feat: add optional nginx HTTPS termination by MoeexT · Pull Request #4026 · ModelEngine-Group/nexent

MoeexT · 2026-09-28T10:36:26Z

Add HTTPS mode option (disabled/self-signed/custom) to install TUI, persisted in deploy.options and reusable on non-interactive reruns
Support auto-generated self-signed certs (99-year validity, SAN from env or NIC auto-detection) and user-provided certs with validation (PEM format, key/cert match, expiry, encrypted key decryption)
Decrypt passphrase-protected keys to a 0600 plaintext copy mounted by nginx; passphrase stored via existing .env credential pattern
Add nexent-nginx helm chart (deployment/service/configmap/secret) terminating TLS on NodePort 30000 via error_page 497 same-port redirect; web service steps down to ClusterIP when HTTPS is enabled
Render cert/key as YAML literal blocks; store TLS as Opaque secret with server.pem/server.key keys
Update offline packaging, env example, install docs and common tests

… installs - Add HTTPS mode option (disabled/self-signed/custom) to install TUI, persisted in deploy.options and reusable on non-interactive reruns - Support auto-generated self-signed certs (99-year validity, SAN from env or NIC auto-detection) and user-provided certs with validation (PEM format, key/cert match, expiry, encrypted key decryption) - Decrypt passphrase-protected keys to a 0600 plaintext copy mounted by nginx; passphrase stored via existing .env credential pattern - Add nexent-nginx helm chart (deployment/service/configmap/secret) terminating TLS on NodePort 30000 via error_page 497 same-port redirect; web service steps down to ClusterIP when HTTPS is enabled - Render cert/key as YAML literal blocks; store TLS as Opaque secret with server.pem/server.key keys - Update offline packaging, env example, install docs and common tests

mi7ak2020-stack · 2026-09-28T10:38:52Z

I

mi7ak2020-stack · 2026-09-28T10:40:28Z

I

mi7ak2020-stack · 2026-09-28T10:40:35Z

I

Copilot

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate issues affect TLS key security, service exposure, image selection, and deployment transitions.

Review effort: Lite
Findings: 4 · 9

Open (13)

Generated Helm values expose the TLS private key · New
HTTPS mode still publishes the web service port · New
HTTPS mode still publishes the web service port · New
Web service starts before its HTTPS port mapping is applied · New
Environment defaults override configured HTTPS variables · New
EC private keys are rejected by RSA-only validation · New
Helm Nginx image ignores the configured registry prefix · New
ifconfig parsing prevents automatic SAN IP detection · New
Existing certificate pair lacks matching and expiry validation · New
HTTPS key passphrase is not persisted across reruns · New
Compose Nginx image ignores the configured registry prefix · New
Offline Compose deployment uses an unprefixed Nginx image · New
Disabling HTTPS leaves the Nginx container running · New

What changed in this PR

Adds optional Nginx HTTPS termination for Docker and Kubernetes deployments, with certificate handling, validation, persistence, and offline packaging support.

Changes:

Adds disabled, self-signed, and custom HTTPS modes.
Adds Docker Compose and Helm Nginx proxy resources.
Updates documentation, environment examples, deployment scripts, and tests.

File	Summary
`doc/docs/zh/quick-start/installation.md`	Chinese HTTPS deployment documentation
`doc/docs/en/quick-start/installation.md`	English HTTPS deployment documentation
`deploy/tests/test_common.sh`	HTTPS configuration and certificate tests
`deploy/offline/build_offline_package.sh`	Offline HTTPS image support
`deploy/k8s/helm/nexent/charts/nexent-nginx/values.yaml`	Nginx chart defaults
`deploy/k8s/helm/nexent/charts/nexent-nginx/templates/service.yaml`	Nginx Service
`deploy/k8s/helm/nexent/charts/nexent-nginx/templates/secret.yaml`	TLS Secret
`deploy/k8s/helm/nexent/charts/nexent-nginx/templates/deployment.yaml`	Nginx Deployment
`deploy/k8s/helm/nexent/charts/nexent-nginx/templates/configmap.yaml`	Nginx configuration
`deploy/k8s/helm/nexent/charts/nexent-nginx/Chart.yaml`	Nginx subchart metadata
`deploy/k8s/helm/nexent/Chart.yaml`	Registers the Nginx dependency
`deploy/k8s/deploy.sh`	Prepares HTTPS for Helm deployment
`deploy/env/.env.example`	Documents HTTPS environment variables
`deploy/docker/deploy.sh`	Starts and manages the Docker HTTPS proxy
`deploy/docker/compose/docker-compose.yml`	Development Nginx service and port mapping
`deploy/docker/compose/docker-compose.prod.yml`	Production Nginx service and port mapping
`deploy/docker/assets/nginx/nginx.conf`	Docker Nginx TLS configuration
`deploy/common/common.sh`	Shared HTTPS configuration, validation, generation, and rendering

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    if [ -r "${DEPLOYMENT_HTTPS_CERT_PATH:-}" ] && [ -r "${DEPLOYMENT_HTTPS_KEY_PATH:-}" ]; then
+      printf '  tls:\n'
+      # Render PEM contents as a YAML literal block: multi-line certificates
+      # cannot be safely quoted on a single line.
+      printf '    cert: |\n'
+      sed 's/^/      /' "$DEPLOYMENT_HTTPS_CERT_PATH"
+      printf '    key: |\n'
+      sed 's/^/      /' "$DEPLOYMENT_HTTPS_KEY_PATH"


      - nexent
    ports:
-      - "3000:3000"
+      - "${NEXENT_WEB_PORT_MAPPING-3000:3000}"


      - nexent
    ports:
-      - "3000:3000"
+      - "${NEXENT_WEB_PORT_MAPPING-3000:3000}"


+  # Start Nginx HTTPS reverse proxy when HTTPS is enabled
+  deploy_https_nginx || {


+  DEPLOYMENT_HTTPS_MODE="disabled"
+  DEPLOYMENT_HTTPS_CERT_FILE=""
+  DEPLOYMENT_HTTPS_KEY_FILE=""


+  if [ -r "$cert_file" ] && [ -r "$key_file" ]; then
+    if openssl x509 -in "$cert_file" -noout >/dev/null 2>&1 && openssl rsa -in "$key_file" -check -noout >/dev/null 2>&1; then
+      DEPLOYMENT_HTTPS_CERT_PATH="$cert_file"
+      DEPLOYMENT_HTTPS_KEY_PATH="$key_file"
+      return 0


+  if [ "$DEPLOYMENT_HTTPS_MODE" != "disabled" ]; then
+    deployment_update_env_var_file "$(deployment_env_dir)/.env" "NEXENT_HTTPS_MODE" "$DEPLOYMENT_HTTPS_MODE"
+    [ -n "${DEPLOYMENT_HTTPS_SAN_RESOLVED:-}" ] && deployment_update_env_var_file "$(deployment_env_dir)/.env" "NEXENT_HTTPS_SAN" "$DEPLOYMENT_HTTPS_SAN_RESOLVED"
+  fi



+
+  nexent-nginx:
+    image: nginx:alpine



+
+  nexent-nginx:
+    image: nginx:alpine


+  if [ "$DEPLOYMENT_HTTPS_MODE" = "disabled" ] || [ -z "$DEPLOYMENT_HTTPS_MODE" ]; then
+    export NEXENT_WEB_PORT_MAPPING="3000:3000"
+    return 0


codecov · 2026-09-28T11:03:42Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

- Seed HTTPS config from NEXENT_HTTPS_* env vars before defaults - Detect SAN via ip -o -4 addr (Linux) with ifconfig fallback - Start docker nginx before core services; clean up on disabled; bind web to loopback 3001 when HTTPS is enabled - chmod 600 generated Helm values containing private keys - Support EC keys via openssl pkey with LibreSSL fallback - Route nginx image through NGINX_IMAGE and registry prefix - Validate cert/key pair and expiry when reusing self-signed certs - Persist custom key passphrase to .env

- Give HTTPS a dedicated entry: Docker port 3100, K8s NodePort 31000 - Keep the plain HTTP entry unchanged (Docker 3000 / K8s NodePort 30000); web no longer steps down to ClusterIP or a loopback-only binding - Drop the same-port error_page 497 redirect now that entries are split - Update TUI/summary wording, tests and install docs for the new ports

Offline hosts cannot pull the nginx image after delivery when the user enables HTTPS during installation. Bundle nginx:alpine with the infrastructure images instead of gating it on build-time HTTPS options, and drop the HTTPS flags from the offline build passthrough list.

Introduce NEXENT_WEB_PORT and NEXENT_HTTPS_PORT so users can change the entry ports for both Docker (host port mapping) and Kubernetes (NodePort) deployments. Defaults keep the current behavior (Docker 3000/3100, K8s 30000/31000). Also fix the deploy script overwriting a user-set web port mapping when HTTPS is disabled, and document the new variables in .env.example and the installation guides.

Reject NEXENT_WEB_PORT and NEXENT_HTTPS_PORT values outside the Kubernetes nodePort range (30000-32767) before rendering Helm values, so users get a clear error instead of a cryptic API server message. Ports are only validated when HTTPS mode needs them, and empty values keep using defaults.

The live Helm values renderer (deployment_render_helm_chart_values) only rendered the nginx image block, so the nginx Service fell back to the chart default NodePort and a user-set NEXENT_HTTPS_PORT never took effect. Render the nginx services block the same way the port-policy renderer does, and cover it with a Helm values assertion.

Copilot AI lite review requested due to automatic review settings September 28, 2026 10:36

MoeexT requested review from Dallas98, WMC001, YehongPan, hhhhsc701 and jeffwu-1999 as code owners September 28, 2026 10:36

Copilot started reviewing on behalf of MoeexT September 28, 2026 10:37 View session

mi7ak2020-stack approved these changes Sep 28, 2026

View reviewed changes

Copilot AI reviewed Sep 28, 2026

View reviewed changes

MoeexT added 8 commits September 28, 2026 19:08

docs(deploy): list the HTTPS entry port in the port mapping table

091b15f

test(deploy): include nginx image in offline push test fixtures

51ec172

Navigation Menu

feat: add optional nginx HTTPS termination - #4026

feat: add optional nginx HTTPS termination#4026
MoeexT wants to merge 9 commits into
developfrom
feature/moeext/nginx-https

MoeexT commented Sep 28, 2026 •

edited

Loading

Uh oh!

mi7ak2020-stack commented Sep 28, 2026

Uh oh!

mi7ak2020-stack commented Sep 28, 2026

Uh oh!

mi7ak2020-stack commented Sep 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

codecov Bot commented Sep 28, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		# Start Nginx HTTPS reverse proxy when HTTPS is enabled
		deploy_https_nginx \|\| {

Conversation

MoeexT commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mi7ak2020-stack commented Sep 28, 2026

Uh oh!

mi7ak2020-stack commented Sep 28, 2026

Uh oh!

mi7ak2020-stack commented Sep 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

codecov Bot commented Sep 28, 2026

Codecov Report

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MoeexT commented Sep 28, 2026 •

edited

Loading