Network Configuration

Firewall Configuration

Inbound

Application port

By default, the Swagger Contract Testing On-Premises application runs on port 9292. To change it, set the PACTFLOW_HTTP_PORT environment variable.

Outbound

Webhooks

The Swagger Contract Testing On-Premises application provides webhooks that are designed for triggering builds in the CI systems of integrated applications. You can also use them to provide status updates to source control systems (such as Github) or team chat software (for example, Slack). To enable Contract Testing On-Premises to operate correctly, you must configure network access to systems that are likely to be the targets of these webhooks.

Note

You should whitelist the host names of these services in the PACTFLOW_WEBHOOK_HOST_WHITELIST environment variable.

Certificate and TLS termination

The recommended configuration is to handle TLS (HTTPS) at the load balancer. From there, use plain HTTP to communicate with the application servers. Inside the container, the servers use local sockets to communicate with the internal applications.

If you want to run Contract Testing On-Premises in a TLS-everywhere configuration, create an HAProxy configuration fragment, for example:

frontend https
  bind *:443 ssl crt /etc/haproxy/ssl/server.pem
  http-request set-header X-Forwarded-Proto https
  default_backend app

When starting the container:

Make sure the TLS port (usually 443) is different to PACTFLOW_HTTP_PORT. The latter must continue to be specified as it is used internally. You may choose not to expose this port to prevent non-HTTPS traffic.
Mount the TLS certificate to the path specified by the crt directive in the fragment, for example, /etc/haproxy/ssl/server.pem
Mount the HAProxy configuration fragment to /etc/haproxy/haproxy.d/99.tls.cfg. The exact filepath does not really matter, as long as it does not clash with an existing one in the same folder.
The frontend name is arbitrary, but must not clash with an existing one in the Haproxy configuration.
The default_backend name must be app.

Refer to the HAProxy documentation for more information.

In this section: