REG-1639: Allow unencrypted calls to fetch graph artifacts

[sirdodger]

REG-1639

---

When running a registry in a protected network, such as inside a Kubernetes cluster, users may want to avoid the overhead of setting up and distributing SSL certificates. This PR allows them to allowlist specific URLs so the router will fetch from those internal repositories over HTTP (while a misconfiguration to an external repo will still demand HTTPS).

Slack convo that started this

Checklist

Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.

• PR description explains the motivation for the change and relevant context for reviewing
• PR description links appropriate GitHub/Jira tickets (creating when necessary)
• Changeset is included for user-facing changes
• Changes are compatible¹
• Documentation² completed
• Performance impact assessed and acceptable
• Metrics and logs are added³ and documented
• Tests added and passing⁴
  • Unit tests
  • Integration tests
  • Manual tests, as necessary

Exceptions

Note any exceptions here

Notes

Footnotes

1. It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. ↩

2. Configuration is an important part of many changes. Where applicable please try to document configuration examples. ↩

3. A lot of (if not most) features benefit from built-in observability and debug-level logs. Please read this guidance on metrics best-practices. ↩

4. Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions. ↩

[apollo-librarian]

✅ Docs preview ready

The preview is ready to be viewed. View the preview

File Changes

0 new, 1 changed, 0 removed

* graphos/routing/(latest)/configuration/envvars.mdx

Build ID: 5c15e910ffcbe1a7bd819124
Build Logs: View logs

URL: https://www.apollographql.com/docs/deploy-preview/5c15e910ffcbe1a7bd819124

---

⚠️ AI Style Review — 5 Issues Found

Summary

The documentation has been updated to align with our style guide across several key areas. Structural changes ensure headings use sentence case and proper naming conventions. Framing was improved by consistently using second-person pronouns ('you', 'your') to speak directly to the reader. Language was refined for clarity by replacing 'rather than' with 'instead of', 'allowing' with 'enabling', and adopting contractions, while 'the' was removed before 'Router' as a standalone product. Text formatting now correctly applies code font to user inputs and system values like localhost and dockerhost. Verb tense and voice were shifted to active voice to provide direct, authoritative, and encouraging instructions for users.

Duration: 3303ms
Review Log: View detailed log

This review is AI-generated. Please use common sense when accepting these suggestions, as they may not always be accurate or appropriate for your specific context.

[carodewig]

Just a few comments/nits, overall LGTM

[carodewig]

Are there any cases where the URL will come in with a scheme, so this will 'double up' on schemes and cause parsing to fail?

[sirdodger]

The user could type whatever they want, but the graph artifacts URLs they use elsewhere will not include scheme, and the documentation does not show scheme, so I think it will feel natural to the user this way. Making it a little more robust is simple though, so I'll go ahead and touch it up.

[carodewig]

I don't know this area of the code well - is this something that will be called repeatedly, or just on router initiation? If it's called repeatedly, it's probably worth putting the env value into a OnceLock or LazyLock (or similar) so that it only gets instantiated once

[sirdodger]

It gets called repeatedly, but it doesn't need to since the reference cannot change. I'll move the whole inference to startup instead of on the network call.

[carodewig]

One last comment RE the test strategy!

[carodewig]

Nit: since you're changing all these tests, it might be worth converting them to use rstest - IMO it's easier to see what is covered and what's not when tests are specified as cases.

Examples:

#[rstest::rstest]
#[case::external_registry("registry.apollographql.com/my-graph:latest")]
#[case::docker_io("docker.io/library/alpine:latest")]
// etc
fn url_should_use_ssl(#[case] url: &str) {
    assert!(should_use_ssl(url));
}

#[rstest::rstest]
#[case::localhost("localhost:5000/test-graph:latest")]
#[case::127_0_0_1("127.0.0.1:5000/test-graph:latest")]
// etc
fn url_should_not_use_ssl(#[case] url: &str) {
    assert!(!should_use_ssl(url));
}

#[rstest::rstest]
#[case::ipv4("127.0.0.1", "127.0.0.1")]
#[case::ipv4("127.0.0.1:5000", "127.0.0.1")]
// etc
fn test_extract_host(#[case] url: &str, #[case] expected_host: &str) {
    assert_eq!(extract_host(url).as_deref(), Some(expected_host))
}

[mabuyo]

Had a few wording changes and also added line breaks in the table entry for easier readability. We have an open ticket to fix the newlines not showing up in a table like this but in the meantime, wanted to make sure this was easier to read!

The code snippet could use some work to be better visible but that's on the docs platform side. Logging a ticket for us to look into reformatting this in a separate PR (maybe a table is not the best format anymore as it grows).

Thank you; docs approved!