API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Jun 25th, 2018
90
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.80 KB | None | 0 0
raw download clone embed print report
  1. {{ $CurrentContainer := where $ "ID" .Docker.CurrentContainerID | first }}
  2.  
  3. {{ define "upstream" }}
  4. {{ if .Address }}
  5. {{/* If we got the containers from swarm and this container's port is published to host, use host IP:PORT */}}
  6. {{ if and .Container.Node.ID .Address.HostPort }}
  7. # {{ .Container.Node.Name }}/{{ .Container.Name }}
  8. server {{ .Container.Node.Address.IP }}:{{ .Address.HostPort }};
  9. {{/* If there is no swarm node or the port is not published on host, use container's IP:PORT */}}
  10. {{ else if .Network }}
  11. # {{ .Container.Name }}
  12. server {{ .Network.IP }}:{{ .Address.Port }};
  13. {{ end }}
  14. {{ else if .Network }}
  15. # {{ .Container.Name }}
  16. server {{ .Network.IP }} down;
  17. {{ end }}
  18. {{ end }}
  19.  
  20. # If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
  21. # scheme used to connect to this server
  22. map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  23. default $http_x_forwarded_proto;
  24. '' $scheme;
  25. }
  26.  
  27. # If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
  28. # server port the client connected to
  29. map $http_x_forwarded_port $proxy_x_forwarded_port {
  30. default $http_x_forwarded_port;
  31. '' $server_port;
  32. }
  33.  
  34. # If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
  35. # Connection header that may have been passed to this server
  36. map $http_upgrade $proxy_connection {
  37. default upgrade;
  38. '' close;
  39. }
  40.  
  41. # Apply fix for very long server names
  42. server_names_hash_bucket_size 128;
  43.  
  44. # Default dhparam
  45. ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
  46.  
  47. # Set appropriate X-Forwarded-Ssl header
  48. map $scheme $proxy_x_forwarded_ssl {
  49. default off;
  50. https on;
  51. }
  52.  
  53. gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
  54.  
  55. log_format vhost '$host $remote_addr - $remote_user [$time_local] '
  56. '"$request" $status $body_bytes_sent '
  57. '"$http_referer" "$http_user_agent"';
  58.  
  59. access_log off;
  60.  
  61. {{ if $.Env.RESOLVERS }}
  62. resolver {{ $.Env.RESOLVERS }};
  63. {{ end }}
  64.  
  65. {{ if (exists "/etc/nginx/proxy.conf") }}
  66. include /etc/nginx/proxy.conf;
  67. {{ else }}
  68. # HTTP 1.1 support
  69. proxy_http_version 1.1;
  70. proxy_buffering off;
  71. proxy_set_header Host $http_host;
  72. proxy_set_header Upgrade $http_upgrade;
  73. proxy_set_header Connection $proxy_connection;
  74. proxy_set_header X-Real-IP $remote_addr;
  75. proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  76. proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
  77. proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
  78. proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
  79.  
  80. # Mitigate httpoxy attack (see README for details)
  81. proxy_set_header Proxy "";
  82. {{ end }}
  83.  
  84. {{ $enable_ipv6 := eq (or ($.Env.ENABLE_IPV6) "") "true" }}
  85. server {
  86. server_name _; # This is just an invalid value which will never trigger on a real hostname.
  87. listen 80;
  88. {{ if $enable_ipv6 }}
  89. listen [::]:80;
  90. {{ end }}
  91. access_log /var/log/nginx/access.log vhost;
  92. client_max_body_size 500m;
  93. return 503;
  94. }
  95.  
  96. {{ if (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
  97. server {
  98. server_name _; # This is just an invalid value which will never trigger on a real hostname.
  99. listen 443 ssl http2;
  100. {{ if $enable_ipv6 }}
  101. listen [::]:443 ssl http2;
  102. {{ end }}
  103. access_log /var/log/nginx/access.log vhost;
  104. client_max_body_size 500m;
  105. return 503;
  106.  
  107. ssl_session_tickets off;
  108. ssl_certificate /etc/nginx/certs/default.crt;
  109. ssl_certificate_key /etc/nginx/certs/default.key;
  110. }
  111. {{ end }}
  112.  
  113. {{ range $host, $containers := groupByMulti $ "Env.VIRTUAL_HOST" "," }}
  114.  
  115. {{ $host := trim $host }}
  116. {{ $is_regexp := hasPrefix "~" $host }}
  117. {{ $upstream_name := when $is_regexp (sha1 $host) $host }}
  118.  
  119. # {{ $host }}
  120. upstream {{ $upstream_name }} {
  121.  
  122. {{ range $container := $containers }}
  123. {{ $addrLen := len $container.Addresses }}
  124.  
  125. {{ range $knownNetwork := $CurrentContainer.Networks }}
  126. {{ range $containerNetwork := $container.Networks }}
  127. {{ if (and (ne $containerNetwork.Name "ingress") (or (eq $knownNetwork.Name $containerNetwork.Name) (eq $knownNetwork.Name "host"))) }}
  128. ## Can be connect with "{{ $containerNetwork.Name }}" network
  129.  
  130. {{/* If only 1 port exposed, use that */}}
  131. {{ if eq $addrLen 1 }}
  132. {{ $address := index $container.Addresses 0 }}
  133. {{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }}
  134. {{/* If more than one port exposed, use the one matching VIRTUAL_PORT env var, falling back to standard web port 80 */}}
  135. {{ else }}
  136. {{ $port := coalesce $container.Env.VIRTUAL_PORT "80" }}
  137. {{ $address := where $container.Addresses "Port" $port | first }}
  138. {{ template "upstream" (dict "Container" $container "Address" $address "Network" $containerNetwork) }}
  139. {{ end }}
  140. {{ end }}
  141. {{ end }}
  142. {{ end }}
  143. {{ end }}
  144. }
  145.  
  146. {{ $default_host := or ($.Env.DEFAULT_HOST) "" }}
  147. {{ $default_server := index (dict $host "" $default_host "default_server") $host }}
  148.  
  149. {{/* Get the VIRTUAL_PROTO defined by containers w/ the same vhost, falling back to "http" */}}
  150. {{ $proto := trim (or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http") }}
  151.  
  152. {{/* Get the HTTPS_METHOD defined by containers w/ the same vhost, falling back to "redirect" */}}
  153. {{ $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) "redirect" }}
  154.  
  155. {{/* Get the first cert name defined by containers w/ the same vhost */}}
  156. {{ $certName := (first (groupByKeys $containers "Env.CERT_NAME")) }}
  157.  
  158. {{/* Get the best matching cert by name for the vhost. */}}
  159. {{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $host))}}
  160.  
  161. {{/* vhostCert is actually a filename so remove any suffixes since they are added later */}}
  162. {{ $vhostCert := trimSuffix ".crt" $vhostCert }}
  163. {{ $vhostCert := trimSuffix ".key" $vhostCert }}
  164.  
  165. {{/* Use the cert specified on the container or fallback to the best vhost match */}}
  166. {{ $cert := (coalesce $certName $vhostCert) }}
  167.  
  168. {{ $is_https := (and (ne $https_method "nohttps") (ne $cert "") (exists (printf "/etc/nginx/certs/%s.crt" $cert)) (exists (printf "/etc/nginx/certs/%s.key" $cert))) }}
  169.  
  170. {{ if $is_https }}
  171.  
  172. {{ if eq $https_method "redirect" }}
  173. server {
  174. server_name {{ $host }};
  175. listen 80 {{ $default_server }};
  176. {{ if $enable_ipv6 }}
  177. listen [::]:80 {{ $default_server }};
  178. {{ end }}
  179. access_log /var/log/nginx/access.log vhost;
  180. client_max_body_size 500m;
  181. return 301 https://$host$request_uri;
  182. }
  183. {{ end }}
  184.  
  185. server {
  186. server_name {{ $host }};
  187. listen 443 ssl http2 {{ $default_server }};
  188. {{ if $enable_ipv6 }}
  189. listen [::]:443 ssl http2 {{ $default_server }};
  190. {{ end }}
  191. access_log /var/log/nginx/access.log vhost;
  192. client_max_body_size 500m;
  193.  
  194. ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  195. ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
  196.  
  197. ssl_prefer_server_ciphers on;
  198. ssl_session_timeout 5m;
  199. ssl_session_cache shared:SSL:50m;
  200. ssl_session_tickets off;
  201.  
  202. ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }};
  203. ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }};
  204.  
  205. {{ if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $cert)) }}
  206. ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }};
  207. {{ end }}
  208.  
  209. {{ if (exists (printf "/etc/nginx/certs/%s.chain.crt" $cert)) }}
  210. ssl_stapling on;
  211. ssl_stapling_verify on;
  212. ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.crt" $cert }};
  213. {{ end }}
  214.  
  215. {{ if (ne $https_method "noredirect") }}
  216. add_header Strict-Transport-Security "max-age=31536000";
  217. {{ end }}
  218.  
  219. {{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
  220. include {{ printf "/etc/nginx/vhost.d/%s" $host }};
  221. {{ else if (exists "/etc/nginx/vhost.d/default") }}
  222. include /etc/nginx/vhost.d/default;
  223. {{ end }}
  224.  
  225. location / {
  226. {{ if eq $proto "uwsgi" }}
  227. include uwsgi_params;
  228. uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }};
  229. {{ else }}
  230. proxy_pass {{ trim $proto }}://{{ trim $upstream_name }};
  231. {{ end }}
  232. client_max_body_size 500m;
  233.  
  234. {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
  235. auth_basic "Restricted {{ $host }}";
  236. auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }};
  237. {{ end }}
  238. {{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }}
  239. include {{ printf "/etc/nginx/vhost.d/%s_location" $host}};
  240. {{ else if (exists "/etc/nginx/vhost.d/default_location") }}
  241. include /etc/nginx/vhost.d/default_location;
  242. {{ end }}
  243. }
  244. }
  245.  
  246. {{ end }}
  247.  
  248. {{ if or (not $is_https) (eq $https_method "noredirect") }}
  249.  
  250. server {
  251. server_name {{ $host }};
  252. listen 80 {{ $default_server }};
  253. {{ if $enable_ipv6 }}
  254. listen [::]:80 {{ $default_server }};
  255. {{ end }}
  256. access_log /var/log/nginx/access.log vhost;
  257. client_max_body_size 500m;
  258.  
  259. {{ if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
  260. include {{ printf "/etc/nginx/vhost.d/%s" $host }};
  261. {{ else if (exists "/etc/nginx/vhost.d/default") }}
  262. include /etc/nginx/vhost.d/default;
  263. {{ end }}
  264.  
  265. location / {
  266. {{ if eq $proto "uwsgi" }}
  267. include uwsgi_params;
  268. uwsgi_pass {{ trim $proto }}://{{ trim $upstream_name }};
  269. {{ else }}
  270. proxy_pass {{ trim $proto }}://{{ trim $upstream_name }};
  271. {{ end }}
  272. {{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
  273. auth_basic "Restricted {{ $host }}";
  274. auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }};
  275. {{ end }}
  276. client_max_body_size 500m;
  277. {{ if (exists (printf "/etc/nginx/vhost.d/%s_location" $host)) }}
  278. include {{ printf "/etc/nginx/vhost.d/%s_location" $host}};
  279. {{ else if (exists "/etc/nginx/vhost.d/default_location") }}
  280. include /etc/nginx/vhost.d/default_location;
  281. {{ end }}
  282. }
  283. }
  284.  
  285. {{ if (and (not $is_https) (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
  286. server {
  287. server_name {{ $host }};
  288. listen 443 ssl http2 {{ $default_server }};
  289. {{ if $enable_ipv6 }}
  290. listen [::]:443 ssl http2 {{ $default_server }};
  291. {{ end }}
  292. access_log /var/log/nginx/access.log vhost;
  293. client_max_body_size 500m;
  294. return 500;
  295.  
  296. ssl_certificate /etc/nginx/certs/default.crt;
  297. ssl_certificate_key /etc/nginx/certs/default.key;
  298. }
  299. {{ end }}
  300.  
  301. {{ end }}
  302. {{ end }}
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!