-
Notifications
You must be signed in to change notification settings - Fork 25
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
MDBF-804 - BB NGINX configuration in GH CI
About This Patch: - Using templates (present since NGINX 1.19) to populate conf.d. - Templates allow for the use of environment variables defined in the .env files, enabling us to distinguish between PROD and DEV environments, particularly for the server name and certificate paths. - A proxy_params file is required according to the PROD configuration. - Mounting /etc/letsencrypt/live for SSL certificates. The base path is the same in both environments. - NGINX_ARTIFACTS_SSL_PATH variable is necessary because, in DEV, the same certificate is used for both CI and BB. - Attaching net_back to the NGINX container to facilitate communication with master-web via DNS. - Removing net_front from master-web; communication will be handled through NGINX. - NGINX access/error logs are written to the Docker-Compose relative path logs/nginx, which is needed for Zabbix collection. TODO Before Migration to PROD: - Address all FIXME comments. - Cross-reference proxy pass - helper_files directory name on hz-bbm2. - location /cloud-init ? TODO Before Deployment in DEV: - Disable the HAProxy service.
- Loading branch information
1 parent
c8775dd
commit 91abbe0
Showing
8 changed files
with
236 additions
and
36 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| proxy_set_header Host $http_host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| server { | ||
| listen 80; | ||
| listen [::]:80; | ||
| server_name ${NGINX_BUILDBOT_VHOST}; | ||
| return 301 https://$server_name$request_uri; | ||
| } | ||
|
|
||
|
|
||
| # Default rate limited zone, with 30 requests per minute | ||
| limit_req_zone $request_uri zone=default:10m rate=30r/m; | ||
| client_max_body_size 10M; | ||
|
|
||
| server { | ||
| listen 443 ssl http2 default_server; | ||
| listen [::]:443 ssl http2 default_server; | ||
|
|
||
| server_name ${NGINX_BUILDBOT_VHOST}; | ||
|
|
||
| # logging | ||
| access_log /var/log/nginx/buildbot.access.log; | ||
| error_log /var/log/nginx/buildbot.error.log error; | ||
|
|
||
| # SSL configuration | ||
| # ssl on; Deprecated in newer versions of NGINX (yields nginx: [emerg] unknown directive "ssl ) | ||
| ssl_certificate /etc/nginx/ssl/${NGINX_BUILDBOT_VHOST}/fullchain.pem; # managed by Certbot | ||
| ssl_certificate_key /etc/nginx/ssl/${NGINX_BUILDBOT_VHOST}/privkey.pem; # managed by Certbot | ||
| # put a one day session timeout for websockets to stay longer | ||
| ssl_session_cache shared:SSL:10m; | ||
| ssl_session_timeout 1d; | ||
| ssl_protocols TLSv1.1 TLSv1.2; | ||
|
|
||
| # Force https - Enable HSTS | ||
| add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;" always; | ||
| # # Disable embedding the site | ||
| add_header X-Frame-Options "SAMEORIGIN"; | ||
| # # Enable XSS protection | ||
| add_header X-XSS-Protection "1;mode=block"; | ||
|
|
||
| # Enable gziped format | ||
| #gzip on; already on in main conf | ||
| # Set level of compression | ||
| gzip_comp_level 3; | ||
| # Set mime types | ||
| gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; | ||
|
|
||
| proxy_set_header Host $host; | ||
| proxy_set_header X-Real-IP $remote_addr; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_set_header X-Forwarded-Server $host; | ||
| proxy_set_header X-Forwarded-Host $host; | ||
|
|
||
| # Use default zone for rate limiting, allow burst of 10 requests with | ||
| # no delay | ||
| limit_req zone=default burst=10 nodelay; | ||
|
|
||
| location / { | ||
| # Reverse proxy settings | ||
| include proxy_params; | ||
| proxy_pass http://master-web:8010; | ||
| } | ||
|
|
||
| # disable logging for wsgi_dashboards/styles.css since it's generated | ||
| # somewhere and mess with fail2ban //TEMP find the root cause! | ||
| location ~ /wsgi_dashboards/styles.css* { | ||
| access_log off; | ||
| } | ||
| location = /favicon.ico { | ||
| access_log off; | ||
| } | ||
| location = /robots.txt { | ||
| access_log off; | ||
| } | ||
|
|
||
| # Server sent event (sse) settings | ||
| location /sse { | ||
| proxy_buffering off; | ||
| proxy_pass http://master-web:8010/sse; | ||
| } | ||
|
|
||
| # Websocket settings | ||
| location /ws { | ||
| proxy_http_version 1.1; | ||
| proxy_set_header Upgrade $http_upgrade; | ||
| proxy_set_header Connection "upgrade"; | ||
| proxy_pass http://master-web:8010/ws; | ||
| proxy_read_timeout 6000s; | ||
| } | ||
|
|
||
|
|
||
| #FIXME: CrossReference not in DEV. ProxyPass for PROD? | ||
| # Cross-reference | ||
| # location /cr/static { | ||
| # alias /srv/cr/static; | ||
| # } | ||
|
|
||
| # location /cr/ { | ||
| # include proxy_params; | ||
| # proxy_pass http://hz-bbw5:8080; | ||
| # } | ||
| } |
Oops, something went wrong.