feat(host): add composition root and API configuration
- Program.cs with dependency injection setup - Database connection retry logic with detailed logging - Serilog structured logging configuration - CORS configuration from environment variables - Response compression (Brotli + Gzip) - Rate limiting for GraphQL endpoint - Health checks with database verification - OWASP security headers middleware - Output caching for read-heavy operations Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Andrés Eduardo García Márquez
parent
a7dde52e02
commit
2b323adcb4
|
|
@ -0,0 +1,29 @@
|
|||
<Project Sdk="Microsoft.NET.Sdk.Web">
|
||||
|
||||
<PropertyGroup>
|
||||
<TargetFramework>net10.0</TargetFramework>
|
||||
<Nullable>enable</Nullable>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
</PropertyGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="..\Application\Application.csproj" />
|
||||
<ProjectReference Include="..\Adapters\Driving\Api\Adapters.Driving.Api.csproj" />
|
||||
<ProjectReference Include="..\Adapters\Driven\Persistence\Adapters.Driven.Persistence.csproj" />
|
||||
</ItemGroup>
|
||||
|
||||
<ItemGroup>
|
||||
<PackageReference Include="dotenv.net" Version="*" />
|
||||
<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.1">
|
||||
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
|
||||
<PrivateAssets>all</PrivateAssets>
|
||||
</PackageReference>
|
||||
<PackageReference Include="Microsoft.Extensions.Diagnostics.HealthChecks.EntityFrameworkCore" Version="*" />
|
||||
<PackageReference Include="Serilog.AspNetCore" Version="*" />
|
||||
<PackageReference Include="Serilog.Enrichers.Environment" Version="*" />
|
||||
<PackageReference Include="Serilog.Enrichers.Thread" Version="*" />
|
||||
<PackageReference Include="Serilog.Expressions" Version="*" />
|
||||
<PackageReference Include="Serilog.Sinks.File" Version="*" />
|
||||
</ItemGroup>
|
||||
|
||||
</Project>
|
||||
|
|
@ -0,0 +1,271 @@
|
|||
using Adapters.Driven.Persistence;
|
||||
using Adapters.Driven.Persistence.Context;
|
||||
using Adapters.Driving.Api.Extensions;
|
||||
using Application;
|
||||
using dotenv.net;
|
||||
using Microsoft.AspNetCore.Diagnostics.HealthChecks;
|
||||
using Microsoft.AspNetCore.RateLimiting;
|
||||
using Microsoft.AspNetCore.ResponseCompression;
|
||||
using Microsoft.EntityFrameworkCore;
|
||||
using Microsoft.Extensions.Diagnostics.HealthChecks;
|
||||
using Serilog;
|
||||
using System.IO.Compression;
|
||||
using System.Text.Json;
|
||||
using System.Threading.RateLimiting;
|
||||
|
||||
// Load .env file (searches up to root directory)
|
||||
DotEnv.Load(options: new DotEnvOptions(
|
||||
probeForEnv: true,
|
||||
probeLevelsToSearch: 5
|
||||
));
|
||||
|
||||
// Configure Serilog from appsettings + environment variables
|
||||
Log.Logger = new LoggerConfiguration()
|
||||
.ReadFrom.Configuration(new ConfigurationBuilder()
|
||||
.AddJsonFile("appsettings.json")
|
||||
.AddJsonFile($"appsettings.{Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT") ?? "Production"}.json", optional: true)
|
||||
.AddEnvironmentVariables()
|
||||
.Build())
|
||||
.CreateLogger();
|
||||
|
||||
try
|
||||
{
|
||||
Log.Information("Starting application");
|
||||
|
||||
var builder = WebApplication.CreateBuilder(args);
|
||||
|
||||
// Add environment variables to configuration
|
||||
builder.Configuration.AddEnvironmentVariables();
|
||||
|
||||
// Build connection string from individual env vars if not provided directly
|
||||
var connectionString = builder.Configuration.GetConnectionString("DefaultConnection");
|
||||
if (string.IsNullOrEmpty(connectionString))
|
||||
{
|
||||
var dbHost = Environment.GetEnvironmentVariable("DB_HOST") ?? "localhost";
|
||||
var dbPort = Environment.GetEnvironmentVariable("DB_PORT") ?? "1433";
|
||||
var dbName = Environment.GetEnvironmentVariable("DB_NAME") ?? "StudentEnrollment";
|
||||
var dbUser = Environment.GetEnvironmentVariable("DB_USER") ?? "sa";
|
||||
var dbPassword = Environment.GetEnvironmentVariable("DB_PASSWORD") ?? "";
|
||||
|
||||
connectionString = $"Server={dbHost},{dbPort};Database={dbName};User Id={dbUser};Password={dbPassword};TrustServerCertificate=True";
|
||||
builder.Configuration["ConnectionStrings:DefaultConnection"] = connectionString;
|
||||
}
|
||||
|
||||
builder.Host.UseSerilog();
|
||||
|
||||
// Add services
|
||||
builder.Services.AddApplication();
|
||||
builder.Services.AddPersistence(builder.Configuration);
|
||||
builder.Services.AddGraphQLApi();
|
||||
|
||||
// Response Compression (Brotli preferred, then Gzip)
|
||||
builder.Services.AddResponseCompression(options =>
|
||||
{
|
||||
options.EnableForHttps = true;
|
||||
options.Providers.Add<BrotliCompressionProvider>();
|
||||
options.Providers.Add<GzipCompressionProvider>();
|
||||
options.MimeTypes = ResponseCompressionDefaults.MimeTypes.Concat(
|
||||
["application/json", "application/graphql-response+json"]);
|
||||
});
|
||||
|
||||
builder.Services.Configure<BrotliCompressionProviderOptions>(options =>
|
||||
options.Level = CompressionLevel.Fastest);
|
||||
|
||||
builder.Services.Configure<GzipCompressionProviderOptions>(options =>
|
||||
options.Level = CompressionLevel.Fastest);
|
||||
|
||||
// CORS (configurable via CORS_ORIGINS env var, comma-separated)
|
||||
var corsOrigins = Environment.GetEnvironmentVariable("CORS_ORIGINS")?.Split(',', StringSplitOptions.RemoveEmptyEntries)
|
||||
?? ["http://localhost:4200"];
|
||||
builder.Services.AddCors(options =>
|
||||
{
|
||||
options.AddDefaultPolicy(policy =>
|
||||
policy.WithOrigins(corsOrigins)
|
||||
.AllowAnyHeader()
|
||||
.AllowAnyMethod());
|
||||
});
|
||||
|
||||
// Output caching for read-heavy operations
|
||||
builder.Services.AddOutputCache(options =>
|
||||
{
|
||||
options.AddBasePolicy(policy => policy.Expire(TimeSpan.FromSeconds(10)));
|
||||
options.AddPolicy("Subjects", policy => policy.Expire(TimeSpan.FromMinutes(5)));
|
||||
options.AddPolicy("Professors", policy => policy.Expire(TimeSpan.FromMinutes(5)));
|
||||
});
|
||||
|
||||
// Health checks
|
||||
builder.Services.AddHealthChecks()
|
||||
.AddDbContextCheck<AppDbContext>("database");
|
||||
|
||||
// Rate limiting (DoS prevention)
|
||||
builder.Services.AddRateLimiter(options =>
|
||||
{
|
||||
options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
|
||||
options.AddFixedWindowLimiter("graphql", limiter =>
|
||||
{
|
||||
limiter.PermitLimit = 100;
|
||||
limiter.Window = TimeSpan.FromMinutes(1);
|
||||
limiter.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
|
||||
limiter.QueueLimit = 10;
|
||||
});
|
||||
options.AddFixedWindowLimiter("mutations", limiter =>
|
||||
{
|
||||
limiter.PermitLimit = 30;
|
||||
limiter.Window = TimeSpan.FromMinutes(1);
|
||||
limiter.QueueLimit = 5;
|
||||
});
|
||||
});
|
||||
|
||||
var app = builder.Build();
|
||||
|
||||
// Verify database connection and apply migrations
|
||||
await VerifyDatabaseConnectionAsync(app);
|
||||
|
||||
async Task VerifyDatabaseConnectionAsync(WebApplication app)
|
||||
{
|
||||
var maxRetries = 10;
|
||||
var delay = TimeSpan.FromSeconds(5);
|
||||
|
||||
for (int attempt = 1; attempt <= maxRetries; attempt++)
|
||||
{
|
||||
try
|
||||
{
|
||||
using var scope = app.Services.CreateScope();
|
||||
var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
|
||||
|
||||
Log.Information("Attempting database connection (attempt {Attempt}/{MaxRetries})...", attempt, maxRetries);
|
||||
|
||||
// Try to apply migrations - this will create the DB if it doesn't exist
|
||||
Log.Information("Applying database migrations (this will create DB if needed)...");
|
||||
await db.Database.MigrateAsync();
|
||||
Log.Information("Database migrations applied successfully");
|
||||
|
||||
// Verify connection works after migrations
|
||||
if (await db.Database.CanConnectAsync())
|
||||
{
|
||||
Log.Information("Database connection verified successfully");
|
||||
return;
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
Log.Error(ex, "Database operation failed (attempt {Attempt}/{MaxRetries}): {ErrorMessage}",
|
||||
attempt, maxRetries, ex.Message);
|
||||
|
||||
if (attempt == maxRetries)
|
||||
{
|
||||
Log.Fatal("Could not establish database connection after {MaxRetries} attempts. " +
|
||||
"Please verify: DB_HOST={DbHost}, DB_PORT={DbPort}, DB_NAME={DbName}, DB_USER={DbUser}",
|
||||
maxRetries,
|
||||
Environment.GetEnvironmentVariable("DB_HOST") ?? "localhost",
|
||||
Environment.GetEnvironmentVariable("DB_PORT") ?? "1433",
|
||||
Environment.GetEnvironmentVariable("DB_NAME") ?? "StudentEnrollment",
|
||||
Environment.GetEnvironmentVariable("DB_USER") ?? "sa");
|
||||
}
|
||||
}
|
||||
|
||||
if (attempt < maxRetries)
|
||||
{
|
||||
Log.Information("Waiting {Delay} seconds before next connection attempt...", delay.TotalSeconds);
|
||||
await Task.Delay(delay);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Security headers (OWASP recommended)
|
||||
app.Use(async (context, next) =>
|
||||
{
|
||||
var headers = context.Response.Headers;
|
||||
headers.Append("X-Content-Type-Options", "nosniff");
|
||||
headers.Append("X-Frame-Options", "DENY");
|
||||
headers.Append("X-XSS-Protection", "0");
|
||||
headers.Append("Referrer-Policy", "strict-origin-when-cross-origin");
|
||||
headers.Append("Permissions-Policy", "geolocation=(), microphone=(), camera=()");
|
||||
// CSP: More restrictive in production, relaxed for dev (GraphQL Playground needs unsafe-inline/eval)
|
||||
var csp = app.Environment.IsDevelopment()
|
||||
? "default-src 'self'; " +
|
||||
"script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
|
||||
"style-src 'self' 'unsafe-inline'; " +
|
||||
"img-src 'self' data: https:; " +
|
||||
"font-src 'self'; " +
|
||||
"connect-src 'self' http://localhost:* https://localhost:*; " +
|
||||
"frame-ancestors 'none'; " +
|
||||
"base-uri 'self'; " +
|
||||
"form-action 'self'"
|
||||
: "default-src 'self'; " +
|
||||
"script-src 'self'; " +
|
||||
"style-src 'self'; " +
|
||||
"img-src 'self' data:; " +
|
||||
"font-src 'self'; " +
|
||||
"connect-src 'self'; " +
|
||||
"frame-ancestors 'none'; " +
|
||||
"base-uri 'self'; " +
|
||||
"form-action 'self'";
|
||||
headers.Append("Content-Security-Policy", csp);
|
||||
if (!context.Request.IsHttps && !app.Environment.IsDevelopment())
|
||||
{
|
||||
headers.Append("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
|
||||
}
|
||||
await next();
|
||||
});
|
||||
|
||||
// Request logging (structured logs, excludes sensitive data)
|
||||
app.UseSerilogRequestLogging(options =>
|
||||
{
|
||||
options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
|
||||
{
|
||||
diagnosticContext.Set("RequestHost", httpContext.Request.Host.Value);
|
||||
diagnosticContext.Set("UserAgent", httpContext.Request.Headers.UserAgent.ToString());
|
||||
};
|
||||
options.MessageTemplate = "HTTP {RequestMethod} {RequestPath} responded {StatusCode} in {Elapsed:0.0000} ms";
|
||||
});
|
||||
|
||||
// Middleware order matters for performance
|
||||
app.UseResponseCompression();
|
||||
app.UseCors();
|
||||
app.UseRateLimiter();
|
||||
app.UseOutputCache();
|
||||
|
||||
// Health check endpoint with JSON response
|
||||
app.MapHealthChecks("/health", new HealthCheckOptions
|
||||
{
|
||||
ResponseWriter = async (context, report) =>
|
||||
{
|
||||
context.Response.ContentType = "application/json";
|
||||
var result = new
|
||||
{
|
||||
status = report.Status.ToString(),
|
||||
timestamp = DateTime.UtcNow,
|
||||
checks = report.Entries.Select(e => new
|
||||
{
|
||||
name = e.Key,
|
||||
status = e.Value.Status.ToString(),
|
||||
description = e.Value.Description,
|
||||
duration = e.Value.Duration.TotalMilliseconds
|
||||
})
|
||||
};
|
||||
await context.Response.WriteAsync(JsonSerializer.Serialize(result, new JsonSerializerOptions
|
||||
{
|
||||
PropertyNamingPolicy = JsonNamingPolicy.CamelCase
|
||||
}));
|
||||
}
|
||||
});
|
||||
|
||||
// GraphQL endpoint with Banana Cake Pop playground and rate limiting
|
||||
app.MapGraphQL()
|
||||
.RequireRateLimiting("graphql")
|
||||
.WithOptions(new HotChocolate.AspNetCore.GraphQLServerOptions
|
||||
{
|
||||
Tool = { Enable = app.Environment.IsDevelopment() }
|
||||
});
|
||||
|
||||
await app.RunAsync();
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
Log.Fatal(ex, "Application terminated unexpectedly");
|
||||
}
|
||||
finally
|
||||
{
|
||||
await Log.CloseAndFlushAsync();
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"GraphQL": {
|
||||
"EnableIntrospection": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
{
|
||||
"ConnectionStrings": {
|
||||
"DefaultConnection": ""
|
||||
},
|
||||
"Serilog": {
|
||||
"Using": ["Serilog.Sinks.Console", "Serilog.Sinks.File"],
|
||||
"MinimumLevel": {
|
||||
"Default": "Information",
|
||||
"Override": {
|
||||
"Microsoft": "Warning",
|
||||
"Microsoft.AspNetCore": "Warning",
|
||||
"Microsoft.EntityFrameworkCore": "Warning",
|
||||
"HotChocolate": "Warning",
|
||||
"System": "Warning"
|
||||
}
|
||||
},
|
||||
"WriteTo": [
|
||||
{
|
||||
"Name": "Console",
|
||||
"Args": {
|
||||
"outputTemplate": "[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj} {Properties:j}{NewLine}{Exception}"
|
||||
}
|
||||
},
|
||||
{
|
||||
"Name": "File",
|
||||
"Args": {
|
||||
"path": "logs/app-.log",
|
||||
"rollingInterval": "Day",
|
||||
"retainedFileCountLimit": 7,
|
||||
"outputTemplate": "{Timestamp:yyyy-MM-dd HH:mm:ss.fff zzz} [{Level:u3}] {Message:lj} {Properties:j}{NewLine}{Exception}"
|
||||
}
|
||||
}
|
||||
],
|
||||
"Enrich": ["FromLogContext", "WithMachineName", "WithThreadId"],
|
||||
"Destructure": [
|
||||
{
|
||||
"Name": "ToMaximumDepth",
|
||||
"Args": { "maximumDestructuringDepth": 3 }
|
||||
}
|
||||
],
|
||||
"Filter": [
|
||||
{
|
||||
"Name": "ByExcluding",
|
||||
"Args": {
|
||||
"expression": "Contains(@Message, 'password') or Contains(@Message, 'Password') or Contains(@Message, 'secret') or Contains(@Message, 'token') or Contains(@Message, 'connectionString')"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"AllowedHosts": "*",
|
||||
"GraphQL": {
|
||||
"MaxExecutionDepth": 5,
|
||||
"MaxComplexity": 100
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue