nginx.conf.tmpl

{{define "logFormat"}}
    {{$escape := ""}}
    {{$format := "$host:$server_port $remote_addr - $remote_user [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\""}}
    {{if (has . "log")}}
        {{if .log.escape}}
            {{$escape = printf "escape=%s" .log.escape}}
        {{end}}
        {{$format = .log.format}}
    {{end}}
    log_format vhost {{$escape}} {{$format | strings.Squote}};
{{end}}
{{define "errorPages"}}
    error_page 502 503 504 404 @error;
    location @error {
    default_type "text/html";
    content_by_lua_block { require("error_page").go(ngx.status) }
    }
{{end}}
{{define "httpsRedirect"}}
    server {
    set $template_root /usr/local/openresty/nginx/lua/templates;
    # create the server based on the service
    server_name {{.name}}.{{.baseUrl}} {{if eq .name "www" }}{{.baseUrl}}{{end}};
    listen 80;

    access_log "/usr/local/openresty/nginx/logs/access.log" vhost;
    location / {
    return 301 https://$host$request_uri;
    }

    location /.well-known/acme-challenge/ {
    content_by_lua_block {
    auto_ssl:challenge_server()
    }
    }

    {{template "errorPages"}}
    }
{{end}}


{{define "enableSSO"}}
    {{if (has . "enableSso")}}
        {{ if .enableSso}}

            {{with $apps := datasource "apps"}}
                error_page 401 = @error401;

                access_by_lua_block {

                local failUrl = "{{$apps.authRequestRedirect}}"

                local glue = "?"
                -- TODO more sophisticated check
                if string.find(failUrl, "?") then
                glue = "&"
                end

                local urltools = require("url")

                local origin = string.format("%s://%s%s", ngx.var.scheme, ngx.var.host, ngx.var.request_uri)
                local loginUrl = string.format("%s%sorigin=%s", failUrl, glue, urltools.urlencode(origin))
                local res = ngx.location.capture("/auth")

                local goodStatus = {
                [200]=true,
                [201]=true,
                [204]=true
                }

                if goodStatus[res.status] ~= true then
                return ngx.redirect(loginUrl)
                end

                -- tests passed
                }

                location = /auth {
                internal;

                {{with $apps := datasource "apps"}}
                    {{if (has $apps "resolver")}}
                        resolver {{$apps.resolver}} ipv6=off;
                    {{else}}
                        resolver {{env.Getenv "SYSTEM_RESOLVER"}} ipv6=off;
                    {{end}}
                    set $upstream {{$apps.authRequestUpstream}};
                {{end}}
                proxy_pass $upstream;

                proxy_pass_request_body     off;

                proxy_set_header Content-Length "";
                proxy_set_header X-Original-URI $request_uri;
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                if ($http_cookie ~* "{{$apps.authRequestCookie}}=([^;]+)(?:;|$)") {
                set $token "Bearer $1";
                }
                proxy_set_header Authorization $token;
                }
            {{end}}
        {{end}}
    {{end}}
{{end}}

{{define "sslSettings"}}
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;

    ssl_prefer_server_ciphers on;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
{{end}}

{{define "enableSSL"}}
    {{if (has . "enableSsl")}}
        {{ if .enableSsl}}

            # anchor::domain {{.baseUrl}}

            ssl_certificate_by_lua_block {
            auto_ssl:ssl_certificate()
            }
            {{template "sslSettings"}}
            {{$sslPath := "/usr/local/openresty/nginx/ssl/"}}
            # fallback certs
            ssl_certificate "{{$sslPath}}{{.baseUrl}}/server.crt";
            ssl_certificate_key "{{$sslPath}}{{.baseUrl}}/server.key";
            {{/*Turn on client ssl??*/}}
            {{if index . "enableClientCerts" }}
                ssl_client_certificate "{{$sslPath}}{{.baseUrl}}/client/ca.crt";
                ssl_verify_client on;
                ssl_verify_depth 2;
            {{end}}
        {{end}}
    {{end}}
{{end}}

{{define "enableMaxBody"}}
    client_max_body_size {{ . }};
{{end}}

{{define "_proxyPassLocation"}}
    set $upstream {{(print "http://" .host ":" .port)}};
    proxy_pass $upstream;
    {{if not (and (has . "headers") (or (has .headers "Host") (has .headers "host")))}}
        proxy_set_header       Host {{.host}};
    {{end}}

    {{if has . "headers"}}
        {{range $name, $value := .headers}}
            proxy_set_header {{$name}} "{{printf "%s" $value}}";
        {{end}}
    {{end}}
{{end}}

{{define "pathRules"}}
    {{range $rule :=  .}}
        {{if eq $rule.type "prefix"}}
            location ^~ {{$rule.path | trimSpace}} {
            proxy_redirect          off;
            proxy_intercept_errors  on;
            {{template "_proxyPassLocation" $rule.origin}}
            {{if eq $rule.stripPath true}}
                rewrite ^{{$rule.path | trimSpace}}(.*)$ /$1 break;
            {{end}}
            }

        {{end}}
    {{end}}
{{end}}

{{define "localOrigin"}}
    root {{$.root}};
    include mime.types;
    try_files $uri $uri/ {{if has . "fallbacks"}}
        {{range $fallback := .fallbacks }}
            {{$fallback | shellQuote}}
        {{end}}
    {{end}} =404;
    {{if has . "pathRules"}}
        {{template "pathRules" .pathRules}}
    {{end}}

    {{if has . "errorPages"}}
        {{range $code, $pageConf := .errorPages}}
            error_page {{$code}} {{$pageConf.file}};
        {{end}}
    {{end}}
{{end}}

{{define "remoteOrigin"}}

    # TODO: yes?
    add_header Strict-Transport-Security "max-age=31536000";
    add_header X-Request-ID $request_id; # Return to client

    location ~* \.(ogg|ogv|svgz|mp4|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|mid|midi|wav|bmp|eot|oft|svg|ttf|woff)$ {

    log_not_found off;
    access_log off;

    {{template "_proxyPassLocation" .}}
    }

    location ~* \.(css|js|htm|html)$ {
    log_not_found on;
    access_log off;
    {{template "_proxyPassLocation" .}}
    }

    location / {
    {{template "_proxyPassLocation" .}}
    }
    {{if has . "pathRules"}}
        {{template "pathRules" .pathRules}}
    {{end}}

{{end}}


{{with $apps := datasource "apps"}}
    {{if has $apps "baseUrl"}}
        # anchor::domain {{$apps.baseUrl}}
    {{end}}

    events {
    worker_connections  {{if (has $apps "workerConnections") }}{{$apps.workerConnections}}{{else}}1024{{end}};
    }


    http {
    # The "auto_ssl" shared dict should be defined with enough storage space to
    # hold your certificate data. 1MB of storage holds certificates for
    # approximately 100 separate domains.
    lua_shared_dict auto_ssl 1m;
    # The "auto_ssl" shared dict is used to temporarily store various settings
    # like the secret used by the hook server on port 8999. Do not change or
    # omit it.
    lua_shared_dict auto_ssl_settings 1m;

    lua_package_path "$prefix/lua/?.lua;;";

    # If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
    # scheme used to connect to this server
    map $http_x_forwarded_proto $proxy_x_forwarded_proto {
    default $http_x_forwarded_proto;
    ''      $scheme;
    }

    # If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
    # Connection header that may have been passed to this server
    map $http_upgrade $proxy_connection {
    default upgrade;
    '' close;
    }

    gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    {{template "logFormat" $apps}}

    {{if (has $apps "resolver")}}
        resolver {{$apps.resolver}} ipv6=off;
    {{else}}
        resolver {{env.Getenv "SYSTEM_RESOLVER"}} ipv6=off;
    {{end}}


    # HTTP 1.1 support
    proxy_http_version 1.1;
    proxy_buffering off;
    proxy_set_header Host $http_host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $proxy_connection;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
    proxy_set_header X-Request-ID $request_id; # Pass to app server

    {{if (has $apps "proxyConnectTimeout") }}
        proxy_connect_timeout       {{$apps.proxyConnectTimeout}};
    {{else}}
        proxy_connect_timeout       120;
    {{end}}
    {{if (has $apps "proxySendTimeout") }}
        proxy_send_timeout          {{$apps.proxySendTimeout}};
    {{else}}
        proxy_send_timeout          120;
    {{end}}
    {{if (has $apps "proxyReadTimeout") }}
        proxy_read_timeout          {{$apps.proxyReadTimeout}};
    {{else}}
        proxy_read_timeout          120;
    {{end}}
    {{if (has $apps "sendTimeout") }}
        send_timeout                {{$apps.sendTimeout}};
    {{else}}
        send_timeout                120;
    {{end}}

    init_by_lua_block {
    auto_ssl = (require "resty.auto-ssl").new()
    {{if ( and (has $apps "letsEncrypt") (has $apps.letsEncrypt "endpoint"))}}
        auto_ssl:set("ca", "{{$apps.letsEncrypt.endpoint}}")
    {{end}}

    -- Define a function to determine which SNI domains to automatically handle
    -- and register new certificates for. Defaults to not allowing any domains,
    -- so this must be configured.
    auto_ssl:set("allow_domain", function(domain)

    {{range $confService := $apps.services}}
        {{if (has $confService "subdomains")}}
            {{range $subdomain := $confService.subdomains}}
                {{if (has $subdomain "enableLetsEncrypt")}}
                    {{if $subdomain.enableLetsEncrypt}}

                        {{if eq $subdomain.name "www" }}
                            if domain == "{{$subdomain.baseUrl}}" then
                            return true
                            end
                        {{end}}
                        if domain == "{{$subdomain.name}}.{{$subdomain.baseUrl}}" then
                        return true
                        end
                    {{end}}
                {{end}}
            {{end}}
        {{end}}
    {{end}}
    return false

    end)

    auto_ssl:init()
    }


    init_worker_by_lua_block {
    auto_ssl:init_worker()
    }

    server {
    set $template_root /usr/local/openresty/nginx/lua/templates;
    server_name _; # This is just an invalid value which will never trigger on a real hostname.
    listen 80;
    access_log "/usr/local/openresty/nginx/logs/access.log" vhost;

    # Endpoint used for performing domain verification with Let's Encrypt.

    location /assets {
    root "/usr/local/openresty/nginx/html";
    try_files $uri $uri/;
    }


    location / {
    return 404;
    }

    {{template "errorPages"}}

    }


    # Internal server running on port 8999 for handling certificate tasks.
    server {
    listen 127.0.0.1:8999;

    # Increase the body buffer size, to ensure the internal POSTs can always
    # parse the full POST contents into memory.
    client_body_buffer_size 128k;
    client_max_body_size 128k;

    access_log "/usr/local/openresty/nginx/logs/access.log" vhost;

    location / {
    content_by_lua_block {
    auto_ssl:hook_server()
    }
    }
    }


    {{range $confService := $apps.services}}
        {{if (has $confService "subdomains")}}
            {{range $subdomain := $confService.subdomains}}
                {{if $subdomain.enabled}}

                    {{$port := or (index $subdomain "port") 443}}
                    {{$enableSsl := false}}
                    {{if (index $subdomain "enableSsl")}}
                        {{$enableSsl = true}}
                    {{else if eq $port 443 }}
                        {{$enableSsl = true}}
                    {{end}}

                    {{if $enableSsl}}
                        {{template "httpsRedirect" (coll.Merge ( coll.Dict "log" (index $apps "log") ) $subdomain)}}
                    {{end}}
                    {{if eq $subdomain.name "www" }}

                        server {

                        # Service: {{$confService.name}}
                        set $template_root /usr/local/openresty/nginx/lua/templates;

                        # create the server based on the service
                        server_name {{$subdomain.baseUrl}};
                        listen {{$port}}{{if $enableSsl}} ssl{{end}};

                        access_log "/usr/local/openresty/nginx/logs/access.log" vhost;

                        location / {
                        return 301 https://www.$host$request_uri;
                        }

                        location /.well-known/acme-challenge/ {
                        content_by_lua_block {
                        auto_ssl:challenge_server()
                        }
                        }

                        {{template "enableSSL" $subdomain}}

                        {{template "enableSSO" $subdomain}}

                        {{template "enableMaxBody" (or (index $subdomain "clientMaxBodySize") "20m")}}
                        {{template "errorPages"}}
                        }
                    {{end}}
                    server {
                    set $template_root /usr/local/openresty/nginx/lua/templates;

                    # create the server based on the service
                    server_name {{$subdomain.name}}.{{$subdomain.baseUrl}};
                    listen {{$port}}{{if $enableSsl}} ssl{{end}};
                    access_log "/usr/local/openresty/nginx/logs/access.log" vhost;

                    {{template "enableSSL" $subdomain}}

                    {{template "enableSSO" $subdomain}}

                    {{if (has $subdomain "clientMaxBodySize")}}
                        {{template "enableMaxBody" $subdomain.clientMaxBodySize}}
                    {{else}}
                        {{template "enableMaxBody" "20m"}}
                    {{end}}

                    ## log error request body and response if certain error codes
                    set $response_body '';  #we must declare variables first, we cannot create vars in lua
                    set $error_request_body '';
                    set $error_response_body '';
                    body_filter_by_lua '
                    local resp_body = string.sub(ngx.arg[1], 1, 1000)  -- arg[1] contains a chunk of response content
                    ngx.ctx.buffered = string.sub((ngx.ctx.buffered or "") .. resp_body, 1, 1000)
                    if ngx.arg[2] then  -- arg[2] is true if this is the last chunk
                    ngx.var.response_body = ngx.ctx.buffered
                    end
                    ';
                    # TODO: make this configurable
                    log_by_lua '
                    local ignoreStatus = {
                    ["200"]=true,
                    ["201"]=true,
                    ["204"]=true,
                    ["301"]=true,
                    ["302"]=true,
                    ["422"]=true,
                    ["403"]=true,
                    ["404"]=true,
                    ["401"]=true
                    }

                    if ignoreStatus[ngx.var.status] ~= true then
                    ngx.var.error_response_body = ngx.var.response_body
                    ngx.var.error_request_body = ngx.var.request_body
                    end
                    ';


                    {{if eq $confService.origin.type "remote"}}
                        {{template "remoteOrigin" $confService.origin}}
                    {{end}}
                    {{if eq $confService.origin.type "local"}}
                        {{template "localOrigin" $confService.origin}}
                    {{end}}

                    }
                {{end}}
            {{end}}
        {{end}}
    {{end}}
{{end}}
}