Merge branch '21394-docker-tag-push'
[arvados.git] / tools / salt-install / config_examples / multi_host / aws / pillars / nginx_controller_configuration.sls
1 ---
2 # Copyright (C) The Arvados Authors. All rights reserved.
3 #
4 # SPDX-License-Identifier: AGPL-3.0
5
6 {%- import_yaml "ssl_key_encrypted.sls" as ssl_key_encrypted_pillar %}
7 {%- set balanced_controller = ("__ENABLE_BALANCER__"|to_bool) %}
8 {%- set server_name = grains['fqdn'] if balanced_controller else "__DOMAIN__" %}
9
10 ### NGINX
11 nginx:
12   ### SERVER
13   server:
14     config:
15       ### STREAMS
16       http:
17         'geo $external_client':
18           default: 1
19           '127.0.0.0/8': 0
20           '__CLUSTER_INT_CIDR__': 0
21         upstream controller_upstream:
22           - server: 'localhost:8003  fail_timeout=10s'
23
24   ### SITES
25   servers:
26     managed:
27       ### DEFAULT
28       arvados_controller_default.conf:
29         enabled: true
30         overwrite: true
31         config:
32           - server:
33             - server_name: {{ server_name }}
34             - listen:
35               - 80 default
36             - location /.well-known:
37               - root: /var/www
38             {%- if balanced_controller %}
39             {%- set balancer_ip = salt['cmd.run']("getent hosts __BALANCER_NODENAME__ | awk '{print $1 ; exit}'", python_shell=True) %}
40             {%- set prometheus_ip = salt['cmd.run']("getent hosts __PROMETHEUS_NODENAME__ | awk '{print $1 ; exit}'", python_shell=True) %}
41             - index: index.html index.htm
42             - location /:
43               - allow: {{ balancer_ip }}
44               - allow: {{ prometheus_ip }}
45               - deny: all
46               - proxy_pass: 'http://controller_upstream'
47               - proxy_read_timeout: 300
48               - proxy_connect_timeout: 90
49               - proxy_redirect: 'off'
50               - proxy_max_temp_file_size: 0
51               - proxy_request_buffering: 'off'
52               - proxy_buffering: 'off'
53               - proxy_http_version: '1.1'
54             - access_log: /var/log/nginx/{{ server_name }}.access.log combined
55             - error_log: /var/log/nginx/{{ server_name }}.error.log
56             - client_max_body_size: 128m
57             {%- else %}
58             - location /:
59               - return: '301 https://$host$request_uri'
60             {%- endif %}
61
62       {%- if not balanced_controller %}
63       arvados_controller_ssl.conf:
64         enabled: true
65         overwrite: true
66         requires:
67           __CERT_REQUIRES__
68         config:
69           - server:
70             - server_name: {{ server_name }}
71             - listen:
72               - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
73             - index: index.html index.htm
74             - location /:
75               - proxy_pass: 'http://controller_upstream'
76               - proxy_read_timeout: 300
77               - proxy_connect_timeout: 90
78               - proxy_redirect: 'off'
79               - proxy_set_header: X-Forwarded-Proto https
80               - proxy_set_header: 'Host $http_host'
81               - proxy_set_header: 'X-Real-IP $remote_addr'
82               - proxy_set_header: 'X-Forwarded-For $proxy_add_x_forwarded_for'
83               - proxy_set_header: 'X-External-Client $external_client'
84               - proxy_set_header: 'Upgrade $http_upgrade'
85               - proxy_set_header: 'Connection "upgrade"'
86               - proxy_max_temp_file_size: 0
87               - proxy_request_buffering: 'off'
88               - proxy_buffering: 'off'
89               - proxy_http_version: '1.1'
90             - include: snippets/ssl_hardening_default.conf
91             - ssl_certificate: __CERT_PEM__
92             - ssl_certificate_key: __CERT_KEY__
93             {%- if ssl_key_encrypted_pillar.ssl_key_encrypted.enabled %}
94             - ssl_password_file: {{ '/run/arvados/' | path_join(ssl_key_encrypted_pillar.ssl_key_encrypted.privkey_password_filename) }}
95             {%- endif %}
96             - access_log: /var/log/nginx/{{ server_name }}.access.log combined
97             - error_log: /var/log/nginx/{{ server_name }}.error.log
98             - client_max_body_size: 128m
99       {%- endif %}