feat: Add configurable cookie domain to gatekeeper and enhance Varnish backend configuration with health probes and increased timeouts.

docker-compose.yml

@@ -66,6 +66,7 @@ services:
       - ${ENV_FILE:-.env}
     environment:
       PORT: 3000
+      COOKIE_DOMAIN: ${COOKIE_DOMAIN}
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.${PROJECT_NAME:-klz-cables}-gatekeeper.loadbalancer.server.port=3000"

gatekeeper/index.js

@@ -5,6 +5,7 @@ const path = require('path');
 const app = express();
 const PORT = process.env.PORT || 3000;
 const GATEKEEPER_PASSWORD = process.env.GATEKEEPER_PASSWORD || 'klz2026';
+const COOKIE_DOMAIN = process.env.COOKIE_DOMAIN;
 const AUTH_COOKIE_NAME = 'klz_gatekeeper_session';
 
 app.set('view engine', 'ejs');
@@ -34,7 +35,7 @@ app.get('/verify', (req, res) => {
 app.get('/gatekeeper/login', (req, res) => {
   res.render('login', {
     error: req.query.error ? 'Invalid password' : null,
-        redirect: req.query.redirect || '/'
+    redirect: req.query.redirect || '/',
   });
 });
 
@@ -43,12 +44,18 @@ app.post('/gatekeeper/login', (req, res) => {
   const { password, redirect } = req.body;
 
   if (password === GATEKEEPER_PASSWORD) {
-        res.cookie(AUTH_COOKIE_NAME, GATEKEEPER_PASSWORD, {
+    const cookieOptions = {
       httpOnly: true,
       secure: true,
       path: '/',
-            maxAge: 30 * 24 * 60 * 60 * 1000 // 30 days
-        });
+      maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
+    };
+
+    if (COOKIE_DOMAIN) {
+      cookieOptions.domain = COOKIE_DOMAIN;
+    }
+
+    res.cookie(AUTH_COOKIE_NAME, GATEKEEPER_PASSWORD, cookieOptions);
     return res.redirect(redirect || '/');
   }
 

varnish/default.vcl

@@ -2,12 +2,21 @@ vcl 4.1;
 
 import std;
 
+probe default_probe {
+    .url = "/en";
+    .timeout = 2s;
+    .interval = 5s;
+    .window = 5;
+    .threshold = 3;
+}
+
 backend default {
     .host = "klz-app";
     .port = "3000";
-    .connect_timeout = 5s;
-    .first_byte_timeout = 90s;
-    .between_bytes_timeout = 5s;
+    .connect_timeout = 10s;
+    .first_byte_timeout = 300s;
+    .between_bytes_timeout = 10s;
+    .probe = default_probe;
 }
 
 acl purge {