139 lines
4.0 KiB
Nginx Configuration File
139 lines
4.0 KiB
Nginx Configuration File
{%- set unique_ports = [] %}
|
|
|
|
{%- for item in http %}
|
|
|
|
{#- Gather http ports #}
|
|
{%- for port in item.external.extra_http_ports %}
|
|
{%- if port not in unique_ports %}
|
|
{{- unique_ports.append(port) }}
|
|
{%- endif %}
|
|
{%- endfor %}
|
|
|
|
{#- Gather https ports #}
|
|
{%- for port in item.external.extra_https_ports %}
|
|
{%- if port not in unique_ports %}
|
|
{{- unique_ports.append(port) }}
|
|
{%- endif %}
|
|
{%- endfor %}
|
|
|
|
{%- endfor %}
|
|
|
|
load_module /usr/lib64/nginx/modules/ngx_stream_module.so;
|
|
|
|
worker_processes auto;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
stream {
|
|
log_format basic '| Remote Addr: $remote_addr:$server_port | SSL Preread: $ssl_preread_server_name | Forward: $map_forward$upstream_port | Upstream Addr: $upstream_addr | $time_local | $protocol | $status | $bytes_sent | $bytes_received | $session_time |';
|
|
|
|
include /etc/nginx/stream.d/*.conf;
|
|
|
|
# Map all SSL parsed server names to hosts
|
|
map $ssl_preread_server_name $map_forward {
|
|
|
|
# Empty ssl preread gets forwarded to internal http server
|
|
"" "unix:/var/lib/nginx/tmp/nginx_http.sock";
|
|
|
|
# These domains will get forwarded to the internal https server
|
|
{% for item in http %}
|
|
{{ item.external.domain }}{{ expose_tld }} unix:/var/lib/nginx/tmp/nginx_https.sock;
|
|
{% endfor %}
|
|
|
|
{% for item in forward %}
|
|
{{ item.domain }}{{ expose_tld }} {{ item.ip }};
|
|
{% endfor %}
|
|
|
|
# By default forward to our internal nginx server (probably kubernetes)
|
|
default {{ defaults.forward_ip }};
|
|
}
|
|
|
|
# Since traffic being forwarded to the unix socket doesn't need a port we'll create
|
|
# a map here to enforce that case.
|
|
map $map_forward $upstream_port {
|
|
{{ defaults.forward_ip }} ":443";
|
|
|
|
"unix:/var/lib/nginx/tmp/nginx_http.sock" "";
|
|
"unix:/var/lib/nginx/tmp/nginx_https.sock" "";
|
|
|
|
default ":$server_port";
|
|
}
|
|
|
|
server {
|
|
access_log /var/log/nginx/nginx_stream_access.log basic;
|
|
error_log /var/log/nginx/nginx_stream_error.log warn;
|
|
|
|
proxy_protocol on;
|
|
|
|
# The default http ports
|
|
{% for port in defaults.listen_ports %}
|
|
listen {{ port }};
|
|
listen [::]:{{ port }};
|
|
{% endfor %}
|
|
|
|
# Any unique ports listed in the extra_ports field
|
|
{% for port in unique_ports %}
|
|
listen {{ port }};
|
|
listen [::]:{{ port }};
|
|
{% endfor %}
|
|
|
|
proxy_pass $map_forward$upstream_port;
|
|
ssl_preread on;
|
|
proxy_socket_keepalive on;
|
|
}
|
|
}
|
|
|
|
http {
|
|
log_format basic '| Proxy Proto Addr: $proxy_protocol_addr | Internal: $external_addr | Remote Addr: $remote_addr:$server_port | Host: $host | Forward: $map_forward$server_port | Referer: $http_referer | $request | $time_local | $status |';
|
|
|
|
map $host $map_forward {
|
|
"" "unix:/var/lib/nginx/tmp/nginx_http.sock";
|
|
|
|
# We don't want to forward traffic we're terminating
|
|
# Rather we'll catch it here and redirect to 443.
|
|
{% for item in http %}
|
|
{{ item.external.domain }}{{ expose_tld }} "unix:/var/lib/nginx/tmp/nginx_https.sock";
|
|
{% endfor %}
|
|
|
|
default {{ defaults.forward_ip }};
|
|
}
|
|
|
|
# Handle internal http requests through unix:/var/lib/nginx/tmp/nginx_http.sock
|
|
server {
|
|
access_log /var/log/nginx/nginx_http_access.log basic;
|
|
error_log /var/log/nginx/nginx_http_error.log warn;
|
|
|
|
listen unix:/var/lib/nginx/tmp/nginx_http.sock default_server proxy_protocol;
|
|
|
|
location / {
|
|
# If we have an external forward IP, forward traffic
|
|
if ($map_forward != "unix:/var/lib/nginx/tmp/nginx_http.sock") {
|
|
proxy_pass $map_forward:80;
|
|
}
|
|
# Else redirect if the scheme is http
|
|
if ($scheme = "http") {
|
|
return 301 https://$host:443$request_uri;
|
|
}
|
|
}
|
|
}
|
|
|
|
map $proxy_protocol_addr $external_addr {
|
|
default 1;
|
|
{% for ip in internal_ipv4_regex %}
|
|
~{{ ip }} 0;
|
|
{% endfor %}
|
|
{% for ip in internal_ipv6_regex %}
|
|
~{{ ip }} 0;
|
|
{% endfor %}
|
|
}
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
include /etc/nginx/http.d/*.conf;
|
|
}
|