Develop

.github/workflows/api-gateway-docker-dispatch.yml

@@ -0,0 +1,93 @@
+name: "💰 api-gateway – Docker Build & GitOps Dispatch"
+
+on:
+  push:
+    branches: [ main, develop ]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: api-gateway-${{ github.ref_name }}
+  cancel-in-progress: true
+
+env:
+  SERVICE: gateway
+  IMAGE:   ${{ secrets.DOCKER_USERNAME }}/api-gateway
+  DEVOPS_REPO: 3-mnms/gitops-repo
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v3
+        with:
+          distribution: temurin
+          java-version: '17'
+
+      - run: chmod +x ./gradlew
+      - run: ./gradlew bootJar --no-daemon
+
+      - name: ⏱️ Tag
+        run: echo "TAG=v$(date -u +'%Y%m%d%H%M%S')" >> $GITHUB_ENV
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=raw,value=${{ env.TAG }}
+            type=sha
+            type=raw,value=v0.1
+            type=raw,value=latest
+
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Dispatch to GitOps (develop-gke + develop-aws)
+        if: ${{ github.ref_name == 'develop' }}
+        uses: peter-evans/repository-dispatch@v3
+        with:
+          token:  ${{ secrets.GH_PAT }}
+          repository: ${{ env.DEVOPS_REPO }}
+          event-type: image-updated
+          client-payload: |
+            {
+              "service": "${{ env.SERVICE }}",
+              "image":   "${{ env.IMAGE }}",
+              "tag":     "${{ env.TAG }}",
+              "targets": "develop-gke,develop-aws"
+            }
+
+      - name: Dispatch to GitOps (prod)
+        if: ${{ github.ref_name == 'main' }}
+        uses: peter-evans/repository-dispatch@v3
+        with:
+          token:  ${{ secrets.GH_PAT }}
+          repository: ${{ env.DEVOPS_REPO }}
+          event-type: image-updated
+          client-payload: |
+            {
+              "service": "${{ env.SERVICE }}",
+              "image":   "${{ env.IMAGE }}",
+              "tag":     "${{ env.TAG }}",
+              "env":     "prod"
+            }

Dockerfile

@@ -0,0 +1,20 @@
+# Debian/Ubuntu 계열 JRE (amd64/arm64 모두 제공)
+FROM eclipse-temurin:17-jre-jammy
+
+# spring 사용자/그룹 생성 (Debian 표준 명령)
+RUN groupadd -r spring \
+ && useradd -r -g spring -d /home/spring -s /usr/sbin/nologin spring \
+ && mkdir -p /app /home/spring
+
+WORKDIR /app
+
+# 빌드 산출물 복사 (권한도 함께 설정)
+ARG JAR_FILE=build/libs/*.jar
+COPY --chown=spring:spring ${JAR_FILE} /app/app.jar
+
+# 비루트 실행
+USER spring
+
+EXPOSE 8080
+ENV JAVA_OPTS="-XX:+UseContainerSupport -XX:MaxRAMPercentage=75"
+ENTRYPOINT ["sh", "-c", "java $JAVA_OPTS -jar /app/app.jar"]

build.gradle

@@ -1,59 +1,68 @@
 plugins {
-	id 'java'
-	id 'org.springframework.boot' version '3.5.4'
-	id 'io.spring.dependency-management' version '1.1.7'
+    id 'java'
+    id 'org.springframework.boot' version '3.5.4'
+    id 'io.spring.dependency-management' version '1.1.7'
 }
 
 group = 'com.tekcit'
 version = '0.0.1-SNAPSHOT'
 
 java {
-	toolchain {
-		languageVersion = JavaLanguageVersion.of(17)
-	}
+    toolchain { languageVersion = JavaLanguageVersion.of(17) }
 }
 
 repositories {
-	mavenCentral()
+    mavenCentral()
 }
+
 ext {
-	set('springCloudVersion', "2025.0.0")
+    set('springCloudVersion', "2025.0.0")
 }
 
 dependencies {
-	implementation 'org.springframework.cloud:spring-cloud-starter-gateway'
-	implementation 'org.springframework.cloud:spring-cloud-starter-kubernetes-client-all'
-	implementation 'org.springframework.boot:spring-boot-starter-actuator'
-	testImplementation 'org.springframework.boot:spring-boot-starter-test'
-	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-	implementation 'org.springframework.boot:spring-boot-starter-security'
+    // Core
+    implementation 'org.springframework.boot:spring-boot-starter-actuator'
+    implementation 'org.springframework.boot:spring-boot-starter-security'
+
+    // ★ Spring Cloud Gateway (starter 하나면 충분; WebFlux 포함됨)
+    implementation 'org.springframework.cloud:spring-cloud-starter-gateway'
+
+    // Kubernetes (필요시)
+    implementation 'org.springframework.cloud:spring-cloud-starter-kubernetes-client-all'
 
+    // JWT / Security
+    implementation 'io.jsonwebtoken:jjwt-api:0.11.5'
+    runtimeOnly   'io.jsonwebtoken:jjwt-impl:0.11.5'
+    runtimeOnly   'io.jsonwebtoken:jjwt-jackson:0.11.5'
+    implementation 'org.springframework.security:spring-security-oauth2-jose'
+    implementation 'org.springframework.security:spring-security-oauth2-resource-server'
 
-	// JWT
-	implementation 'io.jsonwebtoken:jjwt-api:0.11.5'
-	runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.5'
-	runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.11.5'
-	implementation 'org.springframework.security:spring-security-oauth2-jose'
-	implementation 'org.springframework.security:spring-security-oauth2-resource-server'
+    // Lombok
+    compileOnly 'org.projectlombok:lombok'
+    annotationProcessor 'org.projectlombok:lombok'
 
+    // JSON
+    implementation 'com.fasterxml.jackson.core:jackson-databind'
+    implementation 'org.springframework.boot:spring-boot-starter-json'
 
-	// Lombok
-	compileOnly 'org.projectlombok:lombok'
-	annotationProcessor 'org.projectlombok:lombok'
+    // Swagger
+    implementation 'org.springdoc:springdoc-openapi-starter-webflux-ui:2.8.9'
 
+    // ★ Prometheus 레지스트리
+    implementation 'io.micrometer:micrometer-registry-prometheus'
 
-	// JSON 직렬화용
-	implementation 'com.fasterxml.jackson.core:jackson-databind'
-	implementation 'org.springframework.boot:spring-boot-starter-json'
-	testImplementation 'org.springframework.kafka:spring-kafka-test'
+    // Test
+    testImplementation 'org.springframework.boot:spring-boot-starter-test'
+    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
+    testImplementation 'org.springframework.kafka:spring-kafka-test'
 
 
 }
+
 dependencyManagement {
-	imports {
-		mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
-	}
-}
-tasks.named('test') {
-	useJUnitPlatform()
+    imports {
+        mavenBom "org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"
+    }
 }
+
+tasks.named('test') { useJUnitPlatform() }

src/main/java/com/tekcit/gateway/config/gateway/filter/GatewayCorsConfig.java

@@ -0,0 +1,71 @@
+package com.tekcit.gateway.config.gateway.filter;
+
+import com.tekcit.gateway.config.gateway.property.CorsProperties;
+import lombok.RequiredArgsConstructor;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.server.reactive.ServerHttpRequest;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.reactive.CorsWebFilter;
+import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilter;
+import org.springframework.web.server.WebFilterChain;
+
+import java.util.List;
+
+@Configuration
+@RequiredArgsConstructor
+public class GatewayCorsConfig {
+
+
+    private final CorsProperties corsProperties;
+
+
+//    @Bean
+//    public CorsWebFilter corsWebFilter() {
+//        CorsConfiguration config = new CorsConfiguration();
+//        for(String url : corsProperties.getUrl()){
+//            config.addAllowedOrigin(url);
+//        }
+//        config.addAllowedMethod("*");
+//        config.addAllowedHeader("*");
+//        config.setAllowCredentials(true);
+//
+//        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+//
+//        source.registerCorsConfiguration("/**", config);
+//
+//        return new CorsWebFilter(source);
+//    }
+//
+
+        @Bean
+        public WebFilter corsFilter() {
+            return (exchange, chain) -> {
+                String path = exchange.getRequest().getURI().getPath();
+                if (path.startsWith("/ws")) {
+                    // WebSocket 경로는 CORS 필터 건너뛰기 (서버로 그대로 전달)
+                    return chain.filter(exchange);
+                }
+
+                CorsConfiguration config = new CorsConfiguration();
+                for (String url : corsProperties.getUrl()) {
+                    config.addAllowedOrigin(url);
+                }
+                config.addAllowedMethod("*");
+                config.addAllowedHeader("*");
+                config.setAllowCredentials(true);
+
+                UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+                source.registerCorsConfiguration("/**", config);
+
+                return new CorsWebFilter(source).filter(exchange, chain);
+            };
+        }
+
+
+}

src/main/java/com/tekcit/gateway/config/gateway/filter/JwtToHeaderFilter.java

@@ -1,5 +1,6 @@
 package com.tekcit.gateway.config.gateway.filter;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.tekcit.gateway.config.security.jwt.JwtTokenProvider;
 import io.jsonwebtoken.Claims;
 import lombok.RequiredArgsConstructor;
@@ -22,6 +23,35 @@ public class JwtToHeaderFilter implements GlobalFilter, Ordered {
 
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
+
+        String upgradeHeader = exchange.getRequest().getHeaders().getFirst("Upgrade");
+        System.out.println(upgradeHeader);
+
+
+        if (upgradeHeader != null && upgradeHeader.equalsIgnoreCase("websocket")) {
+            // WebSocket handshake 요청이면 SecurityContext와 상관없이 JWT를 직접 읽어 헤더 추가
+            String token = exchange.getRequest().getQueryParams().getFirst("token");
+            exchange.getRequest().getHeaders().forEach((key, values) -> {
+                System.out.println(key + " : " + values);
+            });
+            if (token != null && token.startsWith("Bearer ")) {
+                String jwt = token.substring(7);
+                Claims claims = jwtTokenProvider.getAllClaims(jwt);
+                System.out.println(" ============= WebSocket Authorization ================");
+                System.out.println("X-User-Id" +  jwtTokenProvider.getSubject(claims));
+                System.out.println("X-User-Name" +  jwtTokenProvider.getName(claims));
+                System.out.println("X-User-Role" +  jwtTokenProvider.getClaimAsString(claims, "role"));
+                ServerHttpRequest mutatedRequest = exchange.getRequest().mutate()
+                        .headers(h -> {
+                            h.set("X-User-Id", jwtTokenProvider.getSubject(claims));
+                            h.set("X-User-Name", jwtTokenProvider.getName(claims));
+                            h.set("X-User-Role", jwtTokenProvider.getClaimAsString(claims, "role"));
+                        })
+                        .build();
+                return chain.filter(exchange.mutate().request(mutatedRequest).build());
+            }
+        }
+
         return ReactiveSecurityContextHolder.getContext()
                 .doOnNext(ctx -> System.out.println("SecurityContext 있음: " + ctx))
                 .map(securityContext -> securityContext.getAuthentication())
@@ -31,12 +61,24 @@ public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
                 .flatMap(auth -> {
                     String jwt = auth.getToken().getTokenValue();
                     Claims claims = jwtTokenProvider.getAllClaims(jwt);
+
+                    // 요청 주소 확인
+                    ServerHttpRequest request = exchange.getRequest();
+                    System.out.println("요청 URI: " + request.getURI());
+                    System.out.println("요청 Path: " + request.getPath());
+                    System.out.println("요청 Method: " + request.getMethod());
+
+                    System.out.println("X-User-Id " + jwtTokenProvider.getSubject(claims));
+                    System.out.println("X-User-Name " + jwtTokenProvider.getName(claims));
+                    System.out.println("X-User-Role " + jwtTokenProvider.getClaimAsString(claims, "role"));
+
                     ServerHttpRequest mutatedRequest = exchange.getRequest().mutate()
-                            .header("X-User-Id",  jwtTokenProvider.getClaimAsString(claims, "userId"))
-                            .header("X-User-Name", jwtTokenProvider.getClaimAsString(claims,"name"))
-                            .header("X-User-Role", jwtTokenProvider.getClaimAsString(claims,"role"))
+                            .headers(h ->{
+                                h.set("X-User-Id", jwtTokenProvider.getSubject(claims));
+                                h.set("X-User-Name", jwtTokenProvider.getName(claims));
+                                h.set("X-User-Role", jwtTokenProvider.getClaimAsString(claims, "role"));
+                            })
                             .build();
-
                     return chain.filter(exchange.mutate().request(mutatedRequest).build());
                 })
                 .switchIfEmpty(Mono.defer(() -> {

src/main/java/com/tekcit/gateway/config/gateway/property/CorsProperties.java

@@ -0,0 +1,15 @@
+package com.tekcit.gateway.config.gateway.property;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+
+import java.util.List;
+
+@Component
+@Getter @Setter
+@ConfigurationProperties(prefix = "cors")
+public class CorsProperties {
+    private List<String> url;
+}

src/main/java/com/tekcit/gateway/config/security/WebfluxSecurityConfig.java

@@ -33,6 +33,7 @@ public PasswordEncoder passwordEncoder() {
     @Bean
     public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
         return http
+                .cors(ServerHttpSecurity.CorsSpec::disable)
                 .csrf(ServerHttpSecurity.CsrfSpec::disable)
                 .authorizeExchange(auth -> auth
                         .anyExchange().permitAll()