16267: switch to `arvados-server install -type test` for installing

[arvados.git] / tools / arvbox / lib / arvbox / docker / service / nginx / run

diff --git a/tools/arvbox/lib/arvbox/docker/service/nginx/run b/tools/arvbox/lib/arvbox/docker/service/nginx/run
index 0d60e74128365605a49194b27cb2cf9c09af9618..82db92137053f83f0282f24211e63824a7bb4a0c 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/nginx/run
+++ b/tools/arvbox/lib/arvbox/docker/service/nginx/run
@@ -8,11 +8,22 @@ set -ex -o pipefail
 
 . /usr/local/lib/arvbox/common.sh
 
+if [[ $containerip != $localip ]] ; then
+    if ! grep -q $localip /etc/hosts ; then
+       echo $containerip $localip >> /etc/hosts
+    fi
+fi
+
+geo_dockerip=
+if  [[ -f /var/run/localip_override ]] ; then
+    geo_dockerip="$dockerip/32 0;"
+fi
+
 openssl verify -CAfile $root_cert $server_cert
 
-cat <<EOF >/var/lib/arvados/nginx.conf
+cat <<EOF >$ARVADOS_CONTAINER_PATH/nginx.conf
 worker_processes auto;
-pid /var/lib/arvados/nginx.pid;
+pid $ARVADOS_CONTAINER_PATH/nginx.pid;
 
 error_log stderr;
 daemon off;
@@ -23,18 +34,25 @@ events {
 }
 
 http {
-     access_log off;
-     include /etc/nginx/mime.types;
-     default_type application/octet-stream;
-     client_max_body_size 128M;
-
-     server {
-            listen ${services[doc]} default_server;
-            listen [::]:${services[doc]} default_server;
-            root /usr/src/arvados/doc/.site;
-            index index.html;
-            server_name _;
-     }
+  access_log off;
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+  client_max_body_size 128M;
+
+  geo \$external_client {
+      default     1;
+      127.0.0.0/8 0;
+      $containerip/32 0;
+      $geo_dockerip
+  }
+
+  server {
+        listen ${services[doc]} default_server;
+        listen [::]:${services[doc]} default_server;
+        root /usr/src/arvados/doc/.site;
+        index index.html;
+        server_name _;
+  }
 
   server {
     listen 80 default_server;
@@ -55,32 +73,35 @@ http {
       proxy_set_header Host \$http_host;
       proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header X-External-Client \$external_client;
       proxy_redirect off;
+      # This turns off response caching
+      proxy_buffering off;
     }
   }
 
-upstream arvados-ws {
-  server localhost:${services[websockets]};
-}
-server {
-  listen *:${services[websockets-ssl]} ssl default_server;
-  server_name           websockets;
+  upstream arvados-ws {
+    server localhost:${services[websockets]};
+  }
+  server {
+    listen *:${services[websockets-ssl]} ssl default_server;
+    server_name           websockets;
 
-  proxy_connect_timeout 90s;
-  proxy_read_timeout    300s;
+    proxy_connect_timeout 90s;
+    proxy_read_timeout    300s;
 
-  ssl                   on;
-  ssl_certificate "${server_cert}";
-  ssl_certificate_key "${server_cert_key}";
+    ssl                   on;
+    ssl_certificate "${server_cert}";
+    ssl_certificate_key "${server_cert_key}";
 
-  location / {
-    proxy_pass          http://arvados-ws;
-    proxy_set_header    Upgrade         \$http_upgrade;
-    proxy_set_header    Connection      "upgrade";
-    proxy_set_header Host \$http_host;
-    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    location / {
+      proxy_pass          http://arvados-ws;
+      proxy_set_header    Upgrade         \$http_upgrade;
+      proxy_set_header    Connection      "upgrade";
+      proxy_set_header Host \$http_host;
+      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    }
   }
-}
 
   upstream workbench2 {
     server localhost:${services[workbench2]};
@@ -124,7 +145,6 @@ server {
     }
   }
 
-
   upstream keepproxy {
     server localhost:${services[keepproxy]};
   }
@@ -166,8 +186,53 @@ server {
     }
   }
 
+
+upstream arvados-webshell {
+  server                localhost:${services[webshell]};
+}
+server {
+  listen                ${services[webshell-ssl]} ssl;
+  server_name           arvados-webshell;
+
+  proxy_connect_timeout 90s;
+  proxy_read_timeout    300s;
+
+  ssl                   on;
+  ssl_certificate "${server_cert}";
+  ssl_certificate_key "${server_cert_key}";
+
+  location / {
+    if (\$request_method = 'OPTIONS') {
+       add_header 'Access-Control-Allow-Origin' '*';
+       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+       add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+       add_header 'Access-Control-Max-Age' 1728000;
+       add_header 'Content-Type' 'text/plain charset=UTF-8';
+       add_header 'Content-Length' 0;
+       return 204;
+    }
+    if (\$request_method = 'POST') {
+       add_header 'Access-Control-Allow-Origin' '*';
+       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+       add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+    }
+    if (\$request_method = 'GET') {
+       add_header 'Access-Control-Allow-Origin' '*';
+       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+       add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+    }
+
+    proxy_ssl_session_reuse off;
+    proxy_read_timeout  90;
+    proxy_set_header    X-Forwarded-Proto https;
+    proxy_set_header    Host \$http_host;
+    proxy_set_header    X-Real-IP \$remote_addr;
+    proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_pass          http://arvados-webshell;
+  }
+}
 }
 
 EOF
 
-exec nginx -c /var/lib/arvados/nginx.conf
+exec nginx -c $ARVADOS_CONTAINER_PATH/nginx.conf