X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/79ba997c9bc1f97514dcc6f1d6016ba7524a0ae1..154bfc562eafc642cc801f25b3c258e3846633ba:/tools/arvbox/lib/arvbox/docker/service/nginx/run diff --git a/tools/arvbox/lib/arvbox/docker/service/nginx/run b/tools/arvbox/lib/arvbox/docker/service/nginx/run index 0d60e74128..82db921370 100755 --- a/tools/arvbox/lib/arvbox/docker/service/nginx/run +++ b/tools/arvbox/lib/arvbox/docker/service/nginx/run @@ -8,11 +8,22 @@ set -ex -o pipefail . /usr/local/lib/arvbox/common.sh +if [[ $containerip != $localip ]] ; then + if ! grep -q $localip /etc/hosts ; then + echo $containerip $localip >> /etc/hosts + fi +fi + +geo_dockerip= +if [[ -f /var/run/localip_override ]] ; then + geo_dockerip="$dockerip/32 0;" +fi + openssl verify -CAfile $root_cert $server_cert -cat </var/lib/arvados/nginx.conf +cat <$ARVADOS_CONTAINER_PATH/nginx.conf worker_processes auto; -pid /var/lib/arvados/nginx.pid; +pid $ARVADOS_CONTAINER_PATH/nginx.pid; error_log stderr; daemon off; @@ -23,18 +34,25 @@ events { } http { - access_log off; - include /etc/nginx/mime.types; - default_type application/octet-stream; - client_max_body_size 128M; - - server { - listen ${services[doc]} default_server; - listen [::]:${services[doc]} default_server; - root /usr/src/arvados/doc/.site; - index index.html; - server_name _; - } + access_log off; + include /etc/nginx/mime.types; + default_type application/octet-stream; + client_max_body_size 128M; + + geo \$external_client { + default 1; + 127.0.0.0/8 0; + $containerip/32 0; + $geo_dockerip + } + + server { + listen ${services[doc]} default_server; + listen [::]:${services[doc]} default_server; + root /usr/src/arvados/doc/.site; + index index.html; + server_name _; + } server { listen 80 default_server; @@ -55,32 +73,35 @@ http { proxy_set_header Host \$http_host; proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; + proxy_set_header X-External-Client \$external_client; proxy_redirect off; + # This turns off response caching + proxy_buffering off; } } -upstream arvados-ws { - server localhost:${services[websockets]}; -} -server { - listen *:${services[websockets-ssl]} ssl default_server; - server_name websockets; + upstream arvados-ws { + server localhost:${services[websockets]}; + } + server { + listen *:${services[websockets-ssl]} ssl default_server; + server_name websockets; - proxy_connect_timeout 90s; - proxy_read_timeout 300s; + proxy_connect_timeout 90s; + proxy_read_timeout 300s; - ssl on; - ssl_certificate "${server_cert}"; - ssl_certificate_key "${server_cert_key}"; + ssl on; + ssl_certificate "${server_cert}"; + ssl_certificate_key "${server_cert_key}"; - location / { - proxy_pass http://arvados-ws; - proxy_set_header Upgrade \$http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host \$http_host; - proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + location / { + proxy_pass http://arvados-ws; + proxy_set_header Upgrade \$http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host \$http_host; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + } } -} upstream workbench2 { server localhost:${services[workbench2]}; @@ -124,7 +145,6 @@ server { } } - upstream keepproxy { server localhost:${services[keepproxy]}; } @@ -166,8 +186,53 @@ server { } } + +upstream arvados-webshell { + server localhost:${services[webshell]}; +} +server { + listen ${services[webshell-ssl]} ssl; + server_name arvados-webshell; + + proxy_connect_timeout 90s; + proxy_read_timeout 300s; + + ssl on; + ssl_certificate "${server_cert}"; + ssl_certificate_key "${server_cert_key}"; + + location / { + if (\$request_method = 'OPTIONS') { + add_header 'Access-Control-Allow-Origin' '*'; + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; + add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; + add_header 'Access-Control-Max-Age' 1728000; + add_header 'Content-Type' 'text/plain charset=UTF-8'; + add_header 'Content-Length' 0; + return 204; + } + if (\$request_method = 'POST') { + add_header 'Access-Control-Allow-Origin' '*'; + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; + add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; + } + if (\$request_method = 'GET') { + add_header 'Access-Control-Allow-Origin' '*'; + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; + add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; + } + + proxy_ssl_session_reuse off; + proxy_read_timeout 90; + proxy_set_header X-Forwarded-Proto https; + proxy_set_header Host \$http_host; + proxy_set_header X-Real-IP \$remote_addr; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + proxy_pass http://arvados-webshell; + } +} } EOF -exec nginx -c /var/lib/arvados/nginx.conf +exec nginx -c $ARVADOS_CONTAINER_PATH/nginx.conf