Skip to content

Commit 330ab17

Browse files
tiredofittiredofit
committed
Release 6.2.12 - See CHANGELOG.md
1 parent f269cb8 commit 330ab17

File tree

11 files changed

+89
-83
lines changed

11 files changed

+89
-83
lines changed

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## 6.2.12 2022-12-05 <dave at tiredofit dot ca>
2+
3+
### Changed
4+
- Big warning when using Basic Authentication
5+
- Indent some nginx configuration
6+
7+
18
## 6.2.11 2022-11-29 <dave at tiredofit dot ca>
29

310
### Changed

‎install/assets/functions/10-nginx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ nginx_configure_authentication() {
1313
case "${NGINX_AUTHENTICATION_TYPE,,}" in
1414
"basic")
1515
print_notice "Setting Basic Authentication"
16-
user_num=$(printenv | sort | grep -c '\NGINX_AUTHENTICATION_BASIC_USER.*')
16+
user_num=$(printenv | sort | grep -c 'NGINX_AUTHENTICATION_BASIC_USER.*')
1717
for ((i = 1; i <= user_num; i++)); do
1818
basic_user=NGINX_AUTHENTICATION_BASIC_USER${i}
1919
basic_pass=NGINX_AUTHENTICATION_BASIC_PASS${i}
2020
print_warn "Creating User: ${!basic_user}"
21-
htpasswd -b -n ${!basic_user:-$NGINX_AUTHENTICATION_BASIC_USER} ${!basic_pass:-$NGINX_AUTHENTICATION_BASIC_PASS} >>/etc/nginx/snippets/authentication/basic_authorized_users
21+
htpasswd -b -n ${!basic_user:-$NGINX_AUTHENTICATION_BASIC_USER} ${!basic_pass:-$NGINX_AUTHENTICATION_BASIC_PASS} >> /etc/nginx/snippets/authentication/basic_authorized_users
2222
done
2323
;;
2424
"ldap" )

‎install/etc/nginx/snippets/authentication/llng_auth_request‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
### Start LemonLDAP:NG Authentication
2-
set $original_uri $uri$is_args$args;
3-
auth_request /lmauth;
4-
auth_request_set $lmremote_user $upstream_http_lm_remote_user;
5-
auth_request_set $lmlocation $upstream_http_location;
6-
auth_request_set $cookie_value $upstream_http_set_cookie;
7-
add_header Set-Cookie $cookie_value;
8-
error_page 401 $lmlocation;
1+
### Start LemonLDAP:NG Authentication
2+
set $original_uri $uri$is_args$args;
3+
auth_request /lmauth;
4+
auth_request_set $lmremote_user $upstream_http_lm_remote_user;
5+
auth_request_set $lmlocation $upstream_http_location;
6+
auth_request_set $cookie_value $upstream_http_set_cookie;
7+
add_header Set-Cookie $cookie_value;
8+
error_page 401 $lmlocation;

‎install/etc/nginx/snippets/authentication/llng_location_block‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
1-
### LemonLDAP:NG authentication request
2-
location = /lmauth {
3-
internal;
4-
include /etc/nginx/fastcgi_params;
5-
fastcgi_pass llng-upstream-pool;
6-
fastcgi_param REMOTE_PORT {{NGINX_AUTHENTICATION_LLNG_HANDLER_PORT}};
7-
fastcgi_pass_request_body off;
8-
fastcgi_param CONTENT_LENGTH "";
9-
fastcgi_param HOST $http_host;
10-
fastcgi_param X_ORIGINAL_URI $original_uri;
11-
proxy_http_version 1.1;
12-
proxy_set_header Connection "";
13-
}
14-
### End LemonLDAP:NG authentication request
1+
### LemonLDAP:NG authentication request
2+
location = /lmauth {
3+
internal;
4+
include /etc/nginx/fastcgi_params;
5+
fastcgi_pass llng-upstream-pool;
6+
fastcgi_param REMOTE_PORT {{NGINX_AUTHENTICATION_LLNG_HANDLER_PORT}};
7+
fastcgi_pass_request_body off;
8+
fastcgi_param CONTENT_LENGTH "";
9+
fastcgi_param HOST $http_host;
10+
fastcgi_param X_ORIGINAL_URI $original_uri;
11+
proxy_http_version 1.1;
12+
proxy_set_header Connection "";
13+
}
14+
### End LemonLDAP:NG authentication request

‎install/etc/nginx/snippets/bot_blocker.conf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
server_names_hash_bucket_size 256;
2-
server_names_hash_max_size 4096;
3-
variables_hash_max_size 4096;
4-
variables_hash_bucket_size 4096;
5-
limit_req_zone $binary_remote_addr zone=flood:50m rate=90r/s;
6-
limit_conn_zone $binary_remote_addr zone=addr:50m;
7-
include /etc/nginx/snippets/blockbots/globalblacklist.conf;
1+
server_names_hash_bucket_size 256;
2+
server_names_hash_max_size 4096;
3+
variables_hash_max_size 4096;
4+
variables_hash_bucket_size 4096;
5+
limit_req_zone $binary_remote_addr zone=flood:50m rate=90r/s;
6+
limit_conn_zone $binary_remote_addr zone=addr:50m;
7+
include /etc/nginx/snippets/blockbots/globalblacklist.conf;

‎install/etc/nginx/snippets/compression_brotli.conf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
brotli on;
2-
brotli_window {{NGINX_COMPRESSION_BROTLI_WINDOW}};
3-
brotli_min_length {{NGINX_COMPRESSION_BROTLI_MIN_LENGTH}};
4-
brotli_comp_level {{NGINX_COMPRESSION_BROTLI_LEVEL}};
5-
brotli_types {{NGINX_COMPRESSION_BROTLI_TYPES}};
1+
brotli on;
2+
brotli_window {{NGINX_COMPRESSION_BROTLI_WINDOW}};
3+
brotli_min_length {{NGINX_COMPRESSION_BROTLI_MIN_LENGTH}};
4+
brotli_comp_level {{NGINX_COMPRESSION_BROTLI_LEVEL}};
5+
brotli_types {{NGINX_COMPRESSION_BROTLI_TYPES}};

‎install/etc/nginx/snippets/compression_gzip.conf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
gzip on;
2-
gzip_comp_level {{NGINX_COMPRESSION_GZIP_LEVEL}};
3-
gzip_http_version {{NGINX_COMPRESSION_GZIP_HTTP_VERSION}};
4-
gzip_buffers {{NGINX_COMPRESSION_GZIP_BUFFERS}};
5-
gzip_min_length {{NGINX_COMPRESSION_GZIP_MIN_LENGTH}};
6-
gzip_proxied {{NGINX_COMPRESSION_GZIP_PROXIED}};
7-
gzip_types {{NGINX_COMPRESSION_GZIP_TYPES}};
8-
gzip_disable {{NGINX_COMPRESSION_GZIP_DISABLE}};
9-
gzip_vary on;
1+
gzip on;
2+
gzip_comp_level {{NGINX_COMPRESSION_GZIP_LEVEL}};
3+
gzip_http_version {{NGINX_COMPRESSION_GZIP_HTTP_VERSION}};
4+
gzip_buffers {{NGINX_COMPRESSION_GZIP_BUFFERS}};
5+
gzip_min_length {{NGINX_COMPRESSION_GZIP_MIN_LENGTH}};
6+
gzip_proxied {{NGINX_COMPRESSION_GZIP_PROXIED}};
7+
gzip_types {{NGINX_COMPRESSION_GZIP_TYPES}};
8+
gzip_disable {{NGINX_COMPRESSION_GZIP_DISABLE}};
9+
gzip_vary on;

‎install/etc/nginx/snippets/ddos_protection.conf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:{{NGINX_DDOS_CONNECTIONS_PER_IP}};
2-
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:{{NGINX_DDOS_CONNECTIONS_PER_IP}} rate={{NGINX_DDOS_REQUESTS_PER_IP}};
1+
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:{{NGINX_DDOS_CONNECTIONS_PER_IP}};
2+
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:{{NGINX_DDOS_CONNECTIONS_PER_IP}} rate={{NGINX_DDOS_REQUESTS_PER_IP}};
33

4-
server {
5-
limit_conn conn_limit_per_ip 10;
6-
limit_req zone=req_limit_per_ip burst=10 nodelay;
7-
}
4+
server {
5+
limit_conn conn_limit_per_ip 10;
6+
limit_req zone=req_limit_per_ip burst=10 nodelay;
7+
}

‎install/etc/nginx/snippets/exploit_protection.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
location ~* \.\.\/ { access_log {{NGINX_LOG_BLOCKED_LOCATION}}/{{NGINX_LOG_BLOCKED_FILE}} {{NGINX_LOG_BLOCKED_FORMAT}}; deny all; }
1212
location ~* ~$ { access_log {{NGINX_LOG_BLOCKED_LOCATION}}/{{NGINX_LOG_BLOCKED_FILE}} {{NGINX_LOG_BLOCKED_FORMAT}}; deny all; }
1313
location ~* proc/self/environ { access_log {{NGINX_LOG_BLOCKED_LOCATION}}/{{NGINX_LOG_BLOCKED_FILE}} {{NGINX_LOG_BLOCKED_FORMAT}}; deny all; }
14-
location ~* /\.(htaccess|htpasswd|svn) { access_log {{NGINX_LOG_BLOCKED_LOCATION}}/{{NGINX_LOG_BLOCKED_FILE}} {{NGINX_LOG_BLOCKED_FORMAT}}; deny all; }
14+
location ~* /\.(ci|htaccess|htpasswd|git|svn) { access_log {{NGINX_LOG_BLOCKED_LOCATION}}/{{NGINX_LOG_BLOCKED_FILE}} {{NGINX_LOG_BLOCKED_FORMAT}}; deny all; }
1515

1616
## Block file injections
1717
location ~* [a-zA-Z0-9_]=(\.\.//?)+ { access_log {{NGINX_LOG_BLOCKED_LOCATION}}/{{NGINX_LOG_BLOCKED_FILE}} {{NGINX_LOG_BLOCKED_FORMAT}}; deny all; }

‎install/etc/nginx/snippets/monitoring.conf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
server {
2-
listen 73;
3-
server_name 127.0.0.1;
1+
server {
2+
listen 73;
3+
server_name 127.0.0.1;
44

5-
location /stub_status {
6-
stub_status on;
7-
access_log off;
8-
allow 127.0.0.1;
9-
deny all;
10-
}
11-
}
5+
location /stub_status {
6+
stub_status on;
7+
access_log off;
8+
allow 127.0.0.1;
9+
deny all;
10+
}
11+
}

0 commit comments

Comments
 (0)