Add proxy for release.opensafely.org (to job-server API) - #92
Merged
Conversation
rebkwok
force-pushed
the
proxy-job-server
branch
from
August 19, 2026 14:15
4f17dac to
0ec75be
Compare
4 tasks
rebkwok
force-pushed
the
proxy-job-server
branch
from
August 19, 2026 16:01
0ec75be to
7a38627
Compare
rebkwok
changed the title
Proxies release.opensafely.org to jobs.opensafely.org; only forwards /api/v2/releases/ (for Airlock auth and releasing endpoints) and /api/v2/airlock/events (the Airlock notification endpoint).
rebkwok
force-pushed
the
proxy-job-server
branch
from
August 19, 2026 16:07
7a38627 to
f31ace7
Compare
evansd
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proxies
release.opensafely.orgtojobs.opensafely.org; only forwards /api/v2/releases/ (for Airlock auth and releasing endpoints) and /api/v2/airlock/events (the Airlock notification endpoint).Backends already use release.opensafely.org as the
AIRLOCK_API_ENDPOINT; once the proxy is in place (and we've added release.opensafely.org to the proxy dokku app domains, we can remove it from the job-server app's domains.I've tested this on the emis-staging environment.
Starting with job-server set with releases.emis-staging.opensafely.org and jobs.emis-staging.opensafely.org domains (as on prod), and I deployed the proxy with this branch, and added releases.emis-staging.opensafely.org to its domains. Then I tried to log into emisv2 airlock with an emis-staging job-server token. It worked, but it went directly to job-server. Then I removed releases.emis-staging.opensafely.org from the job-server domains and tried again, and it still worked, this time going via the proxy. I've also tested creating and submitting a release request and Airlock notifications are correctly sent to job-server (e.g. to create this issue when a release request is submitted)
First step in #90