89 lines
2.6 KiB
Nginx Configuration File
89 lines
2.6 KiB
Nginx Configuration File
load_module /usr/lib64/nginx/modules/ngx_stream_module.so;
|
|
|
|
worker_processes 8;
|
|
|
|
events {}
|
|
|
|
stream {
|
|
log_format basic '$remote_addr $restricted_domain [$time_local] '
|
|
'$protocol $status $bytes_sent $bytes_received '
|
|
'$session_time';
|
|
|
|
include /etc/nginx/stream.d/*.conf;
|
|
|
|
# Map all SSL parsed server names to hosts
|
|
map $ssl_preread_server_name $unrestricted_domain {
|
|
|
|
"" 127.0.0.1:443;
|
|
|
|
# For each domain we need to stream to a remote server, forward to internal domain
|
|
{% for domain in stream_ssl %}
|
|
{{ domain.external.domain }} {{ domain.internal.domain }}:{{ domain.internal.port }};
|
|
{% endfor %}
|
|
|
|
# For each domain we want to terminate, forward to internal http server
|
|
{% for domain in terminate_ssl %}
|
|
{% if not domain.restricted %}
|
|
{{ domain.external.domain }} 127.0.0.1:443;
|
|
{% endif %}
|
|
{% endfor %}
|
|
|
|
default {{ nginx.defaults.domain }}:443;
|
|
}
|
|
|
|
map $ssl_preread_server_name $restricted_domain {
|
|
|
|
"" 127.0.0.1:443;
|
|
|
|
# For each domain we need to stream to a remote server, forward to internal domain
|
|
{% for domain in stream_ssl %}
|
|
{{ domain.external.domain }} {{ domain.internal.domain }}:{{ domain.internal.port }};
|
|
{% endfor %}
|
|
|
|
# For each domain we want to terminate, forward to internal http server
|
|
{% for domain in terminate_ssl %}
|
|
{{ domain.external.domain }} 127.0.0.1:443;
|
|
{% endfor %}
|
|
|
|
default {{ nginx.defaults.domain }}:443;
|
|
}
|
|
|
|
# Forward 443 traffic
|
|
server {
|
|
access_log /var/log/nginx/stream-access-443.log basic;
|
|
listen {{ ansible_default_ipv4.address }}:443;
|
|
resolver 1.1.1.1;
|
|
proxy_pass $restricted_domain;
|
|
ssl_preread on;
|
|
proxy_socket_keepalive on;
|
|
}
|
|
|
|
# Forward 444 (restricted) traffic
|
|
server {
|
|
access_log /var/log/nginx/stream-access-444.log basic;
|
|
listen {{ ansible_default_ipv4.address }}:444;
|
|
resolver 1.1.1.1;
|
|
proxy_pass $unrestricted_domain;
|
|
ssl_preread on;
|
|
proxy_socket_keepalive on;
|
|
}
|
|
}
|
|
|
|
http {
|
|
log_format compression '$remote_addr - $remote_user [$time_local] '
|
|
'"$request" $status $bytes_sent '
|
|
'"$http_referer" "$http_user_agent" "$gzip_ratio"';
|
|
|
|
server {
|
|
access_log /var/log/nginx/http-access.log compression;
|
|
|
|
listen 80 default_server;
|
|
|
|
if ($scheme = "http") {
|
|
return 301 https://$host:443$request_uri;
|
|
}
|
|
}
|
|
|
|
include /etc/nginx/http.d/*.conf;
|
|
}
|