NAV Unleash

Simple Unleash v5 server with Google IAP authentication. Built to work well with Unleasherator our Kubernetes operator for managing Unleash instances.

sequenceDiagram
    participant User
    participant Google IAP
    participant Google Auth
    participant Unleash

    autonumber

    User->>Google IAP: request
    alt is not authenticated
        Google IAP->>Google Auth: Redirect to login
        Google Auth->>Google IAP: Redirect to callback
    end

    alt is not authorized
        Google IAP->>User: 403
    end

    Google IAP->>Unleash: request
    Unleash->>User: response

Loading

Configuration

Authentication

environment variable	description	default
GOOGLE_IAP_JWT_HEADER	Header name for JWT token from Google IAP	x-goog-iap-jwt-assertion
GOOGLE_IAP_JWT_ISSUER	Issuer for JWT token from Google IAP	https://cloud.google.com/iap
GOOGLE_IAP_JWT_AUDIENCE	Audience for JWT token from Google IAP	REQUIRED
IAP_PUBLIC_KEY_CACHE_TIME	Cache time for JWT token public keys from Google IAP	3600

GOOGLE_IAP_JWT_AUDIENCE should be a string in the following format:

/projects/PROJECT_NUMBER/global/backendServices/SERVICE_ID

Authorization

environment variable	description	default
TEAMS_API_URL	URL for Teams API	REQUIRED
TEAMS_API_TOKEN	Token for Teams API	REQUIRED
TEAMS_ALLOWED_TEAMS	Teams allowed to access Unleash	REQUIRED
TEAMS_USER_VALIDATION_CACHE_TIME	Cache time for Teams user validation	3600

Unleash configuration

environment variable	description	default
INIT_ADMIN_API_TOKENS	Admin API tokens to create on startup	REQUIRED
AUTH_ENABLE_API_TOKEN	Enable API token authentication	true
SERVER_PORT	Port to listen on	4242
DATABASE_USERNAME	Username for database connection	unleash
DATABASE_PASSWORD	Password for database connection	unleash
DATABASE_NAME	Database name	unleash
DATABASE_HOST	Database host	localhost
DATABASE_SSL	Use SSL for database connection	false
DATABASE_PORT	Database port	5432

Setup for local development

Prerequisites

• Node.js 16 or later
• Docker

Running Unleash

The simplest way to run Unleash is to use docker-compose:

docker-compose up --build

This will start a local Postgres database in a Docker container and expose Unleash on http://localhost:8080.

To build the code, run yarn build. This will compile the TypeScript files to ES2017 and place them in ./dist/. Unleash can then be run with yarn start. For convenience you can also use the yarn build-and-start command.

Running Unleash locally requires a database. The easiest way to get one is to use Docker:

docker-compose up -d postgres

This will start a local Postgres database in a Docker container. You can then connect to it using the following credentials:

export DATABASE_USERNAME=unleash
export DATABASE_PASSWORD=unleash
export DATABASE_NAME=unleash
export DATABASE_HOST=localhost
export DATABASE_SSL=false

You also need the following environment variables:

export INIT_ADMIN_API_TOKENS=*:*.unleash4all
export GOOGLE_IAP_AUDIENCE=/projects/123/global/backendServices/123

Contact

Requests and questions can be made via issues on the repo. For NAV employees this can be done easiest via the slack channel #unleash.

License

MIT