2 # Copyright (C) The Arvados Authors. All rights reserved.
4 # SPDX-License-Identifier: AGPL-3.0
9 . /usr/local/lib/arvbox/common.sh
11 if [[ $containerip != $localip ]] ; then
12 if ! grep -q $localip /etc/hosts ; then
13 echo $containerip $localip >> /etc/hosts
18 if [[ -f /var/run/localip_override ]] ; then
19 geo_dockerip="$dockerip/32 0;"
22 openssl verify -CAfile $root_cert $server_cert
24 cat <<EOF >$ARVADOS_CONTAINER_PATH/nginx.conf
25 worker_processes auto;
26 pid $ARVADOS_CONTAINER_PATH/nginx.pid;
33 worker_connections 64;
38 include /etc/nginx/mime.types;
39 default_type application/octet-stream;
40 client_max_body_size 128M;
42 geo \$external_client {
50 listen ${services[doc]} default_server;
51 listen [::]:${services[doc]} default_server;
52 root /usr/src/arvados/doc/.site;
58 listen 80 default_server;
60 return 301 https://\$host\$request_uri;
64 server localhost:${services[controller]};
67 listen *:${services[controller-ssl]} ssl default_server;
68 server_name controller;
69 ssl_certificate "${server_cert}";
70 ssl_certificate_key "${server_cert_key}";
72 proxy_pass http://controller;
73 proxy_set_header Host \$http_host;
74 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
75 proxy_set_header X-Forwarded-Proto https;
76 proxy_set_header X-External-Client \$external_client;
78 # This turns off response caching
84 server localhost:${services[websockets]};
87 listen *:${services[websockets-ssl]} ssl default_server;
88 server_name websockets;
90 proxy_connect_timeout 90s;
91 proxy_read_timeout 300s;
94 ssl_certificate "${server_cert}";
95 ssl_certificate_key "${server_cert_key}";
98 proxy_pass http://arvados-ws;
99 proxy_set_header Upgrade \$http_upgrade;
100 proxy_set_header Connection "upgrade";
101 proxy_set_header Host \$http_host;
102 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
106 upstream workbench2 {
107 server localhost:${services[workbench2]};
110 listen *:${services[workbench2-ssl]} ssl default_server;
111 server_name workbench2;
112 ssl_certificate "${server_cert}";
113 ssl_certificate_key "${server_cert_key}";
115 proxy_pass http://workbench2;
116 proxy_set_header Host \$http_host;
117 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
118 proxy_set_header X-Forwarded-Proto https;
121 location /sockjs-node {
122 proxy_pass http://workbench2;
123 proxy_set_header Upgrade \$http_upgrade;
124 proxy_set_header Connection "upgrade";
125 proxy_set_header Host \$http_host;
126 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
131 server localhost:${services[keep-web]};
134 listen *:${services[keep-web-ssl]} ssl default_server;
135 server_name keep-web;
136 ssl_certificate "${server_cert}";
137 ssl_certificate_key "${server_cert_key}";
138 client_max_body_size 0;
140 proxy_pass http://keep-web;
141 proxy_set_header Host \$http_host;
142 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
143 proxy_set_header X-Forwarded-Proto https;
148 listen *:${services[keep-web-dl-ssl]} ssl default_server;
149 server_name keep-web-dl;
150 ssl_certificate "${server_cert}";
151 ssl_certificate_key "${server_cert_key}";
152 client_max_body_size 0;
154 proxy_pass http://keep-web;
155 proxy_set_header Host \$http_host;
156 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
157 proxy_set_header X-Forwarded-Proto https;
163 server localhost:${services[keepproxy]};
166 listen *:${services[keepproxy-ssl]} ssl default_server;
167 server_name keepproxy;
168 ssl_certificate "${server_cert}";
169 ssl_certificate_key "${server_cert_key}";
170 client_max_body_size 128M;
172 proxy_pass http://keepproxy;
173 proxy_set_header Host \$http_host;
174 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
175 proxy_set_header X-Forwarded-Proto https;
180 upstream arvados-git-httpd {
181 server localhost:${services[arv-git-httpd]};
184 listen *:${services[arv-git-httpd-ssl]} ssl default_server;
185 server_name arvados-git-httpd;
186 proxy_connect_timeout 90s;
187 proxy_read_timeout 300s;
190 ssl_certificate "${server_cert}";
191 ssl_certificate_key "${server_cert_key}";
192 client_max_body_size 50m;
195 proxy_pass http://arvados-git-httpd;
196 proxy_set_header Host \$http_host;
197 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
198 proxy_set_header X-Forwarded-Proto https;
204 upstream arvados-webshell {
205 server localhost:${services[webshell]};
208 listen ${services[webshell-ssl]} ssl;
209 server_name arvados-webshell;
211 proxy_connect_timeout 90s;
212 proxy_read_timeout 300s;
215 ssl_certificate "${server_cert}";
216 ssl_certificate_key "${server_cert_key}";
219 if (\$request_method = 'OPTIONS') {
220 add_header 'Access-Control-Allow-Origin' '*';
221 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
222 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
223 add_header 'Access-Control-Max-Age' 1728000;
224 add_header 'Content-Type' 'text/plain charset=UTF-8';
225 add_header 'Content-Length' 0;
228 if (\$request_method = 'POST') {
229 add_header 'Access-Control-Allow-Origin' '*';
230 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
231 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
233 if (\$request_method = 'GET') {
234 add_header 'Access-Control-Allow-Origin' '*';
235 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
236 add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
239 proxy_ssl_session_reuse off;
240 proxy_read_timeout 90;
241 proxy_set_header X-Forwarded-Proto https;
242 proxy_set_header Host \$http_host;
243 proxy_set_header X-Real-IP \$remote_addr;
244 proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
245 proxy_pass http://arvados-webshell;
252 exec nginx -c $ARVADOS_CONTAINER_PATH/nginx.conf