test(examples): nginx config examples for webshells
[arvados-formula.git] / test / salt / pillar / examples / nginx_webshell_configuration.sls
1 ---
2 # This parameter will be used here to generate a list of upstreams and vhosts.
3 # This dict is here for convenience and should be managed some other way, but the
4 # different ways of orchestration that can be used for this are outside the scope
5 # of this formula and their examples.
6 # These upstreams should match those defined in `arvados:cluster:resources:virtual_machines`
7 {% set webshell_virtual_machines = {
8   'shell1': {
9     'name': 'webshell1',
10     'backend': '1.2.3.4',
11     'port': 4200,
12   },
13   'shell.internal': {},
14   'webshell3': {
15     'backend': '4.3.2.1',
16     'port': 4500,
17   }
18 }
19 %}
20
21 ### NGINX
22 nginx:
23   ### SERVER
24   server:
25     config:
26       ### STREAMS
27       http:
28         {%- for vm, params in webshell_virtual_machines.items() %}
29           {%- set vm_name = params.name | default(vm) %}
30           {%- set vm_backend = params.backend | default(vm_name) %}
31           {%- set vm_port = params.port | default(4200) %}
32
33         upstream {{ vm_name }}_upstream:
34           - server: '{{ vm_backend }}:{{ vm_port }} fail_timeout=10s'
35
36         {%- endfor %}
37
38   ### SITES
39   servers:
40     managed:
41       arvados_webshell_default.conf:
42         enabled: true
43         overwrite: true
44         config:
45           - server:
46             - server_name: webshell.fixme.example.net
47             - listen:
48               - 80
49             - location /.well-known:
50               - root: /var/www
51             - location /:
52               - return: '301 https://$host$request_uri'
53
54       arvados_webshell_ssl.conf:
55         enabled: true
56         overwrite: true
57         config:
58           - server:
59             - server_name: webshell.fixme.example.net
60             - listen:
61               - 443 http2 ssl
62             - index: index.html index.htm
63             {%- for vm, params in webshell_virtual_machines.items() %}
64               {%- set vm_name = params.name | default(vm) %}
65             - location /{{ vm_name }}:
66               - proxy_pass: 'http://{{ vm_name }}_upstream'
67               - proxy_read_timeout: 90
68               - proxy_connect_timeout: 90
69               - proxy_set_header: 'Host $http_host'
70               - proxy_set_header: 'X-Real-IP $remote_addr'
71               - proxy_set_header: X-Forwarded-Proto https
72               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
73               - proxy_ssl_session_reuse: 'off'
74
75               - "if ($request_method = 'OPTIONS')":
76                 - add_header: "'Access-Control-Allow-Origin' '*'"
77                 - add_header: "'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'"
78                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
79                 - add_header: "'Access-Control-Max-Age' 1728000"
80                 - add_header: "'Content-Type' 'text/plain charset=UTF-8'"
81                 - add_header: "'Content-Length' 0"
82                 - return: 204
83
84               - "if ($request_method = 'POST')":
85                 - add_header: "'Access-Control-Allow-Origin' '*'"
86                 - add_header: "'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'"
87                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
88
89               - "if ($request_method = 'GET')":
90                 - add_header: "'Access-Control-Allow-Origin' '*'"
91                 - add_header: "'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'"
92                 - add_header: "'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'"
93             {%- endfor %}
94             - include: 'snippets/ssl_hardening_default.conf'
95             # - include: 'snippets/letsencrypt.conf'
96             - include: 'snippets/ssl_snakeoil.conf'
97             - access_log: /var/log/nginx/webshell.fixme.example.net.access.log combined
98             - error_log: /var/log/nginx/webshell.fixme.example.net.error.log
99