nginx conf files

ops/nginx_conf/autossl.conf

@@ -0,0 +1,19 @@
+listen 443 ssl http2;
+listen 4443 ssl;
+
+ssl_protocols     TLSv1 TLSv1.1 TLSv1.2;
+ssl_prefer_server_ciphers  on;
+ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
+
+ssl_certificate_by_lua_block {
+    auto_ssl:ssl_certificate()
+}
+
+location /.well-known/acme-challenge/ {
+    content_by_lua_block {
+        auto_ssl:challenge_server()
+    }
+}
+
+ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
+ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;

ops/nginx_conf/nginx.conf

@@ -0,0 +1,140 @@
+#user  nobody;
+worker_processes 8;
+
+#error_log  logs/error.log;
+#error_log  logs/error.log  notice;
+#error_log  logs/error.log  info;
+
+#pid        logs/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    client_max_body_size 4g;
+
+
+    lua_shared_dict auto_ssl 100m;
+    lua_shared_dict auto_ssl_settings 64k;
+
+    resolver 8.8.4.4 8.8.8.8;
+
+    init_by_lua_block {
+        auto_ssl = (require "resty.auto-ssl").new()
+        auto_ssl:set("storage_adapter", "resty.auto-ssl.storage_adapters.redis")
+        auto_ssl:set("allow_domain", function(domain)
+          return ngx.req.toAllow
+        end)
+
+        auto_ssl:set("request_domain", function(ssl, ssl_options)
+            local json = require "cjson"
+            local redis = require "resty.redis"
+            local socket = assert(require "socket.unix"())
+
+            local domain, err = ssl.server_name()
+
+            local function connect(path)
+                assert(socket:settimeout(.1))
+                local status,err = pcall(function() assert(socket:connect(path)) end)
+                if status then return true end
+                return false
+            end
+
+            if not domain then
+                ngx.log(ngx.ERR, "no host header found")
+                ngx.exit(499)
+                return false
+            end
+
+            local red = redis:new()
+            red:set_timeout(1000) -- 1 second
+
+            local ok, err = red:connect("127.0.0.1", 6379)
+            if not ok then
+                ngx.log(ngx.ERR, "failed to connect to redis: ", err)
+                return ngx.exit(598)
+            end
+
+            local res, err = red:hgetall("proxy_host_"..domain)
+            local res = red:array_to_hash(res)
+
+            ngx.req.targetInfo = res
+
+            if not res["ip"] then
+                if connect("/var/run/proxy_lookup.socket") then 
+                    assert(socket:send(json.encode({domain = domain})))
+                    while 1 do
+                        local s, status, partial = socket:receive()
+                        if partial then
+                            res = json.decode(partial)
+                            socket:close()
+                            break
+                        end
+                    end
+                end
+            end
+
+            ngx.req.targetInfo = res
+
+            if not res["ip"] then
+                ngx.log(ngx.ERR, "no host found for key ", domain)
+                ngx.exit(406)
+                return false
+            end
+
+            ngx.req.toAllow = true;
+
+            if res['wildcard_parent'] then
+                return res['wildcard_parent'], err
+            end
+
+            return domain, err
+        end)
+
+        auto_ssl:init()
+    }
+
+    init_worker_by_lua_block {
+      auto_ssl:init_worker()
+    }
+
+    ssl_session_cache   shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    server {
+      listen 127.0.0.1:8999;
+
+      # Increase the body buffer size, to ensure the internal POSTs can always
+      # parse the full POST contents into memory.
+      client_body_buffer_size 128k;
+      client_max_body_size 128k;
+
+      location / {
+        content_by_lua_block {
+          auto_ssl:hook_server()
+        }
+      }
+    }
+
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+    #                  '$status $body_bytes_sent "$http_referer" '
+    #                  '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log;
+    error_log /var/log/nginx/error.log;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    gzip  on;
+    include sites-enabled/*;
+
+}

ops/nginx_conf/proxy.conf

@@ -0,0 +1,69 @@
+map $http_upgrade $connection_upgrade {
+  default Upgrade;
+  '' close;
+}
+
+server {
+  listen 80;
+
+  include autossl.conf;
+
+  set_real_ip_from 192.168.1.0/24;
+  real_ip_header X-Real-IP;
+  real_ip_recursive on;
+
+  location / {
+
+	set $target '';
+	set $target_scheme 'http';
+	set $target_port '';
+	set $header_host $host;
+
+	access_by_lua '
+		local host = ngx.var.host
+		local uri = ngx.var.uri
+		local scheme = ngx.var.scheme
+
+		if scheme == "http" then
+			if ngx.req.targetInfo["forcessl"] == "true" then
+				return ngx.redirect("https://"..host..uri, 301)
+			end
+		end
+
+		if ngx.req.targetInfo["targetssl"] == "true" then
+			ngx.var.target_scheme = "https"
+		end
+
+		if ngx.req.targetInfo["host-pass-though"] == "false" then
+			ngx.var.header_host = ngx.req.targetInfo["ip"]
+		end
+	  
+		ngx.var.target = ngx.req.targetInfo["ip"]
+		ngx.var.target_port = ngx.req.targetInfo["targetPort"]
+	';
+
+
+	resolver 192.168.1.1 ipv6=off;  #8.8.4.4;  # use Google's open DNS server
+
+	proxy_http_version 1.1;
+	proxy_pass_request_headers on;
+	proxy_pass $target_scheme://$target:$target_port;
+
+	proxy_set_header Upgrade $http_upgrade;
+	proxy_set_header Connection $connection_upgrade;
+	proxy_ssl_session_reuse on;
+	proxy_intercept_errors off;
+
+	proxy_set_header Host $header_host;
+	add_header X-Target-Host $target;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $target_scheme;
+	proxy_set_header Referer $target_scheme://$header_host;
+	proxy_set_header Accept-Language $http_accept_language;
+	proxy_set_header User-Agent $http_user_agent;
+
+	sub_filter $target $host;
+	sub_filter_once off;
+  }
+}