# Module: kong (`docker/kong/`)
Purpose: DB-less Kong 3.9 API gateway — the single entry point for every SPA and every Yii backend (one ALB → Kong :8000). Owner: Sanjay.
Entry points: `kong.yml` (ECS flavour, baked into the image by `Dockerfile`), `kong1.yml` (Docker Compose flavour, bind-mounted by `docker-compose.yml`), `manager-auth.conf` + `htpasswd` (local basic-auth proxy `kong-auth` in front of Admin API/Manager), `konnect/` (optional Kong Konnect data-plane mode for local, see `konnect/README.md`).
Config: declarative only (`_format_version: "3.0"`, `KONG_DATABASE=off`). Local: edit `kong1.yml`, then `docker compose restart kong`. ECS: edit `kong.yml`, CI rebuilds image `b2g/kong`. Admin API / Kong Manager edits are silently discarded on restart.
Routes (all `strip_path: true` except `/`): `/healthz` → terminated in Kong (200 "ok"); `/micro/web` → micro:80; `/micro/api` → micro:81; `/usermg/web` → usermgmt:80; `/api` → usermgmt:81 (auth API); `/profilemg/web`; `/configmg/web`; `/digitall/web` (120s timeouts); `/filemst/api` → :81, `/filemst/backend` → :82, `/filemst/storage` → :84; `/cengex/web`; `/gmarketapi/web`; `/mail/web`; `/subpayment/web`; `/zohoapi/web`; `/nibedatamgnr/web` → nibe; SPAs `/app` → fe-b2g, `/market` → fe-gmarket, `/filems` → fe-filems, `/nibe` → fe-nibe, `/` → fe-website (catch-all, `strip_path: false`).
Plugins: one global `cors` (origins `*`, `credentials: false`) — a backstop only; browser traffic is same-origin. No auth plugin on routes; auth is enforced by the backends.
Invariants:
- `kong.yml` and `kong1.yml` must keep identical route tables (names, prefixes, `strip_path`); only upstream hosts differ (`<name>.b2g.local` Service Connect DNS vs Compose container DNS).
- Route prefixes must match the frontends' `environment.docker.ts` keys and their `baseHref`s (`/app/`, `/market/`, `/filems/`, `/nibe/`, `/`).
- Keep CORS `credentials: false` with `origins: ["*"]` (the combination with `true` is invalid and browsers reject it).
- `/healthz` must stay terminated inside Kong so ALB health does not depend on any upstream.
- Never commit Konnect `cluster.key`, tokens or `.env.konnect` values; never paste `htpasswd` contents anywhere.
- Admin (:8001) and Manager (:8002) must never be exposed on the public ALB listener — only :8000.
Gotchas:
- `/nibedatamgnr/web` must strip the `/web` too, else nibe returns its Yii HTML home page ("Unexpected token '<'" in the browser).
- digitall upstream timeouts are 120s; the ALB idle timeout must also be >= 120s or it cuts the request first.
- `Dockerfile` header comment says upstreams point at Compose DNS — stale; `kong.yml` already uses `*.b2g.local` (verify before relying on the comment).
- A longer prefix always wins, so a new API route can never collide with the `/` catch-all, but a typo'd frontend URL silently falls through to fe-website (redirects to `/home`) instead of 404ing.
- `konnect/` holds `cluster.crt`; Konnect mode is a local-only experiment, not used on ECS (verify).
Prod debugging: CloudWatch `/ecs/b2g-prod/kong` (demo: `/ecs/b2g-demo/kong`); health on :8000 via `kong health` (image has no wget/curl) and `/healthz`; ECS service `kong`, task family `b2g-kong` / `b2g-demo-kong`; browser devtools network tab for 4xx/CORS. Runbooks: `docs/runbooks/`.