This PR introduces security enhancements to the NetAlertX backend, focusing on protecting internal endpoints and modernizing request validation.

Refs
#1452
#1403
#1451
Likely others.

1. Modern Security Headers (Fetch Metadata)

• Implementation: Updated the Nginx configuration to support and prefer Sec-Fetch-Site. This provides robust protection against CSRF and unauthorized cross-origin requests by trusting browser-level security metadata.
• Fallback: Retained a Referer-based fallback for legacy browsers to maintain compatibility while improving overall security for modern clients.
• Efficiency: Consolidated the security logic using Nginx map directives for better performance and maintainability.

2. Internal Endpoint Policy

• Documentation: Updated docs/API.md to explicitly mark the /server endpoint as internal-only. This clarifies the API boundary and directs users towards the stable GraphQL and REST interfaces.

3. Development & Test Infrastructure

• Reliability: Refined .devcontainer setup and Docker compose test scenarios (test_docker_compose_scenarios.py) for better stability and cleaner exits.
• Validation: Added a dedicated integration test suite (test_nginx_proxy_security.py) to verify the new security logic in a live container environment, covering modern browsers, legacy browsers, and unauthorized cross-site requests.

4. Frontend Alignment

• Compatibility: Updated front/js/api.js to ensure frontend requests align with the new security expectations and headers.

Port and path semantics (post-merge)

• Port 20211 = Nginx (frontend entrypoint)

  • Used for the web UI.
  • Also provides an internal proxy path: http(s)://<host>:20211/server/* → proxied to localhost:20212 inside the container.

• Port 20212 = NetAlertX service (API/backend)

  • Direct access to the API and the built-in API tester/docs:
    http://<host>:20212/docs

• Important: /server is an internal convenience route via Nginx and is not a supported external integration endpoint.

  • External tools should not be documented as calling /server directly.
  • External tools either:
    • call the API on 20212 (only in trusted/internal networks; not recommended), or
    • call the API through an auth/SSL proxy (recommended).

Supported connection patterns

1) Default out-of-box Docker experience (web + optional direct API docs)

Use this to describe the default “it works after docker run” behavior, and mention :20212/docs for browser-based testing.

flowchart LR
  B[Browser]
  subgraph NAC[NetAlertX Container]
    N[Nginx listening on port 20211]
    A[Service on port 20212]
    N -->|Proxy /server to localhost:20212| A
  end
  B -->|port 20211| NAC
  B -->|port 20212| NAC

Doc notes:

• Web UI via http://<host>:20211/
• API docs/tester via http://<host>:20212/docs (browser convenience)
• /server is for the UI ↔ backend flow through Nginx, not for external consumers.

2) Direct API consumer to port 20212 (NOT recommended)

This is the “possible, but discouraged” pattern.

flowchart LR
  B[Browser] -->|HTTPS| S[Any API Consumer app]
  subgraph NAC[NetAlertX Container]
    N[Nginx listening on port 20211]
    N -->|Proxy /server to localhost:20212| A[Service on port 20212]
  end
  S -->|Port 20212| NAC

Doc notes (include a warning callout):

• Avoid exposing 20212 to untrusted networks.
• Prefer putting auth/SSL in front (see patterns below).

3) Recommended: HTTPS/Auth reverse proxy in front of NetAlertX (proxy to 20211)

This is the “standard” deployment recommendation for web access.

flowchart LR
  B[Browser] -->|HTTPS| S[Any Auth/SSL proxy]
  subgraph NAC[NetAlertX Container]
    N[Nginx listening on port 20211]
    N -->|Proxy /server to localhost:20212| A[Service on port 20212]
  end
  S -->|port 20211| NAC

Doc notes:

• Reverse proxy targets port 20211 (not 20212).
• This gives TLS + auth in front of the web UI, while keeping backend concerns internal.

4) Recommended: Proxied API consumer (TLS + source limiting) to port 20212

Use this for “external tool integrates with NetAlertX API securely”.

flowchart LR
  B[Browser] -->|HTTPS| S[Any API Consumer app]
  C[HTTPS/source-limiting Proxy]
  subgraph NAC[NetAlertX Container]
    N[Nginx listening on port 20211]
    N -->|Proxy /server to localhost:20212| A[Service on port 20212]
  end
  S -->|Port 443| C
  C -->|Port 20212| NAC

Doc notes:

• The proxy should enforce at least one of:
  • authentication (token/auth gateway),
  • IP allowlisting / source limiting,
  • TLS termination (HTTPS).
• NetAlertX API remains on 20212, but it’s no longer “naked” to the network.

One-line documentation rule to add everywhere

Do not document /server as an API endpoint for external clients. /server is only the internal Nginx-to-service proxy route used within the container’s normal web flow.

Summary by CodeRabbit

• New Features

  • Added a secure same-origin proxy endpoint that enforces strict origin/referer checks and proxies requests to the backend.

• Documentation

  • Documented the internal proxy endpoint in the API docs.

• Tests

  • Added extensive tests for proxy access control and origin handling; relaxed one fragile compose test assertion.

• Chores

  • Included a JSON utility in images, set new default backend API/port values, and adjusted container setup/start scripts and test-side build metadata.

_{✏️ Tip: You can customize this high-level summary in your review settings.}