Enable local deployment to improve development and testing

.gitignore

@@ -30,3 +30,4 @@ venv/
 ## Testing
 .pytest_cache/
 *.log
+birdhouse/data/

CHANGES.md

@@ -15,7 +15,49 @@
 [Unreleased](https://github.com/bird-house/birdhouse-deploy/tree/master) (latest)
 ------------------------------------------------------------------------------------------------------------------
 
-[//]: # (list changes here, using '-' for each new entry, remove this when items are added)
+## Changes
+
+- Enable local deployment to improve development and testing
+
+  The Birdhouse stack can now be deployed locally and accessed on a browser on the host machine without the need 
+  for an SSL certificate. This is useful for local development and for running tests against the full stack while developing and in CI environments.
+
+  To enable this, add the new `optional-components/local-dev-test` component to `BIRDHOUSE_EXTRA_CONF_DIRS` and
+  set the following environment variables in the local environment file:
+
+  * `export BIRDHOUSE_FQDN=host.docker.internal`
+  * `export BIRDHOUSE_HTTP_ONLY=True`
+
+  You should also add ``host.docker.internal`` to your ``/etc/hosts`` file pointing to the loopback address so 
+  that URLs generated by Birdhouse that refer to ``host.docker.internal`` will resolve properly in a browser:
+
+  ```
+  echo '127.0.0.1    host.docker.internal' | sudo tee -a /etc/hosts
+  ```
+
+  After deploying the stack, you can now interact with the Birdhouse software at ``http://host.docker.internal`` 
+  from the machine that is the docker host.
+
+  In order to implement the changes above, the following non-breaking changes have been made to the deployment code:
+
+  - added a configuration variable `BIRDHOUSE_HTTP_ONLY` which is not set by default. If set to `True` the `proxy` component will only serve content over `http` (not `https`).
+  - added the following configuration variables. These should not be set directly unless you really know what you're doing:
+    - `BIRDHOUSE_PROXY_SCHEME`: default is `http` if `BIRDHOUSE_HTTP_ONLY` is `True`, otherwise `https`
+    - `PROXY_INCLUDE_HTTPS`: default is unset if `BIRDHOUSE_HTTP_ONLY` is `True`, otherwise `include /etc/nginx/conf.d/https.include;`
+  - changed the default values for the following configuration variables:
+    - `BIRDHOUSE_ALLOW_UNSECURE_HTTP`: default is now `True` if `BIRDHOUSE_HTTP_ONLY` is `True`
+  - logs are written to stderr by default. Previously they were written to stdout.
+    - this allows us to call scripts and programmatically use their outputs. Previously log entries would need to be 
+      manually filtered out before program outputs could be used.
+    - added the `--log-stdout` and `--log-file` flags to the `bin/birdhouse` interface to allow redirecting logs to 
+      stdout or to a specific file instead.
+    - log redirection can also now be set using environment variables:
+      - `BIRDHOUSE_LOG_FD` can be used to redirect logs to a file descriptor (ex: `BIRDHOUSE_LOG_FD=3`)
+      - `BIRDHOUSE_LOG_FILE` can be used to redirect logs to file (ex: `BIRDHOUSE_LOG_FILE=/some/file/on/disk.log`)
+      - Note that the variables here should not be set in the local environment file since that file is sourced **after**
+        some logs are written. Instead, set these by exporting them in the parent process that calls `bin/birdhouse`.
+    - for backwards compatibility, if scripts are not called through the `bin/birdhouse` interface, logs will still be 
+      written to stdout.
 
 [2.6.2](https://github.com/bird-house/birdhouse-deploy/tree/2.6.2) (2024-12-03)
 ------------------------------------------------------------------------------------------------------------------

bin/birdhouse

@@ -7,7 +7,7 @@ COMPOSE_DIR="$(dirname "${THIS_DIR}")/birdhouse"
 export BIRDHOUSE_COMPOSE="${BIRDHOUSE_COMPOSE:-"${COMPOSE_DIR}/birdhouse-compose.sh"}"
 export __BIRDHOUSE_SUPPORTED_INTERFACE=True
 
-USAGE="USAGE: $0 [-h|--help] [-b|--backwards-compatible] [-e|--env-file local-env-file] {info|compose|configs}"
+USAGE="USAGE: $0 [-h|--help] [-b|--backwards-compatible] [-e|--env-file local-env-file] {[--log-stdout] | [--log-file log-file-path]} {info|compose|configs}"
 HELP="$USAGE
 
 Manage the Birdhouse software stack.
@@ -21,6 +21,8 @@ Options:
   -h, --help                   Print this message and exit
   -b, --backwards-compatible   Run in backwards compatible mode
   -e, --env-file string        Override the local environment file, default is ${COMPOSE_DIR}/env.local
+  --log-stdout                 Write logs to stdout, default is to write to stderr
+  --log-file string            Write logs to this file path, default is to write to stderr
 "
 
 CONFIGS_USAGE="USAGE: $0 configs [-h|--help] [-d|--default] {[-p|--print-config-command] | [-c|--command command]}"
@@ -194,6 +196,26 @@ parse_args() {
       shift
       parse_args "$@"
       ;;
+    --log-stdout)
+      shift
+      [ "${LOG_FILE}" = 'True' ] && parse_args 'invalid arg that triggers usage message'
+      export BIRDHOUSE_LOG_FD=1 # The argument here takes precedence over the env variable
+      LOG_STDOUT=True
+      parse_args "$@"
+      ;;
+    -l=|--log-file=*)
+      arg_value="${1#*=}"
+      shift
+      parse_args --log-file "${arg_value}" "$@"
+      ;;
+    -l|--log-file)
+      shift
+      [ "${LOG_STDOUT}" = 'True' ] && parse_args 'invalid arg that triggers usage message'
+      export BIRDHOUSE_LOG_FILE=$(realpath "$1") # The argument here takes precedence over the env variable
+      LOG_FILE=True
+      shift
+      parse_args "$@"
+      ;;
     info)
       shift
       "${BIRDHOUSE_COMPOSE}" info "$@"
@@ -212,7 +234,7 @@ parse_args() {
       echo "$HELP"
       ;;
     -??*)
-      parse_multiple_short_flags parse_configs_args "$@"
+      parse_multiple_short_flags parse_args "$@"
       ;;
     *)
       >&2 echo "$USAGE"

birdhouse/birdhouse-compose.sh

@@ -105,8 +105,8 @@ fi
 
 create_compose_conf_list # this sets COMPOSE_CONF_LIST
 log INFO "Displaying resolved compose configurations:"
-echo "COMPOSE_CONF_LIST="
-echo ${COMPOSE_CONF_LIST} | tr ' ' '\n' | grep -v '^-f'
+log INFO "COMPOSE_CONF_LIST="
+log INFO ${COMPOSE_CONF_LIST} | tr ' ' '\n' | grep -v '^-f'
 
 if [ x"$1" = x"info" ]; then
   log INFO "Stopping before execution of docker-compose command."
@@ -123,12 +123,17 @@ if [ x"$1" = x"up" ]; then
       log INFO "Executing '$COMPONENT_PRE_COMPOSE_UP'"
       sh ${SHELL_EXEC_FLAGS} "$COMPONENT_PRE_COMPOSE_UP"
     fi
+    COMPONENT_PRE_COMPOSE_UP_INCLUDE="$adir/pre-docker-compose-up.include"
+    if [ -f "$COMPONENT_PRE_COMPOSE_UP_INCLUDE" ]; then
+      log INFO "Sourcing '$COMPONENT_PRE_COMPOSE_UP_INCLUDE'"
+      . "$COMPONENT_PRE_COMPOSE_UP_INCLUDE"
+    fi
   done
 fi
 
 log INFO "Executing docker-compose with extra options: $* ${COMPOSE_EXTRA_OPTS}"
-# the PROXY_SECURE_PORT is a little trick to make the compose file invalid without the usage of this wrapper script
-PROXY_SECURE_PORT=443 HOSTNAME=${BIRDHOUSE_FQDN} docker-compose ${COMPOSE_CONF_LIST} $* ${COMPOSE_EXTRA_OPTS}
+# the PROXY_HTTP_PORT is a little trick to make the compose file invalid without the usage of this wrapper script
+PROXY_HTTP_PORT=80 HOSTNAME=${BIRDHOUSE_FQDN} docker-compose ${COMPOSE_CONF_LIST} $* ${COMPOSE_EXTRA_OPTS}
 ERR=$?
 if [ ${ERR} -gt 0 ]; then
   log ERROR "docker-compose error, exit code ${ERR}"
@@ -148,11 +153,11 @@ while [ $# -gt 0 ]
 do
   if [ x"$1" = x"up" ]; then
     # we restart the proxy after an up to make sure nginx continue to work if any container IP address changes
-    PROXY_SECURE_PORT=443 HOSTNAME=${BIRDHOUSE_FQDN} docker-compose ${COMPOSE_CONF_LIST} restart proxy
+    PROXY_HTTP_PORT=80 HOSTNAME=${BIRDHOUSE_FQDN} docker-compose ${COMPOSE_CONF_LIST} restart proxy
 
     # run postgres post-startup setup script
     # Note: this must run before the post-docker-compose-up scripts since some may expect postgres databases to exist
-    postgres_id=$(PROXY_SECURE_PORT=443 HOSTNAME=${BIRDHOUSE_FQDN} docker-compose ${COMPOSE_CONF_LIST} ps -q postgres 2> /dev/null)
+    postgres_id=$(PROXY_HTTP_PORT=80 HOSTNAME=${BIRDHOUSE_FQDN} docker-compose ${COMPOSE_CONF_LIST} ps -q postgres 2> /dev/null)
     if [ ! -z "$postgres_id" ]; then
       docker exec ${postgres_id} /postgres-setup.sh
     fi

birdhouse/components/README.rst

@@ -540,7 +540,7 @@ exposed by the current stack instance. Once this component is enabled, STAC API
 ``https://<BIRDHOUSE_FQDN_PUBLIC>/stac-browser`` endpoint. In order to make the STAC browser the default entrypoint,
 define the following in the ``env.local`` file::
 
-  export BIRDHOUSE_PROXY_ROOT_LOCATION="return 302 https://\$host/stac-browser;"
+  export BIRDHOUSE_PROXY_ROOT_LOCATION='return 302 ${BIRDHOUSE_PROXY_SCHEME}://\$host/stac-browser;'
 
 Here is a sample search query using a CLI::
 
@@ -567,7 +567,7 @@ An endpoint monitoring tool that shows the current status of other components in
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}/canarie``
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/canarie``
 
 How to Enable the Component
 ---------------------------
@@ -599,7 +599,7 @@ degree-days of cooling, the duration of heatwaves, etc. This returns annual valu
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch``
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch``
 
 How to Enable the Component
 ---------------------------
@@ -618,7 +618,7 @@ Geospatial Web.
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}/geoserver``. For usage and
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/geoserver``. For usage and
 configuration options please refer to the `Geoserver documentation`_.
 
 .. _Geoserver documentation: https://docs.geoserver.org
@@ -637,7 +637,7 @@ A Web Processing Service for compliance checks used in the climate science commu
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/hummingbird``
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/hummingbird``
 
 How to Enable the Component
 ---------------------------
@@ -654,7 +654,7 @@ end-users.
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}/jupyter``. Users are able to log in to Jupyterhub using the
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/jupyter``. Users are able to log in to Jupyterhub using the
 same user name and password as Magpie. They will then be able to launch a personal jupyterlab server.
 
 How to Enable the Component
@@ -673,7 +673,7 @@ User/Group/Service/Resource/Permission management and integrates with Twitcher.
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}/magpie``. For usage and configuration options please
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/magpie``. For usage and configuration options please
 refer to the `Magpie documentation`_.
 
 .. _Magpie documentation: https://pavics-magpie.readthedocs.io
@@ -706,7 +706,7 @@ A web based container deployment and management tool.
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}/portainer/``. For usage and configuration options please
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/portainer/``. For usage and configuration options please
 refer to the `portainer documentation`_.
 
 How to Enable the Component
@@ -757,7 +757,7 @@ processing as well as time series analysis.
 Usage
 -----
 
-The service is available at ``https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/raven``
+The service is available at ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/raven``
 
 How to Enable the Component
 ---------------------------
@@ -775,7 +775,7 @@ Climate Data Catalog and Format Renderers. See the `Thredds documentation`_ for
 Usage
 -----
 
-The catalog is available at the ``https://${BIRDHOUSE_FQDN_PUBLIC}/thredds`` endpoint.
+The catalog is available at the ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/thredds`` endpoint.
 
 How to Enable the Component
 ---------------------------
@@ -811,7 +811,7 @@ of all processes executed by these services.
 Usage
 -----
 
-All outputs from these processes will become available at the ``https://${BIRDHOUSE_FQDN_PUBLIC}/wpsoutputs`` endpoint.
+All outputs from these processes will become available at the ``${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/wpsoutputs`` endpoint.
 
 By default, this endpoint is not protected. To secure access to this endpoint it is highly recommended to enable the
 `./optional-components/secure-data-proxy` component as well.

birdhouse/components/canarie-api/docker_configuration.py.template

@@ -10,7 +10,7 @@ import requests_cache  # see entrypoint script
 
 logger = logging.getLogger("canarie-api-config")
 
-MY_SERVER_NAME = 'https://${BIRDHOUSE_FQDN_PUBLIC}/canarie'
+MY_SERVER_NAME = '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/canarie'
 
 DATABASE = {
     'filename': '/data/stats.db',
@@ -125,7 +125,7 @@ SERVICES = {
             'releasenotes': '${BIRDHOUSE_RELEASE_NOTES_URL}',
             'support': '${BIRDHOUSE_SUPPORT_URL}',
             'source': 'https://github.com/bird-house/birdhouse-deploy',
-            'tryme': 'https://${BIRDHOUSE_FQDN_PUBLIC}',
+            'tryme': '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}',
             'licence': '${BIRDHOUSE_LICENSE_URL}',
             'provenance': 'https://pavics-sdi.readthedocs.io/en/latest/provenance/index.html'
         },
@@ -157,7 +157,7 @@ PLATFORMS = {
             'releasenotes': 'https://github.com/bird-house/birdhouse-deploy/releases',
             'support': 'https://github.com/Ouranosinc/pavics-sdi/issues',
             'source': 'https://github.com/Ouranosinc/pavics-sdi',
-            'tryme': 'https://${BIRDHOUSE_FQDN_PUBLIC}',
+            'tryme': '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}',
             'licence': 'https://pavics-sdi.readthedocs.io/en/latest/license.html',
             'provenance': 'https://pavics-sdi.readthedocs.io/en/latest/provenance/index.html',
             'factsheet': 'http://www.canarie.ca/software/pavics'

birdhouse/components/cowbird/config/canarie-api/canarie_api_monitoring.py.template

@@ -19,7 +19,7 @@ SERVICES['Cowbird'] = {
         'releasenotes': 'https://github.com/Ouranosinc/cowbird//blob/master/CHANGES.rst',
         'support': 'https://github.com/Ouranosinc/cowbird//issues',
         'source': 'https://github.com/Ouranosinc/cowbird/',
-        'tryme': 'https://${BIRDHOUSE_FQDN_PUBLIC}/cowbird/',
+        'tryme': '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/cowbird/',
         'licence': 'https://github.com/Ouranosinc/cowbird//blob/${COWBIRD_VERSION}/LICENSE',
         'provenance': 'https://github.com/Ouranosinc/cowbird/'
     },

birdhouse/components/cowbird/config/cowbird/config.yml.template

@@ -21,7 +21,7 @@ handlers:
     admin_password: ${GEOSERVER_ADMIN_PASSWORD}
   Catalog:
     active: true
-    url: https://${BIRDHOUSE_FQDN_PUBLIC}/twitcher/ows/proxy/catalog
+    url: ${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/twitcher/ows/proxy/catalog
     workspace_dir: ${WORKSPACE_DIR}
   Thredds:
     active: true

birdhouse/components/cowbird/config/cowbird/cowbird.ini.template

@@ -32,7 +32,7 @@ mongo_uri = mongodb://${COWBIRD_MONGODB_HOST}:${COWBIRD_MONGODB_PORT}/cowbird
 #   below values are for the external definitions after proxy resolution
 #   internal app access is defined in [server:main] section
 cowbird.port =
-cowbird.url = https://${BIRDHOUSE_FQDN_PUBLIC}/cowbird
+cowbird.url = ${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/cowbird
 
 [app:api_app]
 use = egg:Paste#static

birdhouse/components/cowbird/config/proxy/conf.extra-service.d/cowbird.conf.template

@@ -1,6 +1,6 @@
 
     location /cowbird {
-        proxy_pass https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/cowbird;
+        proxy_pass ${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/cowbird;
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Host $host:$server_port;

birdhouse/components/finch/config/canarie-api/canarie_api_monitoring.py.template

@@ -34,7 +34,7 @@ SERVICES['indices'] = {
     'monitoring': {
         'Finch': {
             'request': {
-                'url': 'https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch?service=WPS&version=1.0.0&request=GetCapabilities'
+                'url': '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch?service=WPS&version=1.0.0&request=GetCapabilities'
             }
         },
     }

birdhouse/components/finch/service-config.json.template

@@ -14,7 +14,7 @@
       {
         "rel": "service",
         "type": "text/xml",
-        "href": "https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch?service=WPS&request=GetCapabilities"
+        "href": "${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch?service=WPS&request=GetCapabilities"
       },
       {
         "rel": "service-doc",
@@ -24,7 +24,7 @@
       {
         "rel": "service-desc",
         "type": "text/xml",
-        "href": "https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch?service=WPS&request=GetCapabilities"
+        "href": "${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_PROTECTED_PATH}/finch?service=WPS&request=GetCapabilities"
       },
       {
         "rel": "service-meta",

birdhouse/components/finch/wps.cfg.template

@@ -1,5 +1,5 @@
 [server]
-outputurl = https://${BIRDHOUSE_FQDN_PUBLIC}/wpsoutputs/finch
+outputurl = ${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/wpsoutputs/finch
 outputpath = /data/wpsoutputs/finch
 
 # default 3mb, fix "Broken pipe" between the proxy and the wps service

birdhouse/components/geoserver/config/canarie-api/canarie_api_monitoring.py.template

@@ -24,14 +24,14 @@ SERVICES['GeoServer'] = {
         'releasenotes': 'https://geoserver.org/release/${GEOSERVER_VERSION}/',
         'support': 'https://github.com/kartoza/docker-geoserver/issues',
         'source': 'https://github.com/kartoza/docker-geoserver',
-        'tryme': 'https://${BIRDHOUSE_FQDN_PUBLIC}/geoserver/',
+        'tryme': '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/geoserver/',
         'licence': 'https://github.com/geoserver/geoserver/blob/${GEOSERVER_VERSION}/LICENSE.txt',
         'provenance': 'https://github.com/kartoza/docker-geoserver'
     },
     "monitoring": {
         "GeoServer": {
             'request': {
-                'url': 'https://${BIRDHOUSE_FQDN_PUBLIC}/geoserver/web/'
+                'url': '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/geoserver/web/'
             }
         }
     }

birdhouse/components/geoserver/config/proxy/conf.extra-service.d/geoserver.conf.template

@@ -19,7 +19,7 @@
         # If GEOSERVER_SKIP_AUTH is "True" then the following section is skipped and this
         # location block will always return 200 (which means that the /geoserver/ location, above,
         # will be publicly available.
-        proxy_pass https://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_VERIFY_PATH}/geoserver$request_uri;
+        proxy_pass ${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}${TWITCHER_VERIFY_PATH}/geoserver$request_uri;
         proxy_pass_request_body off;
         proxy_set_header Host $host;
         proxy_set_header Content-Length "";

birdhouse/components/geoserver/docker-compose-extra.yml

@@ -21,7 +21,7 @@ services:
       MAXIMUM_MEMORY: 8G
       # https://github.com/kartoza/docker-geoserver#proxy-base-url
       HTTP_PROXY_NAME: ${BIRDHOUSE_FQDN_PUBLIC}
-      HTTP_SCHEME: https
+      HTTP_SCHEME: ${BIRDHOUSE_PROXY_SCHEME}
     volumes:
       # run deployment/fix-geoserver-data-dir-perm on existing
       # GEOSERVER_DATA_DIR to match user geoserveruser inside docker image

birdhouse/components/geoserver/service-config.json.template

@@ -20,7 +20,7 @@
       {
         "rel": "service",
         "type": "text/html",
-        "href": "https://${BIRDHOUSE_FQDN_PUBLIC}/geoserver/"
+        "href": "${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}/geoserver/"
       },
       {
         "rel": "service-doc",