Proxy requests from backend to Job Server

[suzannehamilton]

Once Job Server is running on a separate droplet, requests from the backend to Job Server will be blocked by the firewall.

We will need to proxy:

• Release requests
• Airlock authentication

We can do this in advance of the Job Server migration. It will also let us monitor whether the extra proxying causes any latency issues.

Steps:

• Add nginx conf for proxying release.opensafely.org (PR)
• Add release.opensafely.org domain to proxy dokku app on dokku4 and run letsencrypt:enable
• Remove release.opensafely.org domain from job-server dokku app on dokku4
• Remove jobs.opensafely.org from L3 /etc/hosts

[suzannehamilton]

Slack thread

[rebkwok]

Tested on L4:

1. With release.opensafely.org as a domain on both job-server and proxy (both still on dokku4), confirmed I can still login to Airlock. Tailing logs on both dokku apps shows that the request goes directly to job-server still.
2. Removed release.opensafely.org from the job-server domains, confirmed I can still login to Airlock. Tailing logs on both dokku apps shows that the request now goes via the proxy.