Add a reverse proxy to enable grpc-web for webapps

This is needed because there's no browser api with enough control over http/2
requests, so we need a proxy that connects to the RPC backend and handle the
communication between the app and service.

The service is named "databroker-grpc-web-proxy.service" because each proxy
instance connects to only one gRPC service, more services will be added to
connect to other gRPC services.

Bug-AGL: SPEC-4599

Signed-off-by: Roger Zanoni <rzanoni@igalia.com>
Change-Id: I3b5bf6521dc0683639520626819c6a54be839e53
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl-demo/+/29425
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
Tested-by: Jenkins Job builder account
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>

5 files changed, 56 insertions, 1 deletions

diff --git a/recipes-wam/grpc-web-proxy/files/databroker-grpc-web-proxy.env b/recipes-wam/grpc-web-proxy/files/databroker-grpc-web-proxy.env
new file mode 100644
index 000000000..1435253d3
--- /dev/null
+++ b/recipes-wam/grpc-web-proxy/files/databroker-grpc-web-proxy.env
@@ -0,0 +1,7 @@
+EXTRA_ARGS="--backend_addr=localhost:55555 \
+  --backend_client_tls_key_file=/etc/kuksa-val/Client.key \
+  --backend_client_tls_cert_file=/etc/kuksa-val/Client.pem \
+  --server_tls_key_file=/etc/kuksa-val/Server.key \
+  --server_tls_cert_file=/etc/kuksa-val/Server.pem \
+  --backend_tls_ca_files=/etc/kuksa-val/CA.pem --backend_tls=true \
+  --server_http_tls_port=8888 --run_tls_server=true --allowed_origins=true"
diff --git a/recipes-wam/grpc-web-proxy/files/databroker-grpc-web-proxy.service b/recipes-wam/grpc-web-proxy/files/databroker-grpc-web-proxy.service
new file mode 100644
index 000000000..ff6afe44d
--- /dev/null
+++ b/recipes-wam/grpc-web-proxy/files/databroker-grpc-web-proxy.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=gRPC web reverse proxy to kuksa.val databroker
+Requires=kuksa-databroker.service
+After=kuksa-databroker.service
+
+[Service]
+User=kuksa
+EnvironmentFile=-/etc/default/databroker-grpc-web-proxy.env
+ExecStart=/usr/bin/grpcwebproxy $EXTRA_ARGS
+Restart=on-abort
+
+[Install]
+WantedBy=multi-user.target
diff --git a/recipes-wam/grpc-web-proxy/grpc-web-proxy_git.bb b/recipes-wam/grpc-web-proxy/grpc-web-proxy_git.bb
new file mode 100644
index 000000000..dfb763b64
--- /dev/null
+++ b/recipes-wam/grpc-web-proxy/grpc-web-proxy_git.bb
@@ -0,0 +1,34 @@
+SUMMARY = "A small reverse proxy that can front existing gRPC servers and expose their functionality using gRPC-Web protocol, allowing for the gRPC services to be consumed from browsers."
+HOMEPAGE = "https://github.com/improbable-eng/grpc-web"
+
+inherit go-mod systemd
+
+RDEPENDS:${PN} = "bash"
+RDEPENDS:${PN}-dev = "bash"
+
+GO_IMPORT = "github.com/improbable-eng/grpc-web"
+GO_INSTALL = "${GO_IMPORT}/go/grpcwebproxy"
+
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE.txt;md5=71a6955f3cd81a809549da266346dc59"
+
+SRCREV = "1d9bbb09a0990bdaff0e37499570dbc7d6e58ce8"
+SRC_URI = "git://${GO_IMPORT};branch=master;protocol=https \
+           file://databroker-grpc-web-proxy.env \
+           file://databroker-grpc-web-proxy.service"
+
+do_compile[network] = "1"
+
+do_install:append() {
+    install -d ${D}${systemd_system_unitdir}
+    install -m 0644 ${WORKDIR}/databroker-grpc-web-proxy.service ${D}${systemd_system_unitdir}
+
+    install -d ${D}${sysconfdir}/default
+    install -m 0644 ${WORKDIR}/databroker-grpc-web-proxy.env ${D}${sysconfdir}/default/databroker-grpc-web-proxy.env
+}
+
+SYSTEMD_SERVICE:${PN} = "databroker-grpc-web-proxy.service"
+
+FILES:${PN} = "${bindir} \
+               ${systemd_system_unitdir} \
+               ${sysconfdir}/default "
diff --git a/recipes-wam/wam/files/WebAppMgr-cef.env b/recipes-wam/wam/files/WebAppMgr-cef.env
index 557f0d482..adc18b94d 100644
--- a/recipes-wam/wam/files/WebAppMgr-cef.env
+++ b/recipes-wam/wam/files/WebAppMgr-cef.env
@@ -77,4 +77,5 @@ WAM_SWITCHES="\
   --agl-shell-appid=homescreen \
   --disable-gpu-vsync \
   --ignore-gpu-blocklist \
+  --allow-universal-access-from-files \
   --allow-file-access-from-files"
diff --git a/recipes-wam/wam/wam_git.bb b/recipes-wam/wam/wam_git.bb
index 9f2c79ad1..f80433c4a 100644
--- a/recipes-wam/wam/wam_git.bb
+++ b/recipes-wam/wam/wam_git.bb
@@ -52,7 +52,7 @@ FILES:${PN} += "${sysconfdir}/init \
                 ${bindir} \
                 ${libdir}/webappmanager/plugins/*.so"
 
-RDEPENDS:${PN} += " bash"
+RDEPENDS:${PN} += " bash grpc-web-proxy"
 
 PROVIDES += "virtual/webruntime"
 RPROVIDES:${PN} += "virtual/webruntime"