tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls

   1 ---
   2 # Copyright (C) The Arvados Authors. All rights reserved.
   3 #
   4 # SPDX-License-Identifier: AGPL-3.0
   5
   6 {%- import_yaml "ssl_key_encrypted.sls" as ssl_key_encrypted_pillar %}
   7 {%- set balanced_controller = ("__ENABLE_BALANCER__"|to_bool) %}
   8 {%- set server_name = grains['fqdn'] if balanced_controller else "__DOMAIN__" %}
   9
  10 ### NGINX
  11 nginx:
  12   ### SERVER
  13   server:
  14     config:
  15       ### STREAMS
  16       http:
  17         'geo $external_client':
  18           default: 1
  19           '127.0.0.0/8': 0
  20           '__CLUSTER_INT_CIDR__': 0
  21         upstream controller_upstream:
  22           - server: 'localhost:8003  fail_timeout=10s'
  23
  24   ### SITES
  25   servers:
  26     managed:
  27       ### DEFAULT
  28       arvados_controller_default.conf:
  29         enabled: true
  30         overwrite: true
  31         config:
  32           - server:
  33             - server_name: {{ server_name }}
  34             - listen:
  35               - 80 default
  36             - location /.well-known:
  37               - root: /var/www
  38             {%- if balanced_controller %}
  39             {%- set balancer_ip = salt['cmd.run']("getent hosts __BALANCER_NODENAME__ | awk '{print $1 ; exit}'", python_shell=True) %}
  40             {%- set prometheus_ip = salt['cmd.run']("getent hosts __PROMETHEUS_NODENAME__ | awk '{print $1 ; exit}'", python_shell=True) %}
  41             - index: index.html index.htm
  42             - location /:
  43               - allow: {{ balancer_ip }}
  44               - allow: {{ prometheus_ip }}
  45               - deny: all
  46               - proxy_pass: 'http://controller_upstream'
  47               - proxy_read_timeout: 300
  48               - proxy_connect_timeout: 90
  49               - proxy_redirect: 'off'
  50               - proxy_max_temp_file_size: 0
  51               - proxy_request_buffering: 'off'
  52               - proxy_buffering: 'off'
  53               - proxy_http_version: '1.1'
  54             - access_log: /var/log/nginx/{{ server_name }}.access.log combined
  55             - error_log: /var/log/nginx/{{ server_name }}.error.log
  56             - client_max_body_size: 128m
  57             {%- else %}
  58             - location /:
  59               - return: '301 https://$host$request_uri'
  60             {%- endif %}
  61
  62       {%- if not balanced_controller %}
  63       arvados_controller_ssl.conf:
  64         enabled: true
  65         overwrite: true
  66         requires:
  67           __CERT_REQUIRES__
  68         config:
  69           - server:
  70             - server_name: {{ server_name }}
  71             - listen:
  72               - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
  73             - index: index.html index.htm
  74             - location /:
  75               - proxy_pass: 'http://controller_upstream'
  76               - proxy_read_timeout: 300
  77               - proxy_connect_timeout: 90
  78               - proxy_redirect: 'off'
  79               - proxy_set_header: X-Forwarded-Proto https
  80               - proxy_set_header: 'Host $http_host'
  81               - proxy_set_header: 'X-Real-IP $remote_addr'
  82               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
  83               - proxy_set_header: 'X-External-Client $external_client'
  84               - proxy_set_header: 'Upgrade $http_upgrade'
  85               - proxy_set_header: 'Connection "upgrade"'
  86               - proxy_max_temp_file_size: 0
  87               - proxy_request_buffering: 'off'
  88               - proxy_buffering: 'off'
  89               - proxy_http_version: '1.1'
  90             - include: snippets/ssl_hardening_default.conf
  91             - ssl_certificate: __CERT_PEM__
  92             - ssl_certificate_key: __CERT_KEY__
  93             {%- if ssl_key_encrypted_pillar.ssl_key_encrypted.enabled %}
  94             - ssl_password_file: {{ '/run/arvados/' | path_join(ssl_key_encrypted_pillar.ssl_key_encrypted.privkey_password_filename) }}
  95             {%- endif %}
  96             - access_log: /var/log/nginx/{{ server_name }}.access.log combined
  97             - error_log: /var/log/nginx/{{ server_name }}.error.log
  98             - client_max_body_size: 128m
  99       {%- endif %}