google-nomulus/java/google/registry/env/common/backend/WEB-INF/web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" version="2.5"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
                             http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
  <!-- Servlets -->

  <!-- Servlet for injected backends actions -->
  <servlet>
    <display-name>BackendServlet</display-name>
    <servlet-name>backend-servlet</servlet-name>
    <servlet-class>google.registry.module.backend.BackendServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>

  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/metrics</url-pattern>
  </servlet-mapping>

  <!-- RDE -->

  <!--
    Responsible for scanning the database to create a full deposit for a single TLD
    and streaming it to cloud storage. Requests are sent here by App Engine after
    `RdeCreateCronServlet` enqueues a task specifying a URL that points to this servlet.
  -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/rdeStaging</url-pattern>
  </servlet-mapping>

  <!--
    Once `rdeCreateFullCron` finishes writing a deposit file to cloud storage, it'll
    launch this task with the cloud filename so it can be uploaded to Iron Mountain
    via SFTP. The file is deleted once the upload completes. This should be run via
    `rde-upload-backend`.
  -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/rdeUpload</url-pattern>
  </servlet-mapping>

  <!-- Sends an XML RDE report to ICANN's HTTP server after rdeUploadTask finishes. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/rdeReport</url-pattern>
  </servlet-mapping>

  <!--
    Bulk Registration Data Access. This task creates a thin escrow deposit
    and saves it to cloud storage, where a separate script owned by the SREs
    uploads it to ICANN.
  -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/brdaCopy</url-pattern>
  </servlet-mapping>

  <!-- Trademark Clearinghouse -->

  <!-- Downloads TMCH DNL data from MarksDB. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/tmchDnl</url-pattern>
  </servlet-mapping>

  <!-- Downloads TMCH SMDRL data from MarksDB. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/tmchSmdrl</url-pattern>
  </servlet-mapping>

  <!-- Downloads TMCH CRL data from MarksDB. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/tmchCrl</url-pattern>
  </servlet-mapping>

  <!-- Reads the LORDN queues and uploads CSV data for sunrise and claims marks to MarksDB. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/nordnUpload</url-pattern>
  </servlet-mapping>

  <!-- Verifies upload of LORDN data to MarksDB. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/nordnVerify</url-pattern>
  </servlet-mapping>

  <!-- Reads the DNS push and pull queues and kick off the appropriate tasks to update zone. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/cron/readDnsQueue</url-pattern>
  </servlet-mapping>

  <!-- Publishes DNS updates. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/publishDnsUpdates</url-pattern>
  </servlet-mapping>

  <!-- Manually refreshes DNS information. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/dnsRefresh</url-pattern>
  </servlet-mapping>

  <!-- Verifies integrity of database invariants. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/verifyEntityIntegrity</url-pattern>
  </servlet-mapping>

  <servlet>
    <description>Exports a datastore backup snapshot to GCS.</description>
    <display-name>Export snapshot to GCS</display-name>
    <servlet-name>exportSnapshot</servlet-name>
    <servlet-class>google.registry.export.ExportSnapshotServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>exportSnapshot</servlet-name>
    <url-pattern>/_dr/task/exportSnapshot</url-pattern>
  </servlet-mapping>

  <servlet>
    <description>Checks the completion of a datastore backup snapshot.</description>
    <display-name>Check on snapshot status</display-name>
    <servlet-name>checkSnapshot</servlet-name>
    <servlet-class>google.registry.export.CheckSnapshotServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>checkSnapshot</servlet-name>
    <url-pattern>/_dr/task/checkSnapshot</url-pattern>
  </servlet-mapping>

  <!-- Loads a datastore backup snapshot into BigQuery. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/loadSnapshot</url-pattern>
  </servlet-mapping>

  <!-- Updates a view to point at a certain snapshot in BigQuery. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/updateSnapshotView</url-pattern>
  </servlet-mapping>

  <!-- Polls state of jobs in Bigquery -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/pollBigqueryJob</url-pattern>
  </servlet-mapping>

  <!-- Fans out a cron task over an adjustable range of TLDs. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/cron/fanout</url-pattern>
  </servlet-mapping>

  <!-- Backups. -->

  <!-- Fans out a cron task over all commit log buckets. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/cron/commitLogFanout</url-pattern>
  </servlet-mapping>

  <!-- Deletes old commit logs from datastore. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/deleteOldCommitLogs</url-pattern>
  </servlet-mapping>

  <!-- Checkpoints commit logs. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/cron/commitLogCheckpoint</url-pattern>
  </servlet-mapping>

  <!-- Exports commit log diffs. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/exportCommitLogDiff</url-pattern>
  </servlet-mapping>

  <!-- Restores commit logs. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/restoreCommitLogs</url-pattern>
  </servlet-mapping>

  <!-- Deletes commit logs. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/killCommitLogs</url-pattern>
  </servlet-mapping>

  <!-- MapReduce servlet. -->
  <servlet>
    <servlet-name>mapreduce</servlet-name>
    <servlet-class>com.google.appengine.tools.mapreduce.MapReduceServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>mapreduce</servlet-name>
    <url-pattern>/_dr/mapreduce/*</url-pattern>
  </servlet-mapping>

  <!-- Pipeline GUI servlets. -->
  <servlet>
    <servlet-name>pipeline</servlet-name>
    <servlet-class>com.google.appengine.tools.pipeline.impl.servlets.PipelineServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>pipeline</servlet-name>
    <url-pattern>/_ah/pipeline/*</url-pattern>
  </servlet-mapping>

  <!-- Syncs registrars to the registrar spreadsheet.  -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/syncRegistrarsSheet</url-pattern>
  </servlet-mapping>

  <!-- Exports TLD reserved terms. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/exportReservedTerms</url-pattern>
  </servlet-mapping>

  <!-- Syncs RegistrarContact changes to Google Groups. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/syncGroupMembers</url-pattern>
  </servlet-mapping>

  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/exportDomainLists</url-pattern>
  </servlet-mapping>

  <!--  Mapreduce to delete all prober data. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/deleteProberData</url-pattern>
  </servlet-mapping>

  <!--
    Deletes contacts and hosts enqueued for asynchronous deletion if they are
    not referenced by any domain.
  -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/deleteContactsAndHosts</url-pattern>
  </servlet-mapping>

  <!-- Enqueues DNS update tasks following a host rename. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/dnsRefreshForHostRename</url-pattern>
  </servlet-mapping>

  <!-- Enqueues DNS update tasks following a host rename. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/refreshDnsOnHostRename</url-pattern>
  </servlet-mapping>

  <!--  Mapreduce to expand recurring billing events into OneTimes. -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/expandRecurringBillingEvents</url-pattern>
  </servlet-mapping>

  <!-- Mapreduce to import contacts from escrow file -->
  <servlet-mapping>
    <servlet-name>backend-servlet</servlet-name>
    <url-pattern>/_dr/task/importRdeContacts</url-pattern>
  </servlet-mapping>

  <!-- Security config -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Internal</web-resource-name>
      <description>
        Any request path starting with `/_dr/` will be restricted to requests originating
        from the backend or by anyone authenticated to a Google account that's listed in
        the AppEngine control panel settings for this project as a Viewer/Owner/Developer.
        The `_dr` is short for Nomulus to follow AppEngine naming conventions.
      </description>
      <url-pattern>/_dr/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>

  <!-- Require TLS on all requests. -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Secure</web-resource-name>
      <description>
        Require encryption for all paths. http URLs will be redirected to https.
      </description>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>

  <!-- Shut down external access to registrar console. -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Internal</web-resource-name>
      <description>
        Go home rogue registrar!
      </description>
      <url-pattern>/registrar*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>

  <!-- Restrict access to source code. -->
  <!-- These are only included in the default module war, but restricting here too for safety. -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Internal</web-resource-name>
      <description>No soup for you!</description>
      <url-pattern>/assets/sources/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>admin</role-name>
    </auth-constraint>
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>

  <!-- See: https://code.google.com/p/objectify-appengine/wiki/Setup -->
  <filter>
    <filter-name>ObjectifyFilter</filter-name>
    <filter-class>com.googlecode.objectify.ObjectifyFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>ObjectifyFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- Register types with Objectify. -->
  <filter>
    <filter-name>OfyFilter</filter-name>
    <filter-class>google.registry.model.ofy.OfyFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>OfyFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

</web-app>