tools/arvbox/lib/arvbox/docker/service/nginx/run

   1 #!/bin/bash
   2 # Copyright (C) The Arvados Authors. All rights reserved.
   3 #
   4 # SPDX-License-Identifier: AGPL-3.0
   5
   6 exec 2>&1
   7 set -ex -o pipefail
   8
   9 . /usr/local/lib/arvbox/common.sh
  10
  11 if [[ $containerip != $localip ]] ; then
  12     if ! grep -q $localip /etc/hosts ; then
  13         echo $containerip $localip >> /etc/hosts
  14     fi
  15 fi
  16
  17 geo_dockerip=
  18 if  [[ -f /var/run/localip_override ]] ; then
  19     geo_dockerip="$dockerip/32 0;"
  20 fi
  21
  22 openssl verify -CAfile $root_cert $server_cert
  23
  24 cat <<EOF >$ARVADOS_CONTAINER_PATH/nginx.conf
  25 worker_processes auto;
  26 pid $ARVADOS_CONTAINER_PATH/nginx.pid;
  27
  28 error_log stderr;
  29 daemon off;
  30 user arvbox;
  31
  32 events {
  33         worker_connections 64;
  34 }
  35
  36 http {
  37   access_log off;
  38   include /etc/nginx/mime.types;
  39   default_type application/octet-stream;
  40   client_max_body_size 128M;
  41
  42   geo \$external_client {
  43       default     1;
  44       127.0.0.0/8 0;
  45       $containerip/32 0;
  46       $geo_dockerip
  47   }
  48
  49   server {
  50         listen ${services[doc]} default_server;
  51         listen [::]:${services[doc]} default_server;
  52         root /usr/src/arvados/doc/.site;
  53         index index.html;
  54         server_name _;
  55   }
  56
  57   server {
  58     listen 80 default_server;
  59     server_name _;
  60     return 301 https://\$host\$request_uri;
  61   }
  62
  63   upstream controller {
  64     server localhost:${services[controller]};
  65   }
  66   server {
  67     listen *:${services[controller-ssl]} ssl default_server;
  68     server_name controller;
  69     ssl_certificate "${server_cert}";
  70     ssl_certificate_key "${server_cert_key}";
  71     location  / {
  72       proxy_pass http://controller;
  73       proxy_set_header Host \$http_host;
  74       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
  75       proxy_set_header X-Forwarded-Proto https;
  76       proxy_set_header X-External-Client \$external_client;
  77       proxy_redirect off;
  78       # This turns off response caching
  79       proxy_buffering off;
  80     }
  81   }
  82
  83   upstream arvados-ws {
  84     server localhost:${services[websockets]};
  85   }
  86   server {
  87     listen *:${services[websockets-ssl]} ssl default_server;
  88     server_name           websockets;
  89
  90     proxy_connect_timeout 90s;
  91     proxy_read_timeout    300s;
  92
  93     ssl                   on;
  94     ssl_certificate "${server_cert}";
  95     ssl_certificate_key "${server_cert_key}";
  96
  97     location / {
  98       proxy_pass          http://arvados-ws;
  99       proxy_set_header    Upgrade         \$http_upgrade;
 100       proxy_set_header    Connection      "upgrade";
 101       proxy_set_header Host \$http_host;
 102       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 103     }
 104   }
 105
 106   upstream workbench2 {
 107     server localhost:${services[workbench2]};
 108   }
 109   server {
 110     listen *:${services[workbench2-ssl]} ssl default_server;
 111     server_name workbench2;
 112     ssl_certificate "${server_cert}";
 113     ssl_certificate_key "${server_cert_key}";
 114     location  / {
 115       proxy_pass http://workbench2;
 116       proxy_set_header Host \$http_host;
 117       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 118       proxy_set_header X-Forwarded-Proto https;
 119       proxy_redirect off;
 120     }
 121     location  /sockjs-node {
 122       proxy_pass http://workbench2;
 123       proxy_set_header    Upgrade         \$http_upgrade;
 124       proxy_set_header    Connection      "upgrade";
 125       proxy_set_header Host \$http_host;
 126       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 127     }
 128   }
 129
 130   upstream keep-web {
 131     server localhost:${services[keep-web]};
 132   }
 133   server {
 134     listen *:${services[keep-web-ssl]} ssl default_server;
 135     server_name keep-web;
 136     ssl_certificate "${server_cert}";
 137     ssl_certificate_key "${server_cert_key}";
 138     client_max_body_size 0;
 139     location  / {
 140       proxy_pass http://keep-web;
 141       proxy_set_header Host \$http_host;
 142       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 143       proxy_set_header X-Forwarded-Proto https;
 144       proxy_redirect off;
 145     }
 146   }
 147   server {
 148     listen *:${services[keep-web-dl-ssl]} ssl default_server;
 149     server_name keep-web-dl;
 150     ssl_certificate "${server_cert}";
 151     ssl_certificate_key "${server_cert_key}";
 152     client_max_body_size 0;
 153     location  / {
 154       proxy_pass http://keep-web;
 155       proxy_set_header Host \$http_host;
 156       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 157       proxy_set_header X-Forwarded-Proto https;
 158       proxy_redirect off;
 159     }
 160   }
 161
 162   upstream keepproxy {
 163     server localhost:${services[keepproxy]};
 164   }
 165   server {
 166     listen *:${services[keepproxy-ssl]} ssl default_server;
 167     server_name keepproxy;
 168     ssl_certificate "${server_cert}";
 169     ssl_certificate_key "${server_cert_key}";
 170     client_max_body_size 128M;
 171     location  / {
 172       proxy_pass http://keepproxy;
 173       proxy_set_header Host \$http_host;
 174       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 175       proxy_set_header X-Forwarded-Proto https;
 176       proxy_redirect off;
 177     }
 178   }
 179
 180   upstream arvados-git-httpd {
 181     server localhost:${services[arv-git-httpd]};
 182   }
 183   server {
 184     listen *:${services[arv-git-httpd-ssl]} ssl default_server;
 185     server_name arvados-git-httpd;
 186     proxy_connect_timeout 90s;
 187     proxy_read_timeout 300s;
 188
 189     ssl on;
 190     ssl_certificate "${server_cert}";
 191     ssl_certificate_key "${server_cert_key}";
 192     client_max_body_size 50m;
 193
 194     location  / {
 195       proxy_pass http://arvados-git-httpd;
 196       proxy_set_header Host \$http_host;
 197       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
 198       proxy_set_header X-Forwarded-Proto https;
 199       proxy_redirect off;
 200     }
 201   }
 202
 203
 204 upstream arvados-webshell {
 205   server                localhost:${services[webshell]};
 206 }
 207 server {
 208   listen                ${services[webshell-ssl]} ssl;
 209   server_name           arvados-webshell;
 210
 211   proxy_connect_timeout 90s;
 212   proxy_read_timeout    300s;
 213
 214   ssl                   on;
 215   ssl_certificate "${server_cert}";
 216   ssl_certificate_key "${server_cert_key}";
 217
 218   location / {
 219     if (\$request_method = 'OPTIONS') {
 220        add_header 'Access-Control-Allow-Origin' '*';
 221        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
 222        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
 223        add_header 'Access-Control-Max-Age' 1728000;
 224        add_header 'Content-Type' 'text/plain charset=UTF-8';
 225        add_header 'Content-Length' 0;
 226        return 204;
 227     }
 228     if (\$request_method = 'POST') {
 229        add_header 'Access-Control-Allow-Origin' '*';
 230        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
 231        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
 232     }
 233     if (\$request_method = 'GET') {
 234        add_header 'Access-Control-Allow-Origin' '*';
 235        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
 236        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
 237     }
 238
 239     proxy_ssl_session_reuse off;
 240     proxy_read_timeout  90;
 241     proxy_set_header    X-Forwarded-Proto https;
 242     proxy_set_header    Host \$http_host;
 243     proxy_set_header    X-Real-IP \$remote_addr;
 244     proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
 245     proxy_pass          http://arvados-webshell;
 246   }
 247 }
 248 }
 249
 250 EOF
 251
 252 exec nginx -c $ARVADOS_CONTAINER_PATH/nginx.conf