You're viewingApigee Edge documentation.
Go to theApigee X documentation.info

Support forNode.js proxies andsecure vaults

Since 2013, Apigee has supported theuse of Node.js proxies within Apigee Edge through the use ofTrireme, which enables you to run your Node.js code within Apigee Edge for Private Cloud and expose it as an API.

Apigee recommends Private Cloud customers take the following steps:

• Migrate data in secure vaults toEncrypted Key Value Maps (KVM) to access sensitive data from an API proxy.
• Migrate Trireme (Node.js) based API proxies to a native Node.js environment outside of Apigee.

See alsoApigee deprecations and retirements.

Public Cloud Retired feature: The traditional, Trireme-based Node.js support on Apigee Edge Cloud is retired and, by extension,apigee-access is also retired because it is only used in Trireme-based Node.js applications deployed on Apigee Edge. Trireme-based Node.js was retired on October 10, 2019. SeeTrireme-based Node.js End of Life.

What version of Node.js is supported on Apigee Edge?

Edge currently supports Node.js 0.10.32.

Which standard Node.js modules are supported on Edge?

Additional supported modules

This section lists additional modules that are not supported in standard Node.js, but are supported by Trireme and Trireme running on Apigee Edge.Trireme is the open-source Node.js container that runs on Apigee Edge. It is designed to run Node.js scripts inside a Java Virtual Machine (JVM). All of these modules are available on NPM.

Support for commonly used Node.js modules

• For standard input, you are limited to passing arguments using the ScriptTarget element of TargetEndpoint. SeeAdvanced ScriptTarget configuration for more information.
  
• For standard output, you are limited to using the Node.js Logs button in the Edge management UI for your proxy. You can also use the "apigeetool getlogs" command. For more information, seeDeploying a standalone Node.js app.
  
• Modules that depend on native code are not supported.
  
• Modules that depend on EcmaScript 6 features, such as Promises and Generators, are not supported.
  
• The Node.js runtime flags such as "harmony-proxies" are not supported.

Setting IP connection restrictions on Edge for Private Cloud

Edge for Private Cloud can restrict Node.js code from accessing IP addresses starting with “10.", "192.168", and localhost. If you attempt to access these IP addresses, you will see an error in the form:

{[Error:connectEINVAL]message:'connect EINVAL',code:'EINVAL',errno:'EINVAL',syscall:'connect'}

You can modify these restrictions by setting theconf_nodejs_connect.ranges.denied property in themessage-processors.properties file for each Message Processor. By default, this property has the value:

• Edge 4.17.05 and earlier:conf_nodejs_connect.ranges.denied=10.0.0.0/8,192.168.0.0/16,127.0.0.1/32
• Edge 4.17.09 and later:conf_nodejs_connect.ranges.denied= (meaning no restrictions)

To set this property:

1. Open themessage-processor.properties file in an editor. If the file does not exist, create it:
   > vi /<inst_root>/apigee/customer/application/message-processor.properties
2. Set the property as desired. For example, to deny access to only localhost:
   conf_nodejs_connect.ranges.denied=127.0.0.1/32
3. Save your changes.
4. Make sure the properties file is owned by the 'apigee' user:
   > chown apigee:apigee /<inst_root>/apigee/customer/application/message-processor.properties
5. Restart the Message Processor:
   > /<inst_root>/apigee/apigee-service/bin/apigee-service edge-message-processor restart

Understanding support for the http and https modules

All Node.js applications running in Apigee Edge must use thehttp orhttps module to listen for incoming requests. If you were to deploy a script that doesn't listen for incoming requests, it would simply execute and exit.

Thelisten method of thehttp andhttps modules in Node.js takes a port number as a parameter. For example:

svr.listen(process.env.PORT||9000,function(){console.log('The server is running.');});

This "port" argument is required in Node.js, but Apigee Edge ignores this parameter. Instead, the API proxy in which the Node.js script runs specifies the "virtual host" that it listens on, and the Node.js application uses those same virtual hosts, just like any other Apigee Edge proxy.

Every environment in Apigee has at least one virtual host. The virtual host defines the HTTP settings for connection with the Apigee organization. All API proxies in an environment share the same virtual hosts. By default, two virtual hosts are available for each environment:default andsecure. For more information, see Get Virtual Host andAPI development lifecycle.

Theapigeetool deploynodeapp command generates an Apigee Edge proxy wrapper around the Node.js application. When deployed, the Node.js application listens on the default virtual host defined for the environment. The URL for a Node.js application will always behttp://{org_name}-{env_name}.apigee.net.

Handling incoming requests

Like other Apigee Edge applications, if the proxy application is set up to listen on thesecure virtual host, then it will accept incoming requests using HTTPS.

Handling outgoing requests

In addition to receiving incoming traffic, Node.js applications inside Apigee Edge may use thehttp andhttps modules to make outbound requests like any other Node.js application. These modules work just as they always do inside Node.js.

Understanding support for the tls module

Apigee Edge supports theNode.js tls module. This module uses OpenSSL to provide Transport Layer Security (TLS) and/or Secure Socket Layer (SSL) encrypted stream communication. You can use thetls module to create secure connections to backend services from Node.js applications running on Edge.

To understand how thetls module works on Apigee Edge, it's important to understand howvirtual hosts are used on Apigee Edge. Every environment in Apigee has at least one virtual host. The virtual host defines the HTTP settings for connection with the Apigee organization. All API proxies in an environment share the same virtual hosts. By default, two virtual hosts are available for each environment:default andsecure. For more information on virtual hosts, see Get Virtual Host andAPI development lifecycle.

Now, let's look at how Apigee Edge handles TLS (SSL) communication for incoming and outgoing requests on Node.js applications:

Handling incoming requests

Depending on how virtual hosts are configured for your organization, Edge provides these options:

• If the API proxy is configured to listen on thedefault virtual host, then it accepts requests over HTTP.
• If the API proxy is configured to listen on thesecure virtual host, then it accepts requests over HTTPS. The URL will be under theapigee.net domain, and a wildcard SSL certificate for*.apigee.net will be used. As long as apps make requests to theapigee.net domain, then the SSL certificate will validate normally.

Handling outgoing requests

You can make outgoing requests with thetls module the same way you would normally in Node.js. Basically, you need to add client-side keys and certificates (.pem files) to theresources/node directory and load them inside your script. For information on using thetls module and its methods, see theNode.js tls module documentation.

Advanced ScriptTarget Configuration

<TargetEndpointname="default"><ScriptTarget><ResourceURL>node://hello.js</ResourceURL><EnvironmentVariables><EnvironmentVariablename="NAME">VALUE</EnvironmentVariable></EnvironmentVariables><Arguments><Argument>ARG</Argument></Arguments></ScriptTarget></TargetEndpoint>

{"TERM":"","JAVA_HOME":"","SHLVL":"","XFILESEARCHPATH":"","APIGEE_HOME":"","microkernel_overrideTokenFolder":"","working_dir":"","microkernel_host":"","PWD":"","microkernel_overrideTokenDirs":"","LOGNAME":"","_APIGEE_APP_ID":"","_":"","microkernel_defaultTokenFolder":"","NLSPATH":"","microkernel_timeout":"","SHELL":"","TMPDIR":"""microkernel_hasMonetization":"","USE_TOKENIZED_CONFIG":"","microkernel_org":"","PATH":"","microkernel_application":"","microkernel_installType":"","microkernel_instanceType":"","USER":"","HOME":"","APIGEE_ORGANIZATION":"","CONFIG_UTIL_HOME":"","microkernel_pod":"","APIGEE_ENVIRONMENT":"","microkernel_defaultTokenDirs":"","microkernel_region":"","LANG":""}