jlmconsulting/bnb-druid-proxy repository overview

⁠jlmconsulting/bnb-druid-proxy

Druid Proxy Server is an Express-based proxy server, written in TypeScript, that securely forwards SQL queries to an Apache Druid instance. It is designed to enhance security by validating UUID v4 strings in requests and enforcing Bearer token authentication with UUID validation. This image provides a ready-to-run container for deploying the proxy server.

⁠Key Features

• Secure Proxy for Apache Druid: Acts as a secure intermediary between clients and your Druid database.
• UUID v4 Validation: Validates id query parameters and Bearer tokens as UUID v4 strings, enhancing security.
• Bearer Token Authentication: Requires valid Bearer tokens in the Authorization header for access.
• HTTPS Support: Enables secure communication via HTTPS, with automatic redirection from HTTP.
• Environment Variable Configuration: Configured via environment variables for easy customization.
• Dockerized Deployment: Containerized for easy deployment and portability.
• Health Check Endpoint: Provides a /health endpoint for monitoring container health.
• Request Logging: Logs incoming requests for debugging and monitoring.

⁠Prerequisites

• Docker installed on your host machine.
• An accessible Apache Druid instance.
• SSL/TLS certificates (if using HTTPS).

⁠Quick Start (Docker Compose)

The recommended way to run this image is using Docker Compose.

1. Create a docker-compose.yml file:

   version: "3.8"
   services:
     bnb-druid-proxy:
       image: jlmconsulting/bnb-druid-proxy:latest
       container_name: bnb-druid-proxy
       ports:
         - "3333:3333" # HTTPS Port
         - "3334:3334" # HTTP Port (redirects to HTTPS)
       environment:
         - MONGO_CONNECTION_STRING=mongodb+srv://youruser:[email protected]/yourdb # Replace with your MongoDB connection string (if needed by backend logic)
         - HTTPS_PORT=3333
         - HTTP_PORT=3334
         - DRUID_URL=http://your-druid-host:8888/druid/v2/sql # Replace with your Druid URL
         - CERT_KEY_PATH=/usr/src/app/certs/privkey1.pem # Path inside container
         - CERT_CERT_PATH=/usr/src/app/certs/fullchain1.pem # Path inside container
         - CERT_CA_PATH=/usr/src/app/certs/ca.pem # Optional CA cert path inside container
         # Add other environment variables as needed (see Configuration section)
       volumes:
         - ./certs:/usr/src/app/certs # Mount your certs directory
       # network_mode: "host" # Uncomment if you need host network mode
   

   Copy

2. Create a certs directory:

   Create a directory named certs in the same directory as your docker-compose.yml file. Place your SSL certificate files (privkey1.pem, fullchain1.pem, and optionally ca.pem) inside this directory.

   mkdir certs
   # Copy your certificate files into the certs directory
   # e.g., cp /path/to/your/privkey1.pem certs/
   

   Copy

3. Run Docker Compose:

   docker-compose up -d
   

   Copy

   This will start the Druid Proxy server in detached mode.

⁠Configuration (Environment Variables)

The following environment variables can be used to configure the Druid Proxy server:

Important Notes:

• SSL Certificates: Ensure your SSL certificate files are correctly placed in the certs directory and that the CERT_*_PATH environment variables correctly point to them inside the container. Volume mounting is used in the docker-compose.yml example to make certificates available within the container.
• Security: Protect your environment variables, especially MONGO_CONNECTION_STRING, AWS_SECRET_ACCESS_KEY, BIDSNBUYS_PASSWORD, and TOTP_SECRET. Avoid hardcoding sensitive information in your Docker Compose file. Use Docker secrets or environment variable management tools in production.
• Druid URL: Double-check that DRUID_URL is correctly pointing to your Druid SQL endpoint and that the Druid instance is accessible from within the Docker container (or from the host if using network_mode: "host").

⁠Usage

Once the container is running, you can send requests to the proxy server.

Example curl command to query Druid via /v2/sql:

curl -X POST "https://your-server-address:3333/v2/sql?id=$(uuidgen)" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $(uuidgen)" \
    -d '{"query": "SELECT * FROM \\"your-druid-datasource\\""}' \
    --cacert ./certs/fullchain1.pem # Replace with your cert path, or use --insecure for testing (not recommended for production)