MCM-36 — APISIX Gateway Fronting mcm-docs

← Back to Internal Docs Single Sign-On overview

As a Platform Admin,
I want APISIX deployed as the single gateway in front of mcm-docs, with mcm-docs itself moved to a private origin only the gateway can reach,
so that there's one place to manage routing, TLS, and authentication, and the static site genuinely cannot be reached by bypassing the gateway.

Assumption: the gated mcm-docs needs a real internal-facing domain — treated as a placeholder here until confirmed. See the overview's Open Questions.

Acceptance Criteria

• mcm-docs is redeployed to a private origin that is not reachable from the public internet — only the gateway can reach it.
• The gateway is reachable at the internal domain over HTTPS, with a valid TLS certificate.
• The gateway's upstream configuration points at mcm-docs's new private origin.
• Attempting to reach mcm-docs's origin directly, bypassing the gateway, fails — there is no network path to it except through the gateway.
• The gateway's routing is structured so that adding a second internal site later is a new route pointing at a new upstream, without touching mcm-docs's existing route.

---

Technical Design

mcm-docs's static export moves off its current public hosting to a private origin reachable only from the gateway's network — the specific hosting target is an implementation choice for whoever builds this, but the requirement is that no public path to it exists outside the gateway. APISIX is deployed as the single public entrypoint, terminating TLS and routing requests for the internal domain to this private origin only after the session check (see MCM-37) passes. This mirrors the same gateway technology the product itself already runs for its own customer-facing traffic — a separate deployment, not a shared one — so the organization isn't introducing an unfamiliar stack, just a second instance of it scoped to internal tooling.

---

UI / Frontend Changes

• No change to mcm-docs's own pages or content — this story only changes where and how it's reachable, not what it looks like.
• The site's URL changes to the new gateway-fronted internal domain; any existing public link/bookmark to the old hosting location stops working.