diff --git a/ops/nginx_conf/autossl.conf b/ops/nginx_conf/autossl.conf new file mode 100644 index 0000000..a7ae8b7 --- /dev/null +++ b/ops/nginx_conf/autossl.conf @@ -0,0 +1,19 @@ +listen 443 ssl http2; +listen 4443 ssl; + +ssl_protocols TLSv1 TLSv1.1 TLSv1.2; +ssl_prefer_server_ciphers on; +ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5; + +ssl_certificate_by_lua_block { + auto_ssl:ssl_certificate() +} + +location /.well-known/acme-challenge/ { + content_by_lua_block { + auto_ssl:challenge_server() + } +} + +ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt; +ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key; diff --git a/ops/nginx_conf/nginx.conf b/ops/nginx_conf/nginx.conf new file mode 100644 index 0000000..271530c --- /dev/null +++ b/ops/nginx_conf/nginx.conf @@ -0,0 +1,140 @@ +#user nobody; +worker_processes 8; + +#error_log logs/error.log; +#error_log logs/error.log notice; +#error_log logs/error.log info; + +#pid logs/nginx.pid; + + +events { + worker_connections 1024; +} + +http { + client_max_body_size 4g; + + + lua_shared_dict auto_ssl 100m; + lua_shared_dict auto_ssl_settings 64k; + + resolver 8.8.4.4 8.8.8.8; + + init_by_lua_block { + auto_ssl = (require "resty.auto-ssl").new() + auto_ssl:set("storage_adapter", "resty.auto-ssl.storage_adapters.redis") + auto_ssl:set("allow_domain", function(domain) + return ngx.req.toAllow + end) + + auto_ssl:set("request_domain", function(ssl, ssl_options) + local json = require "cjson" + local redis = require "resty.redis" + local socket = assert(require "socket.unix"()) + + local domain, err = ssl.server_name() + + local function connect(path) + assert(socket:settimeout(.1)) + local status,err = pcall(function() assert(socket:connect(path)) end) + if status then return true end + return false + end + + if not domain then + ngx.log(ngx.ERR, "no host header found") + ngx.exit(499) + return false + end + + local red = redis:new() + red:set_timeout(1000) -- 1 second + + local ok, err = red:connect("127.0.0.1", 6379) + if not ok then + ngx.log(ngx.ERR, "failed to connect to redis: ", err) + return ngx.exit(598) + end + + local res, err = red:hgetall("proxy_host_"..domain) + local res = red:array_to_hash(res) + + ngx.req.targetInfo = res + + if not res["ip"] then + if connect("/var/run/proxy_lookup.socket") then + assert(socket:send(json.encode({domain = domain}))) + while 1 do + local s, status, partial = socket:receive() + if partial then + res = json.decode(partial) + socket:close() + break + end + end + end + end + + ngx.req.targetInfo = res + + if not res["ip"] then + ngx.log(ngx.ERR, "no host found for key ", domain) + ngx.exit(406) + return false + end + + ngx.req.toAllow = true; + + if res['wildcard_parent'] then + return res['wildcard_parent'], err + end + + return domain, err + end) + + auto_ssl:init() + } + + init_worker_by_lua_block { + auto_ssl:init_worker() + } + + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + server { + listen 127.0.0.1:8999; + + # Increase the body buffer size, to ensure the internal POSTs can always + # parse the full POST contents into memory. + client_body_buffer_size 128k; + client_max_body_size 128k; + + location / { + content_by_lua_block { + auto_ssl:hook_server() + } + } + } + + include mime.types; + default_type application/octet-stream; + + #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + # '$status $body_bytes_sent "$http_referer" ' + # '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; + + sendfile on; + #tcp_nopush on; + + #keepalive_timeout 0; + keepalive_timeout 65; + + gzip on; + include sites-enabled/*; + +} diff --git a/ops/nginx_conf/proxy.conf b/ops/nginx_conf/proxy.conf new file mode 100644 index 0000000..7bf7c60 --- /dev/null +++ b/ops/nginx_conf/proxy.conf @@ -0,0 +1,69 @@ +map $http_upgrade $connection_upgrade { + default Upgrade; + '' close; +} + +server { + listen 80; + + include autossl.conf; + + set_real_ip_from 192.168.1.0/24; + real_ip_header X-Real-IP; + real_ip_recursive on; + + location / { + + set $target ''; + set $target_scheme 'http'; + set $target_port ''; + set $header_host $host; + + access_by_lua ' + local host = ngx.var.host + local uri = ngx.var.uri + local scheme = ngx.var.scheme + + if scheme == "http" then + if ngx.req.targetInfo["forcessl"] == "true" then + return ngx.redirect("https://"..host..uri, 301) + end + end + + if ngx.req.targetInfo["targetssl"] == "true" then + ngx.var.target_scheme = "https" + end + + if ngx.req.targetInfo["host-pass-though"] == "false" then + ngx.var.header_host = ngx.req.targetInfo["ip"] + end + + ngx.var.target = ngx.req.targetInfo["ip"] + ngx.var.target_port = ngx.req.targetInfo["targetPort"] + '; + + + resolver 192.168.1.1 ipv6=off; #8.8.4.4; # use Google's open DNS server + + proxy_http_version 1.1; + proxy_pass_request_headers on; + proxy_pass $target_scheme://$target:$target_port; + + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_ssl_session_reuse on; + proxy_intercept_errors off; + + proxy_set_header Host $header_host; + add_header X-Target-Host $target; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $target_scheme; + proxy_set_header Referer $target_scheme://$header_host; + proxy_set_header Accept-Language $http_accept_language; + proxy_set_header User-Agent $http_user_agent; + + sub_filter $target $host; + sub_filter_once off; + } +}