diff --git a/ops/nginx_conf/nginx.conf b/ops/nginx_conf/nginx.conf index a05fbd5..2fb1824 100644 --- a/ops/nginx_conf/nginx.conf +++ b/ops/nginx_conf/nginx.conf @@ -1,5 +1,5 @@ #user nobody; -worker_processes 4; +worker_processes 8; #error_log logs/error.log; #error_log logs/error.log notice; @@ -9,116 +9,83 @@ worker_processes 4; events { - worker_connections 1024; + worker_connections 1024; } - http { - client_max_body_size 4g; + client_max_body_size 4g; + lua_shared_dict auto_ssl 100m; + lua_shared_dict auto_ssl_settings 64k; - lua_shared_dict auto_ssl 100m; - lua_shared_dict auto_ssl_settings 64k; + resolver 8.8.4.4 8.8.8.8; - resolver 8.8.4.4 8.8.8.8; + init_by_lua_block { - init_by_lua_block { - auto_ssl = (require "resty.auto-ssl").new() - auto_ssl:set("storage_adapter", "resty.auto-ssl.storage_adapters.redis") - auto_ssl:set("allow_domain", function(domain) - local json = require "cjson" - local socket = assert(require "socket.unix"()) - local function connect(path) - assert(socket:settimeout(.1)) - local status,err = pcall(function() assert(socket:connect(path)) end) - if status then return true end - return false - end + auto_ssl = (require "resty.auto-ssl").new() + auto_ssl:set("storage_adapter", "resty.auto-ssl.storage_adapters.redis") + + local targetInfo = require "targetinfo" - if not domain then - ngx.log(ngx.ERR, "no host header found") - ngx.exit(499) - return false - end + auto_ssl:set("allow_domain", function(domain) + ngx.log(ngx.ERR, "!!!!!!!!!! allow_domain ", ngx.ctx.toAllow) + return ngx.ctx.toAllow + end) - local redis = require "resty.redis" - local red = redis:new() + auto_ssl:set("request_domain", function(ssl, ssl_options) + local domain, err = ssl.server_name() - red:set_timeout(1000) -- 1 second + local res = targetInfo.get(ngx, domain, ngx.ctx.targetInfo) - local ok, err = red:connect("127.0.0.1", 6379) - if not ok then - ngx.log(ngx.ERR, "failed to connect to redis: ", err) - return ngx.exit(598) - end + if res['wildcard_parent'] then + return res['wildcard_parent'], err + end - local res, err = red:hgetall("proxy_host_"..domain) - local res = red:array_to_hash(res) + return domain, err + end) - if not res["ip"] then - if connect("/var/run/proxy_lookup.socket") then - assert(socket:send(json.encode({domain = domain}))) - while 1 do - local s, status, partial = socket:receive() - if partial then - res = json.decode(partial) - socket:close() - break - end - end - end - end + auto_ssl:init() + } - if not res["ip"] then - ngx.log(ngx.ERR, "no host found for key ", domain) - -- ngx.exit(406) - return false - end + init_worker_by_lua_block { + auto_ssl:init_worker() + } - return true - end) - auto_ssl:init() - } + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; - init_worker_by_lua_block { - auto_ssl:init_worker() - } + server { + listen 127.0.0.1:8999; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; + # Increase the body buffer size, to ensure the internal POSTs can always + # parse the full POST contents into memory. + client_body_buffer_size 128k; + client_max_body_size 128k; - server { - listen 127.0.0.1:8999; + location / { + content_by_lua_block { + auto_ssl:hook_server() + } + } + } - # Increase the body buffer size, to ensure the internal POSTs can always - # parse the full POST contents into memory. - client_body_buffer_size 128k; - client_max_body_size 128k; + include mime.types; + default_type application/octet-stream; - location / { - content_by_lua_block { - auto_ssl:hook_server() - } - } - } + #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + # '$status $body_bytes_sent "$http_referer" ' + # '"$http_user_agent" "$http_x_forwarded_for"'; - include mime.types; - default_type application/octet-stream; + access_log /var/log/nginx/access.log; + error_log /var/log/nginx/error.log; - #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' - # '$status $body_bytes_sent "$http_referer" ' - # '"$http_user_agent" "$http_x_forwarded_for"'; + sendfile on; + #tcp_nopush on; - access_log /var/log/nginx/access.log; - error_log /var/log/nginx/error.log; + #keepalive_timeout 0; + keepalive_timeout 65; - sendfile on; - #tcp_nopush on; + gzip on; + include sites-enabled/*; - #keepalive_timeout 0; - keepalive_timeout 65; - - #gzip on; - include sites-enabled/*; - -} \ No newline at end of file +} diff --git a/ops/nginx_conf/proxy.conf b/ops/nginx_conf/proxy.conf index 3d8cf2c..db0ee6e 100644 --- a/ops/nginx_conf/proxy.conf +++ b/ops/nginx_conf/proxy.conf @@ -14,103 +14,60 @@ server { location / { - set $target ''; - set $target_scheme 'http'; - set $target_port ''; - set $header_host $host; + set $target ''; + set $target_scheme 'http'; + set $target_port ''; + set $header_host $host; - access_by_lua ' - local host = ngx.var.host - local uri = ngx.var.uri - local scheme = ngx.var.scheme + access_by_lua ' + local targetInfo = require "targetinfo" + local host = ngx.var.host + local uri = ngx.var.uri + local scheme = ngx.var.scheme + local res = targetInfo.get(ngx, host, ngx.ctx.targetInfo) - local json = require "cjson" - local socket = assert(require "socket.unix"()) - local function connect(path) - assert(socket:settimeout(.1)) - local status,err = pcall(function() assert(socket:connect(path)) end) - if status then return true end - return false - end + ngx.log(ngx.ERR, "!!!!!!!!! after getTargetInfo proxy.conf ", res["ip"]) - if not host then - ngx.log(ngx.ERR, "no host header found") - return ngx.exit(499) - end + if scheme == "http" then + if res["forcessl"] == "true" then + return ngx.redirect("https://"..host..uri, 301) + end + end - local redis = require "resty.redis" - local red = redis:new() + if res["targetssl"] == "true" then + ngx.var.target_scheme = "https" + end - red:set_timeout(1000) -- 1 second - - local ok, err = red:connect("127.0.0.1", 6379) - if not ok then - ngx.log(ngx.ERR, "failed to connect to redis: ", err) - return ngx.exit(598) - end - - local res, err = red:hgetall("proxy_host_"..host) - local res = red:array_to_hash(res) - - if not res["ip"] then - if connect("/var/run/proxy_lookup.socket") then - assert(socket:send(json.encode({domain = host}))) - while 1 do - local s, status, partial = socket:receive() - if partial then - res = json.decode(partial) - socket:close() - break - end - end - end - end - - if not res["ip"] then - ngx.log(ngx.ERR, "no host found for key ", host) - return ngx.exit(406) - end - - if scheme == "http" then - if res["forcessl"] == "true" then - return ngx.redirect("https://"..host..uri, 301) - end - end - - if res["targetssl"] == "true" then - ngx.var.target_scheme = "https" - end - - if res["host-pass-though"] == "false" then - ngx.var.header_host = res["ip"] - end - - ngx.var.target = res["ip"] - ngx.var.target_port = res["targetPort"] - '; + if res["host-pass-though"] == "false" then + ngx.var.header_host = res["ip"] + end + + ngx.var.target = res["ip"] + ngx.var.target_port = res["targetPort"] + '; - resolver 192.168.1.1 ipv6=off; #8.8.4.4; # use Google's open DNS server + resolver 192.168.1.1 ipv6=off; #8.8.4.4; # use Google's open DNS server - proxy_http_version 1.1; - proxy_pass_request_headers on; - proxy_pass $target_scheme://$target:$target_port; + proxy_http_version 1.1; + proxy_pass_request_headers on; + proxy_pass $target_scheme://$target:$target_port; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_ssl_session_reuse on; - proxy_intercept_errors off; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_ssl_session_reuse on; + proxy_intercept_errors off; - proxy_set_header Host $header_host; - add_header X-Target-Host $target; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $target_scheme; - proxy_set_header Referer $target_scheme://$header_host; - proxy_set_header Accept-Language $http_accept_language; - proxy_set_header User-Agent $http_user_agent; + proxy_set_header Host $header_host; + add_header X-Target-Host $target; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $target_scheme; + proxy_set_header Referer $target_scheme://$header_host; + proxy_set_header Accept-Language $http_accept_language; + proxy_set_header User-Agent $http_user_agent; - sub_filter $target $host; - sub_filter_once off; + sub_filter $target $host; + sub_filter_once off; } -} \ No newline at end of file +} diff --git a/ops/nginx_conf/show.py b/ops/nginx_conf/show.py deleted file mode 100644 index e68cb16..0000000 --- a/ops/nginx_conf/show.py +++ /dev/null @@ -1,8 +0,0 @@ -members = ['Roisin', 'Billy', 'Joseph', 'Emily', 'Chloe'] - -message = "I love you {}" - -for member in members: - if member == "Billy": - continue - print(message.format(member)) \ No newline at end of file diff --git a/ops/nginx_conf/targetinfo.lua b/ops/nginx_conf/targetinfo.lua new file mode 100644 index 0000000..3e56558 --- /dev/null +++ b/ops/nginx_conf/targetinfo.lua @@ -0,0 +1,70 @@ +local M = {} + +-- Function to connect to a Unix socket +local function connect(path) + local socket = require("socket.unix")() + assert(socket:settimeout(.1)) + local status, err = pcall(function() assert(socket:connect(path)) end) + if status then return true end + return false +end + +print("In targetInfo module") + +-- Main function of the module +function M.get(ngx, domain, targetInfo) + ngx.log(ngx.ERR, "!!!!!!!!! in targetInfo get") + if targetInfo then + return targetInfo + end + + local json = require "cjson" + local redis = require "resty.redis" + + if not domain then + ngx.log(ngx.ERR, "no host header found") + ngx.exit(499) + return false + end + + local red = redis:new() + red:set_timeout(1000) -- 1 second + + local ok, err = red:connect("127.0.0.1", 6379) + if not ok then + ngx.log(ngx.ERR, "failed to connect to redis: ", err) + return ngx.exit(598) + end + + local res, err = red:hgetall("proxy_Host_"..domain) + res = red:array_to_hash(res) + + if not res["ip"] then + if connect("/var/run/proxy_lookup.socket") then + local socket = require("socket.unix")() + assert(socket:settimeout(.1)) + assert(socket:connect("/var/run/proxy_lookup.socket")) + assert(socket:send(json.encode({domain = domain}))) + while true do + local s, status, partial = socket:receive() + if partial then + res = json.decode(partial) + socket:close() + break + end + end + end + end + + if not res["ip"] then + ngx.exit(406) + return false + end + + ngx.ctx.targetInfo = res + ngx.ctx.toAllow = true + + return res +end + +return M diff --git a/ops/proxy.service b/ops/proxy.service index dd4f440..e2dc4a3 100644 --- a/ops/proxy.service +++ b/ops/proxy.service @@ -8,6 +8,7 @@ Type=simple Restart=always RestartSec=1 User=root +Environment="NODE_ENV=production" ExecStart=/usr/bin/env node /var/www/proxy/nodejs/bin/www [Install]