refactor: replace nginx with Go backend

Replace the nginx reverse proxy with a custom Go server
that embeds and serves static files. Supports TLS with
automatic fallback to HTTP-only when certs are absent.

Switches the Dockerfile to a multi-stage build (Node →
Go → ubi9-micro) and removes the nginx ConfigMap from
the Helm chart.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Matej Vašek <matejvasek@gmail.com>

Author: 2 people

Dockerfile

@@ -1,15 +1,33 @@
-FROM registry.access.redhat.com/ubi9/nodejs-22:latest AS build
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/nodejs-22:latest AS build
 USER root
 ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 RUN npm i -g corepack && corepack enable
 
-ADD . /usr/src/app
 WORKDIR /usr/src/app
-RUN yarn install --immutable && yarn build
 
-FROM registry.access.redhat.com/ubi9/nginx-120:latest
+COPY package.json yarn.lock .yarnrc.yml ./
+COPY .yarn/ .yarn/
+RUN yarn install --immutable
 
-COPY --from=build /usr/src/app/dist /usr/share/nginx/html
+COPY --exclude=node_modules --exclude=backend . .
+RUN  yarn build
+
+FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi9/go-toolset:1.24 AS go-build
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /opt/app-root/src/backend
+
+COPY --chown=1001:0 backend/go.mod backend/go.sum /opt/app-root/src/backend/
+RUN go mod download
+
+COPY --chown=1001:0 --from=build /usr/src/app/dist /opt/app-root/src/backend/static
+COPY --chown=1001:0 backend/ /opt/app-root/src/backend/
+RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-s -w" -o plugin-backend .
+
+FROM registry.access.redhat.com/ubi9-micro:latest
+
+COPY --from=go-build /opt/app-root/src/backend/plugin-backend /usr/bin/plugin-backend
 USER 1001
 
-ENTRYPOINT ["nginx", "-g", "daemon off;"]
+ENTRYPOINT ["plugin-backend"]

backend/go.mod

@@ -0,0 +1,3 @@
+module github.com/openshift/console-plugin-template/backend
+
+go 1.23.0

backend/go.sum

@@ -0,0 +1,72 @@
+package main
+
+import (
+	"crypto/tls"
+	"embed"
+	"flag"
+	"fmt"
+	"io/fs"
+	"log"
+	"net"
+	"net/http"
+	"os"
+)
+
+//go:embed static/*
+var staticFiles embed.FS
+
+func main() {
+	httpPort := flag.Int("http-port", 8080, "HTTP server port")
+	httpsPort := flag.Int("https-port", 8443, "HTTPS server port")
+	certFile := flag.String("cert", "/var/cert/tls.crt", "TLS certificate file")
+	keyFile := flag.String("key", "/var/cert/tls.key", "TLS key file")
+	flag.Parse()
+
+	static, err := fs.Sub(staticFiles, "static")
+	if err != nil {
+		log.Fatalf("Failed to create sub filesystem: %v", err)
+	}
+
+	handler := loggingMiddleware(http.FileServer(http.FS(static)))
+
+	_, certErr := os.Stat(*certFile)
+	_, keyErr := os.Stat(*keyFile)
+	if certErr == nil && keyErr == nil {
+		go func() {
+			ln, err := net.Listen("tcp", fmt.Sprintf(":%d", *httpPort))
+			if err != nil {
+				log.Fatal(err)
+			}
+			log.Printf("Listening on http://%s", ln.Addr())
+			log.Fatal(http.Serve(ln, handler))
+		}()
+
+		cert, err := tls.LoadX509KeyPair(*certFile, *keyFile)
+		if err != nil {
+			log.Fatalf("Failed to load TLS certificate: %v", err)
+		}
+		ln, err := net.Listen("tcp", fmt.Sprintf(":%d", *httpsPort))
+		if err != nil {
+			log.Fatal(err)
+		}
+		tlsLn := tls.NewListener(ln, &tls.Config{
+			Certificates: []tls.Certificate{cert},
+		})
+		log.Printf("Listening on https://%s", ln.Addr())
+		log.Fatal(http.Serve(tlsLn, handler))
+	} else {
+		ln, err := net.Listen("tcp", fmt.Sprintf(":%d", *httpPort))
+		if err != nil {
+			log.Fatal(err)
+		}
+		log.Printf("TLS certificate not found, listening on http://%s", ln.Addr())
+		log.Fatal(http.Serve(ln, handler))
+	}
+}
+
+func loggingMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		log.Printf("%s %s %s", r.RemoteAddr, r.Method, r.URL.Path)
+		next.ServeHTTP(w, r)
+	})
+}

backend/main.go

@@ -26,6 +26,8 @@ spec:
           ports:
             - containerPort: {{ .Values.plugin.port }}
               protocol: TCP
+          args:
+            - "--https-port={{ .Values.plugin.port }}"
           imagePullPolicy: {{ .Values.plugin.imagePullPolicy }}
           {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.containerSecurityContext) }}
           securityContext: {{ tpl (toYaml (omit .Values.plugin.containerSecurityContext "enabled")) $ | nindent 12 }}
@@ -36,19 +38,11 @@ spec:
             - name: {{ template "openshift-console-plugin.certificateSecret" . }}
               readOnly: true
               mountPath: /var/cert
-            - name: nginx-conf
-              readOnly: true
-              mountPath: /etc/nginx/nginx.conf
-              subPath: nginx.conf
       volumes:
         - name: {{ template "openshift-console-plugin.certificateSecret" . }}
           secret:
             secretName: {{ template "openshift-console-plugin.certificateSecret" . }}
             defaultMode: 420
-        - name: nginx-conf
-          configMap:
-            name: {{ template "openshift-console-plugin.name" . }}
-            defaultMode: 420
       restartPolicy: Always
       dnsPolicy: ClusterFirst
       {{- if and (.Values.plugin.securityContext.enabled) (.Values.plugin.podSecurityContext) }}

backend/static/.gitkeep

@@ -1,6 +1,17 @@
 # Claude Progress Log
 # Newest entries first. Agents: append your entry at the top after the header.
 
+---
+## 2026-03-30 | Session: Replace nginx with Go backend
+Worked on: Replaced nginx reverse proxy with custom Go backend server
+Completed:
+- Go backend serving static files with embed.FS
+- Multi-stage Dockerfile (Node build → Go build → ubi9-micro runtime)
+- TLS support with automatic fallback to HTTP-only
+- Removed nginx ConfigMap from Helm chart
+Left off: Function list page with data entries
+Blockers: None
+
 ---
 ## 2026-03-30 | Session: Empty state feature and docs restructure
 Worked on: Implemented function list empty state, restructured docs, added init.sh

charts/openshift-console-plugin/templates/configmap.yaml

@@ -42,6 +42,17 @@
     ],
     "passes": false
   },
+  {
+    "category": "technical",
+    "description": "Go backend: custom Go server replaces nginx for static file serving",
+    "steps": [
+      "Go server embeds and serves webpack-built static files",
+      "Multi-stage Dockerfile: Node build, Go build, ubi9-micro runtime",
+      "TLS support with automatic fallback to HTTP-only",
+      "Nginx ConfigMap removed from Helm chart"
+    ],
+    "passes": true
+  },
   {
     "category": "functional",
     "description": "Function Create Page renders form with all fields",