test/salt/pillar/examples/nginx_webshell_configuration.sls

   1 ---
   2 # This parameter will be used here to generate a list of upstreams and vhosts.
   3 # This dict is here for convenience and should be managed some other way, but the
   4 # different ways of orchestration that can be used for this are outside the scope
   5 # of this formula and their examples.
   6 # These upstreams should match those defined in `arvados:cluster:resources:virtual_machines`
   7 {% set webshell_virtual_machines = {
   8   'shell1': {
   9     'name': 'webshell1',
  10     'backend': '1.2.3.4',
  11     'port': 4200,
  12   },
  13   'shell.internal': {},
  14   'webshell3': {
  15     'backend': '4.3.2.1',
  16     'port': 4500,
  17   }
  18 }
  19 %}
  20
  21 ### NGINX
  22 nginx:
  23   ### SERVER
  24   server:
  25     config:
  26       ### STREAMS
  27       http:
  28         {%- for vm, params in webshell_virtual_machines.items() %}
  29           {%- set vm_name = params.name | default(vm) %}
  30           {%- set vm_backend = params.backend | default(vm_name) %}
  31           {%- set vm_port = params.port | default(4200) %}
  32
  33         upstream {{ vm_name }}_upstream:
  34           - server: '{{ vm_backend }}:{{ vm_port }} fail_timeout=10s'
  35
  36         {%- endfor %}
  37
  38   ### SITES
  39   servers:
  40     managed:
  41       arvados_webshell_default.conf:
  42         enabled: true
  43         overwrite: true
  44         config:
  45           - server:
  46             - server_name: webshell.fixme.example.net
  47             - listen:
  48               - 80
  49             - location /.well-known:
  50               - root: /var/www
  51             - location /:
  52               - return: '301 https://$host$request_uri'
  53
  54       arvados_webshell_ssl.conf:
  55         enabled: true
  56         overwrite: true
  57         config:
  58           - server:
  59             - server_name: webshell.fixme.example.net
  60             - listen:
  61               - 443 http2 ssl
  62             - index: index.html index.htm
  63             {%- for vm, params in webshell_virtual_machines.items() %}
  64               {%- set vm_name = params.name | default(vm) %}
  65             - location /{{ vm_name }}:
  66               - proxy_pass: 'http://{{ vm_name }}_upstream'
  67               - proxy_read_timeout: 90
  68               - proxy_connect_timeout: 90
  69               - proxy_set_header: 'Host $http_host'
  70               - proxy_set_header: 'X-Real-IP $remote_addr'
  71               - proxy_set_header: X-Forwarded-Proto https
  72               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
  73               - proxy_ssl_session_reuse: 'off'
  74
  75               - "if ($request_method = 'OPTIONS')":
  76                 - add_header: "'Access-Control-Allow-Origin' '*'"
  77                 - add_header: "'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'"
  78                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
  79                 - add_header: "'Access-Control-Max-Age' 1728000"
  80                 - add_header: "'Content-Type' 'text/plain charset=UTF-8'"
  81                 - add_header: "'Content-Length' 0"
  82                 - return: 204
  83
  84               - "if ($request_method = 'POST')":
  85                 - add_header: "'Access-Control-Allow-Origin' '*'"
  86                 - add_header: "'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'"
  87                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
  88
  89               - "if ($request_method = 'GET')":
  90                 - add_header: "'Access-Control-Allow-Origin' '*'"
  91                 - add_header: "'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'"
  92                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
  93             {%- endfor %}
  94             - include: 'snippets/ssl_hardening_default.conf'
  95             # - include: 'snippets/letsencrypt.conf'
  96             - include: 'snippets/ssl_snakeoil.conf'
  97             - access_log: /var/log/nginx/webshell.fixme.example.net.access.log combined
  98             - error_log: /var/log/nginx/webshell.fixme.example.net.error.log
  99