2 # Copyright (C) The Arvados Authors. All rights reserved.
4 # SPDX-License-Identifier: AGPL-3.0
9 . /usr/local/lib/arvbox/common.sh
11 if [[ $containerip != $localip ]] ; then
12 if ! grep -q $localip /etc/hosts ; then
13 echo $containerip $localip >> /etc/hosts
18 if [[ -f /var/run/localip_override ]] ; then
19 geo_dockerip="$dockerip/32 0;"
22 openssl verify -CAfile $root_cert $server_cert
24 cat <<EOF >$ARVADOS_CONTAINER_PATH/nginx.conf
25 worker_processes auto;
26 pid $ARVADOS_CONTAINER_PATH/nginx.pid;
33 worker_connections 64;
38 include /etc/nginx/mime.types;
39 default_type application/octet-stream;
40 client_max_body_size 128M;
42 geo \$external_client {
50 listen ${services[doc]} default_server;
51 listen [::]:${services[doc]} default_server;
52 root /usr/src/arvados/doc/.site;
58 listen 80 default_server;
60 return 301 https://\$host\$request_uri;
64 server localhost:${services[controller]};
67 listen *:${services[controller-ssl]} ssl default_server;
68 server_name controller;
69 ssl_certificate "${server_cert}";
70 ssl_certificate_key "${server_cert_key}";
72 proxy_pass http://controller;
73 proxy_set_header Host \$http_host;
74 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
75 proxy_set_header X-Forwarded-Proto https;
76 proxy_set_header X-External-Client \$external_client;
78 # This turns off response caching
84 server localhost:${services[websockets]};
87 listen *:${services[websockets-ssl]} ssl default_server;
88 server_name websockets;
90 proxy_connect_timeout 90s;
91 proxy_read_timeout 300s;
94 ssl_certificate "${server_cert}";
95 ssl_certificate_key "${server_cert_key}";
98 proxy_pass http://arvados-ws;
99 proxy_set_header Upgrade \$http_upgrade;
100 proxy_set_header Connection "upgrade";
101 proxy_set_header Host \$http_host;
102 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
106 upstream workbench2 {
107 server localhost:${services[workbench2]};
110 listen *:${services[workbench2-ssl]} ssl default_server;
111 server_name workbench2;
112 ssl_certificate "${server_cert}";
113 ssl_certificate_key "${server_cert_key}";
115 # REDIRECTS FROM WORKBENCH 1 TO WORKBENCH 2
117 # Paths that are not redirected because wb1 and wb2 have similar enough paths
118 # that a redirect is pointless and would create a redirect loop.
119 # rewrite ^/api_client_authorizations.* /api_client_authorizations redirect;
120 # rewrite ^/repositories.* /repositories redirect;
121 # rewrite ^/links.* /links redirect;
122 # rewrite ^/projects.* /projects redirect;
123 # rewrite ^/trash /trash redirect;
125 # Redirects that include a uuid
126 rewrite ^/work_units/(.*) /processes/\$1 redirect;
127 rewrite ^/container_requests/(.*) /processes/\$1 redirect;
128 rewrite ^/users/(.*) /user/\$1 redirect;
129 rewrite ^/groups/(.*) /group/\$1 redirect;
131 # Special file download redirects
132 if (\$arg_disposition = attachment) {
133 rewrite ^/collections/([^/]*)/(.*) /?redirectToDownload=/c=\$1/\$2? redirect;
135 if (\$arg_disposition = inline) {
136 rewrite ^/collections/([^/]*)/(.*) /?redirectToPreview=/c=\$1/\$2? redirect;
139 # Redirects that go to a roughly equivalent page
140 rewrite ^/virtual_machines.* /virtual-machines-admin redirect;
141 rewrite ^/users/.*/virtual_machines /virtual-machines-user redirect;
142 rewrite ^/authorized_keys.* /ssh-keys-admin redirect;
143 rewrite ^/users/.*/ssh_keys /ssh-keys-user redirect;
144 rewrite ^/containers.* /all_processes redirect;
145 rewrite ^/container_requests /all_processes redirect;
146 rewrite ^/job.* /all_processes redirect;
147 rewrite ^/users/link_account /link_account redirect;
148 rewrite ^/keep_services.* /keep-services redirect;
149 rewrite ^/trash_items.* /trash redirect;
151 # Redirects that don't have a good mapping and
153 rewrite ^/themes.* / redirect;
154 rewrite ^/keep_disks.* / redirect;
155 rewrite ^/user_agreements.* / redirect;
156 rewrite ^/nodes.* / redirect;
157 rewrite ^/humans.* / redirect;
158 rewrite ^/traits.* / redirect;
159 rewrite ^/sessions.* / redirect;
160 rewrite ^/logout.* / redirect;
161 rewrite ^/logged_out.* / redirect;
162 rewrite ^/current_token / redirect;
163 rewrite ^/logs.* / redirect;
164 rewrite ^/factory_jobs.* / redirect;
165 rewrite ^/uploaded_datasets.* / redirect;
166 rewrite ^/specimens.* / redirect;
167 rewrite ^/pipeline_templates.* / redirect;
168 rewrite ^/pipeline_instances.* / redirect;
171 proxy_pass http://workbench2;
172 proxy_set_header Host \$http_host;
173 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
174 proxy_set_header X-Forwarded-Proto https;
177 location /sockjs-node {
178 proxy_pass http://workbench2;
179 proxy_set_header Upgrade \$http_upgrade;
180 proxy_set_header Connection "upgrade";
181 proxy_set_header Host \$http_host;
182 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
187 server localhost:${services[keep-web]};
190 listen *:${services[keep-web-ssl]} ssl default_server;
191 server_name keep-web;
192 ssl_certificate "${server_cert}";
193 ssl_certificate_key "${server_cert_key}";
194 client_max_body_size 0;
196 proxy_pass http://keep-web;
197 proxy_set_header Host \$http_host;
198 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
199 proxy_set_header X-Forwarded-Proto https;
204 listen *:${services[keep-web-dl-ssl]} ssl default_server;
205 server_name keep-web-dl;
206 ssl_certificate "${server_cert}";
207 ssl_certificate_key "${server_cert_key}";
208 client_max_body_size 0;
210 proxy_pass http://keep-web;
211 proxy_set_header Host \$http_host;
212 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
213 proxy_set_header X-Forwarded-Proto https;
219 server localhost:${services[keepproxy]};
222 listen *:${services[keepproxy-ssl]} ssl default_server;
223 server_name keepproxy;
224 ssl_certificate "${server_cert}";
225 ssl_certificate_key "${server_cert_key}";
226 client_max_body_size 128M;
228 proxy_pass http://keepproxy;
229 proxy_set_header Host \$http_host;
230 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
231 proxy_set_header X-Forwarded-Proto https;
236 upstream arvados-git-httpd {
237 server localhost:${services[arv-git-httpd]};
240 listen *:${services[arv-git-httpd-ssl]} ssl default_server;
241 server_name arvados-git-httpd;
242 proxy_connect_timeout 90s;
243 proxy_read_timeout 300s;
246 ssl_certificate "${server_cert}";
247 ssl_certificate_key "${server_cert_key}";
248 client_max_body_size 50m;
251 proxy_pass http://arvados-git-httpd;
252 proxy_set_header Host \$http_host;
253 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
254 proxy_set_header X-Forwarded-Proto https;
260 upstream arvados-webshell {
261 server localhost:${services[webshell]};
264 listen ${services[webshell-ssl]} ssl;
265 server_name arvados-webshell;
267 proxy_connect_timeout 90s;
268 proxy_read_timeout 300s;
271 ssl_certificate "${server_cert}";
272 ssl_certificate_key "${server_cert_key}";
275 if (\$request_method = 'OPTIONS') {
276 add_header 'Access-Control-Allow-Origin' '*';
277 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
278 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
279 add_header 'Access-Control-Max-Age' 1728000;
280 add_header 'Content-Type' 'text/plain charset=UTF-8';
281 add_header 'Content-Length' 0;
284 if (\$request_method = 'POST') {
285 add_header 'Access-Control-Allow-Origin' '*';
286 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
287 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
289 if (\$request_method = 'GET') {
290 add_header 'Access-Control-Allow-Origin' '*';
291 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
292 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
295 proxy_ssl_session_reuse off;
296 proxy_read_timeout 90;
297 proxy_set_header X-Forwarded-Proto https;
298 proxy_set_header Host \$http_host;
299 proxy_set_header X-Real-IP \$remote_addr;
300 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
301 proxy_pass http://arvados-webshell;
308 exec nginx -c $ARVADOS_CONTAINER_PATH/nginx.conf