Network Configuration

Firewall Configuration

Inbound

Application port

By default, the Swagger Contract Testing On-Premises application runs on port 9292. To change it, set the PACTFLOW_HTTP_PORT environment variable.

Outbound

Webhooks

The Swagger Contract Testing On-Premises application provides webhooks that are designed for triggering builds in the CI systems of integrated applications. You can also use them to provide status updates to source control systems (such as Github) or team chat software (for example, Slack). To enable Contract Testing On-Premises to operate correctly, you must configure network access to systems that are likely to be the targets of these webhooks.

Note

You should whitelist the host names of these services in the PACTFLOW_WEBHOOK_HOST_WHITELIST environment variable.

Certificate and TLS termination

The recommended configuration is to handle TLS (HTTPS) at the load balancer. From there, use plain HTTP to communicate with the application servers. Inside the container, the servers use local sockets to communicate with the internal applications.

If you want to run Contract Testing On-Premises in a TLS-everywhere configuration,create an HAProxy configuration fragment, for example:

/etc/haproxy/haproxy.d/99.main.cfg

Add the following configuration to the fragment:

frontend api
  bind :443 ssl crt /certs/site.pem
  default_backend app

When starting the container:

Mount the HAProxy configuration fragment to /etc/haproxy/haproxy.d/99.main.cfg. The fragment must be mounted at this exact path.
Mount the TLS certificate to the path specified by the crt directive in the fragment, for example, /certs/site.pem.
The backend name must be app.
The frontend name cannot be changed from api.

Refer to the HAProxy documentation for more information.

In this section: