microsoft / microsoft/AzureTRE
Route Guacamole traffic through the app gateway
Open
Nobody has claimed this yet.
feature
- Dominant language
- Python
- Stars
- 235
- Forks
- 192
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 13
Description
Route Guacamole traffic through the App Gateway, and do not allow direct connections to guacamole service endpoints.
This would provide the following benefits:
- TRE web traffic would flow through a single ingress point
- a
singletrusted domain name can be used, rather than relying on default azure domain names for guacamole - App Gateway WAF features can be enabled for all web traffic rather than just API + UI
- would meet Apache’s recommendation of hosting behind a reverse proxy: https://guacamole.apache.org/doc/gug/reverse-proxy.html
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the current App Gateway and Guacamole service endpoint configuration in AzureTRE, then review how web traffic and direct service access are exposed. Done means Guacamole traffic enters through the App Gateway and direct connections to Guacamole endpoints are no longer allowed, while the reverse-proxy arrangement supports the stated WAF and trusted-domain goals.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, infrastructure, networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100