PROFILES:-} # the "assistant" profile also makes the UI offer the assistant (entrypoint.sh)
      - EGRESS_PROXY=${EGRESS_PROXY:-egress:3128} # the platform's own SPARQL SERVICE (PATCH, imports) goes through egress too

      - CONNECTION_REQUEST_TIMEOUT=${CONNECTION_REQUEST_TIMEOUT:-}
      - NOTIFICATION_ADDRESS=LinkedDataHub <notifications@localhost>
      - MAIL_SMTP_HOST=email-server
      - MAIL_SMTP_PORT=25
      - MAIL_USER=linkeddatahub@localhost
      - PROXY_SECRET=${PROXY_SECRET:?set PROXY_SECRET in .env - make secrets generates it} # nginx sends it; Client-Cert is accepted only with it
      - REMOTE_IP_VALVE=true
      - REMOTE_IP_VALVE_PROTOCOL_HEADER=X-Forwarded-Proto
      - REMOTE_IP_VALVE_PORT_HEADER=X-Forwarded-Port
      - REMOTE_IP_VALVE_REMOTE_IP_HEADER=X-Forwarded-For
      - REMOTE_IP_VALVE_HOST_HEADER=X-Forwarded-Host
      - OWNER_MBOX=${OWNER_MBOX}
      #- OWNER_URI=${OWNER_URI}
      - OWNER_GIVEN_NAME=${OWNER_GIVEN_NAME}
      - OWNER_FAMILY_NAME=${OWNER_FAMILY_NAME}
      - OWNER_ORG_UNIT=${OWNER_ORG_UNIT}
      - OWNER_ORGANIZATION=${OWNER_ORGANIZATION}
      - OWNER_LOCALITY=${OWNER_LOCALITY}
      - OWNER_STATE_OR_PROVINCE=${OWNER_STATE_OR_PROVINCE}
      - OWNER_COUNTRY_NAME=${OWNER_COUNTRY_NAME}
    secrets:
      - owner_cert_password
      - secretary_cert_password
      - client_truststore_password
      # - google_client_id
      # - google_client_secret
      # - orcid_client_id
      # - orcid_client_secret
      # - credentials
    volumes:
      - /var/linkeddatahub/oidc
      - ./ssl/server:/var/linkeddatahub/ssl/server:ro
      - ./ssl/owner:/var/linkeddatahub/ssl/owner
      - ./ssl/secretary:/var/linkeddatahub/ssl/secretary
      - ./datasets/owner:/var/linkeddatahub/datasets/owner
      - ./datasets/secretary:/var/linkeddatahub/datasets/secretary
      - ./uploads:/var/www/linkeddatahub/uploads
      - ./sef:/var/www/linkeddatahub/sef
      - ./packages:/var/www/linkeddatahub/packages
      - ./settings:/var/www/linkeddatahub/settings
      - ./config/dev.log4j.properties:/usr/local/tomcat/webapps/ROOT/WEB-INF/classes/log4j.properties:ro
      - ./config/dataspaces.trig:/var/linkeddatahub/datasets/dataspaces.trig
      - ./config/system.trig:/var/linkeddatahub/datasets/system.trig
  sef-compiler:
    # composes each dataspace's client stylesheet with its package stylesheets and compiles
    # the result to a SEF. Built from the same Dockerfile as the platform, so its copy of the
    # static tree is the deployed one by construction
    build:
      context: .
      target: sef-compiler
    mem_limit: 3072m # the compile peaks around 1.5 GB; it must not share the platform's limit
    restart: on-failure
    expose:
      - 8080 # internal only - the platform is the sole client
  fuseki: # one server; every dataspace role is its own dataset in config/fuseki/config.ttl, stored under ./fuseki/<dataset>
    image: atomgraph/fuseki:6.1.0
    user: root # otherwise fuseki user does not have permissions to the mounted folder which is owner by root
    mem_limit: 4608m # the former fuseki-admin (1536m) and fuseki-end-user (3072m) combined
    restart: on-failure
    depends_on:
      - egress
    environment:
      - JAVA_OPTIONS=-Xmx2304m -Xms2304m # the former heaps combined: 768m admin + 1536m end-user
      # every outbound request (SPARQL SERVICE, LOAD) goes through egress, which only lets it reach public addresses.
      # JAVA_TOOL_OPTIONS rather than JAVA_OPTIONS, which an override setting the heap would replace. The empty
      # nonProxyHosts is load-bearing: by default the JVM bypasses the proxy for localhost, and
      # SERVICE <http://localhost:3030/other-dataset/> would read a sibling dataset in this same server.
      # ExitOnOutOfMemoryError: a query that exhausts the heap kills the JVM and restart: on-failure brings it back in
      # seconds - the query timeout bounds time, not memory, and a JVM past an OutOfMemoryError keeps running broken
      - JAVA_TOOL_OPTIONS=-Dhttp.proxyHost=${EGRESS_PROXY_HOST:-egress} -Dhttp.proxyPort=3128 -Dhttps.proxyHost=${EGRESS_PROXY_HOST:-egress} -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts= -XX:+ExitOnOutOfMemoryError
    expose:
      - 3030
    volumes:
      - ./config/fuseki/config.ttl:/fuseki/config.ttl:ro
      - ./fuseki:/fuseki/databases
    command: [ "--config", "/fuseki/config.ttl" ]
  egress: # forward proxy for the triplestores' outbound requests: refuses loopback, private and link-local destinations
    image: ubuntu/squid:6.6-24.04_beta
    mem_limit: 256m
    restart: on-failure
    configs:
      - source: egress_squid_conf
        target: /etc/squid/squid.conf
    expose:
      - 3128
  # runs Web-Algebra plans against this instance, and writes them from natural language for the assistant drawer.
  # Opt-in, since the image is distributed without its source: it starts only under the "assistant" profile
  # (COMPOSE_PROFILES=assistant in .env), which the platform reads too, so the UI offers it only then
  web-algebra:
    image: ghcr.io/atomgraph/webalgebra-server-ldh:${WEBALGEBRA_VERSION:-latest}
    profiles:
      - assistant
    mem_limit: 1024m
    restart: on-failure
    depends_on:
      - egress
    expose:
      - 8080 # internal only: nginx is the sole client, and the server trusts the Client-Cert header only because nginx sets it
    environment:
      # the origin that receives an identity - this instance, with every dataspace subdomain under it. Its public name is
      # not a route to it from inside the network, so requests for it go to nginx's client-cert listener under that name
      - WEBALGEBRA_TRUSTED_ORIGIN=${PROTOCOL}://${HOST}:${HTTPS_PORT}
      - WEBALGEBRA_PROXY_HOST=nginx
      - WEBALGEBRA_PROXY_PORT=9443
      # the secretary's WebID: the agent every user's WebID document already delegates (root-owner.trig.template, SignUp),
      # so a plan submitted by a user runs under that user's own access control, not the secretary's
      - WEBALGEBRA_KEYSTORE=/var/webalgebra/ssl/secretary/keystore.p12
      - WEBALGEBRA_KEYSTORE_PASSWORD_FILE=/run/secrets/secretary_cert_password
      - WEBALGEBRA_TRUSTSTORE=/var/webalgebra/ssl/server/server.crt # the self-signed server certificate, as PEM
      # the model key is optional, like the OAuth secrets: a deployment that writes plans declares the openai_api_key
      # secret and this variable in its override; without them the service runs plans and declines to write any
      # - OPENAI_API_KEY_FILE=/run/secrets/openai_api_key
      - OPENAI_MODEL=${OPENAI_MODEL:-gpt-4o}
      # public destinations (SPARQL endpoints a plan names, the model's API) go through egress like the platform's own; nginx
      # is reached directly, since egress refuses internal addresses
      - JAVA_TOOL_OPTIONS=-Dhttp.proxyHost=${EGRESS_PROXY_HOST:-egress} -Dhttp.proxyPort=3128 -Dhttps.proxyHost=${EGRESS_PROXY_HOST:-egress} -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts=nginx
    secrets:
      - secretary_cert_password
      # - openai_api_key
    volumes:
      - ./ssl/secretary:/var/webalgebra/ssl/secretary:ro
      - ./ssl/server:/var/webalgebra/ssl/server:ro
  varnish-frontend:
    image: varnish:7.7.3
    user: root # otherwise varnish user does not have permissions to the mounted folder which is owner by root
    configs:
      - source: varnish-frontend_vcl
        target: /etc/varnish/default.vcl
    depends_on:
      - linkeddatahub
    tmpfs: /var/lib/varnish/varnishd:exec
    volumes:
      - varnish_frontend_cache:/var/lib/varnish
    entrypoint: varnishd
    command: [ "-F", "-f", "/etc/varnish/default.vcl", "-a", "http=:6060,HTTP", "-a", "proxy=:8443,PROXY", "-p", "feature=+http2", "-s", "file,/var/lib/varnish/storage.bin,3G", "-t", "86400" ] # -F: foreground, -f: config, -a: listeners, -p: http2, -s: storage, -t: TTL
  varnish-admin:
    image: varnish:7.7.3
    user: root # otherwise the varnish user does not have permissions to the mounted folder which is owner by root
    configs:
      - source: varnish-admin_vcl
        target: /etc/varnish/default.vcl
    depends_on:
      - linkeddatahub
    tmpfs: /var/lib/varnish/varnishd:exec
    entrypoint: varnishd
    command: [ "-F", "-f", "/etc/varnish/default.vcl", "-a", "http=:80,HTTP", "-a", "proxy=:8443,PROXY", "-p", "feature=+http2", "-s", "main=malloc,1G", "-s", "sparql=malloc,${VARNISH_SPARQL_STORAGE:-64M}", "-t", "86400", "-p", "timeout_idle=60s" ] # -F: foreground, -f: config, -a: listeners, -p: http2 + idle timeout, -s: storage (main, and one for SPARQL results), -t: TTL
  varnish-end-user:
    image: varnish:7.7.3
    user: root # otherwise varnish user does not have permissions to the mounted folder which is owner by root
    configs:
      - source: varnish-end-user_vcl
        target: /etc/varnish/default.vcl
    depends_on:
      - linkeddatahub
    tmpfs: /var/lib/varnish/varnishd:exec
    volumes:
      - varnish_end_user_cache:/var/lib/varnish
    entrypoint: varnishd
    command: [ "-F", "-f", "/etc/varnish/default.vcl", "-a", "http=:80,HTTP", "-a", "proxy=:8443,PROXY", "-p", "feature=+http2", "-s", "main=file,/var/lib/varnish/storage.bin,3G", "-s", "sparql=malloc,${VARNISH_SPARQL_STORAGE:-64M}", "-t", "86400", "-p", "timeout_idle=60s" ] # -F: foreground, -f: config, -a: listeners, -p: http2 + idle timeout, -s: storage (main, and one for SPARQL results), -t: TTL
  email-server:
    image: namshi/smtp
    environment:
      - DISABLE_IPV6=true
configs:
  nginx_conf:
    content: |
      pid /tmp/nginx.pid;

      events { 
          worker_connections 1024;
      }

      http {
          upstream linkeddatahub {
              server ${NGINX_UPSTREAM_SERVER:-varnish-frontend:6060};
          }

          # Exempt internal requests from the linkeddatahub container from rate limiting
          # Use RFC 1918 private IP ranges (same logic as InetAddress.isSiteLocalAddress())
          map $$remote_addr $$limit_key {
              default $$binary_remote_addr;
              ~^10\.          "";  # RFC 1918: 10.0.0.0/8
              ~^172\.1[6-9]\. "";  # RFC 1918: 172.16.0.0/12 (172.16-19.x.x)
              ~^172\.2[0-9]\. "";  # RFC 1918: 172.16.0.0/12 (172.20-29.x.x)
              ~^172\.3[0-1]\. "";  # RFC 1918: 172.16.0.0/12 (172.30-31.x.x)
              ~^192\.168\.    "";  # RFC 1918: 192.168.0.0/16
          }

          # a page is many requests at once - up to ~175 on a rich one, 35-46 of them in its first second (measured on
          # linkeddata.lt and the Northwind demo) - so the burst is queued rather than refused: the first 60 pass straight
          # through, the rest are paced at the rate, and only a sustained flood past 200 is answered 429
          limit_req_zone $$limit_key zone=linked_data:10m rate=20r/s;
          limit_req_zone $$limit_key zone=static_files:10m rate=20r/s;
          limit_req_zone $$limit_key zone=web_algebra:10m rate=5r/s; # a plan is a model call; polling is what bursts
          limit_req_status 429;

          # SPARQL endpoints are capped by concurrency, not only by rate: a handful of heavy queries in flight at once is
          # what exhausts the store's heap, however slowly they arrive. The keys are set for an external client's
          # /sparql request only - every other path and every internal (RFC 1918) caller maps to "", which nginx does not
          # count - so the caps sit in the generic locations below without touching anything else
          map $$uri $$sparql_key {
              default "";
              /sparql $$limit_key;
          }
          # Two tiers, told apart by Sec-Fetch-Site. A browser sets it on every request and a page's script cannot (it is a
          # forbidden header), so "same-origin" is LinkedDataHub's own client rendering a page: a rich one sends up to ~55
          # queries, ~22 within a second and ~14 in flight. Everything else - scripts, other sites - is the external tier
          # and keeps the strict limits. A non-browser client can send the header and claim the UI tier, so the tier is not
          # a security boundary: the UI tier's total in flight is what bounds the store's load, sized so that ~50 visitors
          # loading pages at once fit (in flight ~ visitors x query seconds per page / seconds between page loads)
          map $$http_sec_fetch_site $$sparql_ui {
              same-origin 1;
              default 0;
          }
          map $$sparql_ui $$sparql_ui_key {
              1 $$sparql_key;
              default "";
          }
          map $$sparql_ui $$sparql_api_key {
              1 "";
              default $$sparql_key;
          }
          map $$sparql_ui_key $$sparql_ui_all {
              default sparql_ui;
              "" "";
          }
          map $$sparql_api_key $$sparql_all {
              default sparql;
              "" "";
          }
          limit_conn_zone $$sparql_ui_key zone=sparql_ui_per_client:10m;
          limit_conn_zone $$sparql_ui_all zone=sparql_ui_total:1m;
          limit_req_zone $$sparql_ui_key zone=sparql_ui:10m rate=${NGINX_SPARQL_UI_RATE:-10r/s};
          limit_conn_zone $$sparql_api_key zone=sparql_per_client:10m;
          limit_conn_zone $$sparql_all zone=sparql_total:1m;
          limit_req_zone $$sparql_api_key zone=sparql:10m rate=${NGINX_SPARQL_RATE:-2r/s};
          limit_conn_status 429;

          # the upload limit when one is set: the platform holds every other body to MAX_CONTENT_LENGTH itself
          client_max_body_size ${MAX_UPLOAD_LENGTH:-${MAX_CONTENT_LENGTH:-2097152}};

          # server with optional client cert authentication
          server {
              listen 8443 ssl;
              server_name *.${HOST} ${HOST};
              ssl_certificate /etc/nginx/ssl/server.crt;
              ssl_certificate_key /etc/nginx/ssl/server.key;
              ssl_session_cache shared:SSL:1m;
              ssl_prefer_server_ciphers on;
              ssl_verify_client ${NGINX_SSL_VERIFY_CLIENT:-optional_no_ca};

              # Identity and forwarding headers, set once for the whole server. proxy_set_header is inherited only by a location
              # that sets none of its own, so a location that sets any repeats this set. On-Behalf-Of is passed through: the
              # platform honours it only from an agent the named WebID delegates to. The platform accepts Client-Cert only on a
              # request carrying Proxy-Secret
              proxy_set_header Host $$host;
              proxy_set_header X-Forwarded-Host $$host;
              proxy_set_header X-Forwarded-Proto $$scheme;
              proxy_set_header X-Forwarded-Port ${HTTPS_PORT};
              proxy_set_header X-Forwarded-For $$remote_addr;
              proxy_set_header Client-Cert $$ssl_client_escaped_cert; # empty, and so not sent, without a client certificate
              proxy_set_header Proxy-Secret "${PROXY_SECRET:?set PROXY_SECRET in .env - make secrets generates it}";

              # the platform uses no path parameters (;)
              if ($$request_uri ~ "^[^?]*;") {
                  return 400;
              }

              # the assistant's plan service. A reserved path, like /static/ and /uploads/: prefix-matched ahead of the
              # generic location and never rewritten, so /webalgebra, /webalgebra/plans and /webalgebra/{id}/result reach the
              # sidecar as they are. Reachable only with a WebID certificate on the connection: the sidecar acts for the
              # WebID in the certificate nginx forwards, and a caller without one has nobody to act for. On-Behalf-Of is
              # cleared for the same reason Client-Cert is - identity comes from the connection, never from a header
              # The sidecar is opt-in (the "assistant" profile), so its name is resolved per request through Docker's DNS
              # rather than once at startup: without it nginx still starts, and this location answers 502
              location ^~ /webalgebra {
                  if ($$ssl_client_verify = NONE) {
                      return 401;
                  }

                  resolver 127.0.0.11 valid=30s ipv6=off;
                  set $$web_algebra http://web-algebra:8080;
                  proxy_pass $$web_algebra;
                  limit_req zone=web_algebra burst=10 nodelay;
                  proxy_read_timeout 120s; # writing a plan is a 10-30 s model call

                  # repeats the server-level set, since it also clears On-Behalf-Of. Proxy-Secret is for the platform only and
                  # is not sent to the sidecar
                  proxy_set_header Host $$host;
                  proxy_set_header X-Forwarded-Host $$host;
                  proxy_set_header X-Forwarded-Proto $$scheme;
                  proxy_set_header X-Forwarded-Port ${HTTPS_PORT};
                  proxy_set_header X-Forwarded-For $$remote_addr;
                  proxy_set_header Client-Cert $$ssl_client_escaped_cert;
                  proxy_set_header On-Behalf-Of '';
              }

              location / {
                  add_header Access-Control-Allow-Origin "*" always;
                  add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS" always;
                  add_header Access-Control-Allow-Headers "Accept, Content-Type, Authorization" always;
                  add_header Access-Control-Expose-Headers "Link, Content-Location, Location, Memento-Datetime" always;

                  if ($$request_method = OPTIONS) {
                      add_header Access-Control-Allow-Origin "*";
                      add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS";
                      add_header Access-Control-Allow-Headers "Accept, Content-Type, Authorization";
                      add_header Access-Control-Expose-Headers "Link, Content-Location, Location, Memento-Datetime";
                      add_header Access-Control-Max-Age "1728000";
                      return 204;
                  }

                  proxy_pass http://linkeddatahub;
                  #proxy_cache backcache;
                  limit_req zone=linked_data burst=200 delay=60;
                  limit_req zone=sparql_ui burst=60 delay=30;
                  limit_conn sparql_ui_per_client ${NGINX_SPARQL_UI_CONN_PER_CLIENT:-8};
                  limit_conn sparql_ui_total ${NGINX_SPARQL_UI_CONN_TOTAL:-32};
                  limit_req zone=sparql burst=10 nodelay;
                  limit_conn sparql_per_client ${NGINX_SPARQL_CONN_PER_CLIENT:-2};
                  limit_conn sparql_total ${NGINX_SPARQL_CONN_TOTAL:-8};
              }

              location ^~ /uploads/ {
                  gzip on;
                  gzip_proxied any;
                  gzip_types *;
                  gzip_min_length 1024;

                  proxy_pass http://linkeddatahub;
                  limit_req zone=static_files burst=20 nodelay;

                  add_header Cache-Control "private, max-age=604800, immutable"; # access-controlled: no shared cache may store it
              }

              location ^~ /static/ {
                  gzip on;
                  gzip_proxied any;
                  gzip_types *;
                  gzip_min_length 1024;

                  proxy_pass http://linkeddatahub;
                  limit_req zone=static_files burst=50 nodelay;

                  add_header Access-Control-Allow-Origin "*" always;
                  add_header Cache-Control "public, max-age=604800, immutable";
              }
          }

          # server with client cert authentication on
          server {
              listen 9443 ssl;
              server_name *.${HOST} ${HOST};
              ssl_certificate /etc/nginx/ssl/server.crt;
              ssl_certificate_key /etc/nginx/ssl/server.key;
              ssl_session_cache shared:SSL:1m;  
              ssl_prefer_server_ciphers on;
              ssl_verify_client optional_no_ca;

              # Identity and forwarding headers, set once for the whole server. proxy_set_header is inherited only by a location
              # that sets none of its own, so a location that sets any repeats this set. On-Behalf-Of is passed through: the
              # platform honours it only from an agent the named WebID delegates to. The platform accepts Client-Cert only on a
              # request carrying Proxy-Secret
              proxy_set_header Host $$host;
              proxy_set_header X-Forwarded-Host $$host;
              proxy_set_header X-Forwarded-Proto $$scheme;
              proxy_set_header X-Forwarded-Port ${HTTPS_PORT};
              proxy_set_header X-Forwarded-For $$remote_addr;
              proxy_set_header Client-Cert $$ssl_client_escaped_cert; # empty, and so not sent, without a client certificate
              proxy_set_header Proxy-Secret "${PROXY_SECRET:?set PROXY_SECRET in .env - make secrets generates it}";

              # the platform uses no path parameters (;)
              if ($$request_uri ~ "^[^?]*;") {
                  return 400;
              }

              location / {
                  add_header Access-Control-Allow-Origin "*" always;
                  add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS" always;
                  add_header Access-Control-Allow-Headers "Accept, Content-Type, Authorization" always;
                  add_header Access-Control-Expose-Headers "Link, Content-Location, Location, Memento-Datetime" always;

                  if ($$request_method = OPTIONS) {
                      add_header Access-Control-Allow-Origin "*";
                      add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS";
                      add_header Access-Control-Allow-Headers "Accept, Content-Type, Authorization";
                      add_header Access-Control-Expose-Headers "Link, Content-Location, Location, Memento-Datetime";
                      add_header Access-Control-Max-Age "1728000";
                      return 204;
                  }

                  proxy_pass http://linkeddatahub;
                  #proxy_cache backcache;
                  limit_req zone=linked_data burst=200 delay=60;
                  limit_req zone=sparql_ui burst=60 delay=30;
                  limit_conn sparql_ui_per_client ${NGINX_SPARQL_UI_CONN_PER_CLIENT:-8};
                  limit_conn sparql_ui_total ${NGINX_SPARQL_UI_CONN_TOTAL:-32};
                  limit_req zone=sparql burst=10 nodelay;
                  limit_conn sparql_per_client ${NGINX_SPARQL_CONN_PER_CLIENT:-2};
                  limit_conn sparql_total ${NGINX_SPARQL_CONN_TOTAL:-8};
              }

              location ^~ /static/ {
                  gzip on;
                  gzip_proxied any;
                  gzip_types *;
                  gzip_min_length 1024;

                  proxy_pass http://linkeddatahub;
                  limit_req zone=static_files burst=50 nodelay;

                  add_header Access-Control-Allow-Origin "*" always;
              }
          }

          server {
              listen 8080;
              server_name *.${HOST} ${HOST};
          
              location / {
                  return 301 https://$$server_name:${HTTPS_PORT}$$request_uri;
              }
          }

      }
  varnish-frontend_vcl:
    content: |
      vcl 4.0;

      import std;
      import bodyaccess;
      import xkey;

      backend default {
          .host = "${VARNISH_FRONTEND_BACKEND_HOST:-linkeddatahub}";
          .port = "${VARNISH_FRONTEND_BACKEND_PORT:-7070}";
          .first_byte_timeout = 60s;
      }

      acl local {
          "localhost";
          "linkeddatahub";
      }

      acl remote {
      }

      sub vcl_recv {
          if (req.method == "PURGE") {
              if (!client.ip ~ local && !client.ip ~ remote) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              return (purge);
          }

          # the platform tags responses with xkey (XkeyTaggingFilter: document, parent container, access-control scope) and
          # purges by those tags after a write (CacheInvalidationFilter, ClearOntology)
          if (req.method == "XKEY-PURGE") {
              if (!client.ip ~ local && !client.ip ~ remote) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              # hard purge: softpurge would keep serving the purged copy during grace
              set req.http.n-purged = xkey.purge(req.http.xkey-purge);
              return (synth(200, "Purged " + req.http.n-purged + " objects for key " + req.http.xkey-purge));
          }

          if (req.method != "GET" &&
            req.method != "HEAD" &&
            req.method != "PUT" &&
            req.method != "POST" &&
            req.method != "TRACE" &&
            req.method != "OPTIONS" &&
            req.method != "DELETE" &&
            req.method != "PATCH") {
              /* Non-RFC2616 or CONNECT which is weird. */
              return (pipe);
          }

          # Range is defined for GET only (RFC 9110 §14.2), and Varnish's own range code accepts one
          # well-formed "bytes" range and nothing else: on a pass it fails the fetch with 503 when the
          # forwarded Range is in another unit, lists several ranges, ends before it starts or is "-0", and
          # it answers a HEAD with Range as 206. RFC 9110 lets a server ignore any of those, so they are
          # dropped here and the whole representation is served.
          if (req.http.Range && (req.method != "GET" ||
            req.http.Range !~ "^(?i)bytes=([0-9]+-[0-9]*|-[0-9]+)\s*$" ||
            req.http.Range ~ "^(?i)bytes=-0+\s*$" ||
            (req.http.Range ~ "^(?i)bytes=[0-9]+-[0-9]+\s*$" &&
              std.integer(regsub(req.http.Range, "^(?i)bytes=([0-9]+)-.*$", "\1"), 0) >
              std.integer(regsub(req.http.Range, "^(?i)bytes=[0-9]+-([0-9]+)\s*$", "\1"), 0)))) {
              unset req.http.Range;
          }

          # Anonymous SPARQL queries are cached on their body. The platform's client POSTs every query (the
          # SPARQL 1.1 Protocol's "query via POST"), and a URL-keyed cache cannot tell two of those apart, so
          # without this every visitor's views reach the platform. Only reads are cached - a query body, never
          # an update - and only anonymous ones, for the same reason the GET branch below passes authenticated
          # requests: the response would carry the agent's identity. Bodies over 64 KB pass.
          if (req.method == "POST" && req.url ~ "^/(sparql|ns)(\?|$)" &&
            !req.http.Client-Cert && !req.http.On-Behalf-Of && req.http.Cookie !~ "LinkedDataHub\.id_token=" &&
            (req.http.Content-Type ~ "^application/sparql-query" || req.http.Content-Type ~ "^application/x-www-form-urlencoded")) {
              if (std.cache_req_body(64KB)) {
                  if (req.http.Content-Type ~ "^application/sparql-query" ||
                    (bodyaccess.rematch_req_body("(^|&)query=") == 1 && bodyaccess.rematch_req_body("(^|&)update=") == 0)) {
                      set req.http.X-SPARQL-Query = "cache";
                      unset req.http.Cookie;
                      return (hash);
                  }
              }
          }
          unset req.http.X-SPARQL-Query;

          # Only GET is cached. A HEAD passes as well: on a miss Varnish fetches a HEAD as a GET so it can
          # store the body, and the platform decides the two differently - a HEAD is granted to any agent
          # with a mode on the document (acl:Read or acl:Append, AuthorizationFilter), so a writer who may
          # not read can learn the entity tag its conditional write needs; a GET needs acl:Read. Fetched as
          # a GET, such a HEAD was refused with 403. A HEAD carries no body, so nothing worth caching is lost.
          if (req.method != "GET") {
              return (pass);
          }

          # Delegated requests carry user identity in the On-Behalf-Of header.
          # The backend response echoes that identity in the Link header
          # (acl#agent). The cache key does not include the asserted identity,
          # so caching would let a later anonymous request to the same
          # URL+Accept read back the previous agent's WebID and ACL grant.
          if (req.http.On-Behalf-Of) {
              return (pass);
          }

          # Authenticated responses get acl#agent stamped into the Link header by
          # the backend, regardless of representation (HTML, RDF/XML, Turtle,
          # JSON-LD, SPARQL results, …). The URL-keyed cache slot ignores the
          # asserting identity, so any such response would leak to anonymous
          # readers of the same URL. /static/* is the only safely-shared path —
          # it's served by Tomcat's default servlet (web.xml:365-371), bypasses
          # Jersey, and carries no identity-bearing headers.
          if (req.http.Client-Cert && req.url !~ "^/static/") {
              return (pass);
          }

          # the ID token cookie authenticates the request too
          if (req.http.Cookie ~ "LinkedDataHub\.id_token=" && req.url !~ "^/static/") {
              return (pass);
          }

          if (req.http.Cookie) {
              # explicitly allow only cookies required by LDH server-side
              set req.http.Cookie = ";" + req.http.Cookie;
              set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
              set req.http.Cookie = regsuball(req.http.Cookie, ";(LinkedDataHub\.state|LinkedDataHub\.id_token)=", "; \1=");
              set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
              set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");

              if (req.http.cookie ~ "^\s*$") {
                  unset req.http.cookie;
              }
          }

          return (hash);
      }

      sub vcl_hash {
          # a cached query is keyed on its body as well as the URL (and, through Vary, the Accept header)
          if (req.http.X-SPARQL-Query == "cache") {
              bodyaccess.hash_req_body();
          }
      }

      sub vcl_backend_fetch {
          # a cache miss is fetched as a GET unless told otherwise; the query is the POST's body
          if (bereq.http.X-SPARQL-Query == "cache") {
              set bereq.method = "POST";
          }
      }

      sub vcl_backend_response {
          if (bereq.http.X-SPARQL-Query == "cache") {
              # an error is not kept; a result is kept for an hour at most, and dropped by any write (below)
              if (beresp.status != 200) {
                  set beresp.uncacheable = true;
                  set beresp.ttl = 0s;
              } else {
                  set beresp.ttl = 1h;
                  set beresp.http.X-SPARQL-Query = "cached";
              }
              return (deliver);
          }

          /* Add Vary: Origin for static files to enable proper CORS caching */
          if (bereq.url ~ "^/static/") {
              if (beresp.http.Vary) {
                  set beresp.http.Vary = beresp.http.Vary + ", Origin";
              } else {
                  set beresp.http.Vary = "Origin";
              }
          }
          
          /* purge URLs after updates */
          if ((beresp.status == 200 || beresp.status == 201 || beresp.status == 204) && bereq.method ~ "POST|PUT|DELETE|PATCH") {
              set beresp.http.X-LinkedDataHub = "Banned";
              ban("req.url == " + bereq.url + " && req.http.host == " + bereq.http.host);
              # a write can change any query's result
              ban("obj.http.X-SPARQL-Query == cached");
          }

          /* NS (ontology) SPARQL queries from authenticated clients are cache-busted per-request with _nc;
             skip caching only for them (otherwise we'd both waste Varnish storage on one-shot entries
             and open a DDoS vector for anonymous traffic crafting unique URLs) */
          if (bereq.url ~ "^/ns\?" && bereq.http.Client-Cert) {
              set beresp.uncacheable = true;
              set beresp.ttl = 0s;
          }

          return (deliver);
      }

      sub vcl_deliver {
          unset resp.http.X-SPARQL-Query;
          unset resp.http.xkey; # the cache's index, not part of the representation
      }
  varnish-admin_vcl:
    content: |
      vcl 4.0;

      import std;
      import xkey;

      backend default {
          .host = "${VARNISH_ADMIN_BACKEND_HOST:-fuseki}";
          .port = "${VARNISH_ADMIN_BACKEND_PORT:-3030}";
          .first_byte_timeout = 60s;
      }

      acl local {
          "localhost";
          "linkeddatahub";
      }

      sub vcl_recv {
          if (req.method == "PURGE") {
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              return (purge);
          }

          if (req.method == "BAN") { # supports only 2 URIs!
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }

              set req.http.X-Escaped-Request-URI-1 = regsub(req.http.X-Escaped-Request-URI, ",.*$", ""); # remove header value after comma
              set req.http.X-Escaped-Request-URI-2 = regsub(req.http.X-Escaped-Request-URI, "^.*,", ""); # remove header value before comma
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-1);
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-2);
              return (synth(200, "Banned"));
          }

          if (req.method == "XKEY-PURGE") {
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              # hard purge, not softpurge: ClearOntology and CacheInvalidationFilter need strong
              # consistency, not stale-while-revalidate. Softpurge would serve the just-purged
              # object during beresp.grace (default 10s) and OntologyModelGetter's immediate reload
              # would repopulate OntDocumentManager with stale data.
              set req.http.n-purged = xkey.purge(req.http.xkey-purge);
              return (synth(200, "Purged " + req.http.n-purged + " objects for key " + req.http.xkey-purge));
          }

          if (req.method != "GET" &&
            req.method != "HEAD" &&
            req.method != "PUT" &&
            req.method != "POST" &&
            req.method != "TRACE" &&
            req.method != "OPTIONS" &&
            req.method != "DELETE" &&
            req.method != "PATCH") {
              /* Non-RFC2616 or CONNECT which is weird. */
              return (pipe);
          }

          if (req.method != "GET" && req.method != "HEAD") {
              /* We only deal with GET and HEAD by default */
              return (pass);
          }

          return (hash);
      }

      sub vcl_backend_response {
          /* purge URLs after updates */
          if ((beresp.status == 200 || beresp.status == 201 || beresp.status == 204) && bereq.method ~ "POST|PUT|DELETE|PATCH") {
              set beresp.http.X-LinkedDataHub = "Banned";
              ban("req.url == " + bereq.url + " && req.http.host == " + bereq.http.host);
              /* SPARQL query results depend on dataset state — any write invalidates every cached query. xkey below
                 covers only the responses LDH stamps (ontology CONSTRUCTs); a client SELECT carries no key, so
                 without this it keeps its pre-write answer for the whole 24h TTL. */
              ban("req.url ~ \?(query|default-graph-uri|named-graph-uri)=");
          }

          /* promote outbound surrogate-key hint from LDH into the indexed xkey header on the cached response */
          if (bereq.http.X-Xkey-Promote) {
              set beresp.http.xkey = bereq.http.X-Xkey-Promote;
          }

          /* SPARQL results get a store of their own, so a result too large for it ends the fetch there: a cached fetch runs
             on after its client has gone - the platform refusing an oversize result included - and would otherwise go on
             filling the main store while the triplestore keeps evaluating the query. Failing the fetch closes the backend
             connection, which is what makes the triplestore abandon the query. Everything else is sent to the main store by
             name: left unset, Varnish spreads objects across both stores in turn */
          if (bereq.url ~ "\?(query|default-graph-uri|named-graph-uri)=") {
              set beresp.storage = storage.sparql;
          } else {
              set beresp.storage = storage.main;
          }

          return (deliver);
      }
  varnish-end-user_vcl:
    content: |
      vcl 4.0;

      import std;

      backend default {
          .host = "${VARNISH_END_USER_BACKEND_HOST:-fuseki}";
          .port = "${VARNISH_END_USER_BACKEND_PORT:-3030}";
          .first_byte_timeout = 60s;
      }

      acl local {
          "localhost";
          "linkeddatahub";
      }

      sub vcl_recv {
          if (req.method == "PURGE") {
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }
              return (purge);
          }

          if (req.method == "BAN") { # supports only 2 URIs!
              if (!client.ip ~ local) {
                  return (synth(403, "Unknown IP address '" + client.ip + "'. Access denied."));
              }

              set req.http.X-Escaped-Request-URI-1 = regsub(req.http.X-Escaped-Request-URI, ",.*$", ""); # remove header value after comma
              set req.http.X-Escaped-Request-URI-2 = regsub(req.http.X-Escaped-Request-URI, "^.*,", ""); # remove header value before comma
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-1);
              ban("req.url ~ " + req.http.X-Escaped-Request-URI-2);
              return (synth(200, "Banned"));
          }

          if (req.method != "GET" &&
            req.method != "HEAD" &&
            req.method != "PUT" &&
            req.method != "POST" &&
            req.method != "TRACE" &&
            req.method != "OPTIONS" &&
            req.method != "DELETE" &&
            req.method != "PATCH") {
              /* Non-RFC2616 or CONNECT which is weird. */
              return (pipe);
          }

          if (req.method != "GET" && req.method != "HEAD") {
              /* We only deal with GET and HEAD by default */
              return (pass);
          }

          return (hash);
      }

      sub vcl_backend_response {
          /* purge URLs after updates */
          if ((beresp.status == 200 || beresp.status == 201 || beresp.status == 204) && bereq.method ~ "POST|PUT|DELETE|PATCH") {
              set beresp.http.X-LinkedDataHub = "Banned";
              ban("req.url == " + bereq.url + " && req.http.host == " + bereq.http.host);
              /* SPARQL query results depend on dataset state — any write invalidates every cached query. */
              ban("req.url ~ \?(query|default-graph-uri|named-graph-uri)=");
          }

          /* SPARQL results get a store of their own, so a result too large for it ends the fetch there: a cached fetch runs
             on after its client has gone - the platform refusing an oversize result included - and would otherwise go on
             filling the main store while the triplestore keeps evaluating the query. Failing the fetch closes the backend
             connection, which is what makes the triplestore abandon the query. Everything else is sent to the main store by
             name: left unset, Varnish spreads objects across both stores in turn */
          if (bereq.url ~ "\?(query|default-graph-uri|named-graph-uri)=") {
              set beresp.storage = storage.sparql;
          } else {
              set beresp.storage = storage.main;
          }

          return (deliver);
      }
  egress_squid_conf:
    content: |
      # The triplestores reach the outside world only through here, so a SPARQL SERVICE or LOAD can federate with public
      # endpoints but cannot reach this deployment's own services - the admin store, Varnish, the platform - or the
      # host's and cloud's internal addresses. dst resolves the host where the connection is made, so every redirect
      # hop and every DNS answer is checked, not just the IRI written in the query.
      http_port 3128

      acl internal dst 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 ::1 fc00::/7 fe80::/10
      http_access deny internal
      http_access allow all

      cache deny all