initial commit

Author: Alex Ianchici

Dockerfile

@@ -0,0 +1,28 @@
+FROM ubuntu:trusty
+ENV DEBIAN_FRONTEND noninteractive
+
+# nginx
+RUN apt-get update -q
+RUN apt-get install -yf build-essential python-software-properties software-properties-common
+RUN add-apt-repository ppa:nginx/stable
+RUN apt-get update -q
+RUN apt-get -y install -y curl
+
+# build nginx from source with http auth module enabled
+RUN apt-get -y install libpcre3-dev zlib1g-dev libssl-dev
+RUN curl -O http://nginx.org/download/nginx-1.6.1.tar.gz
+RUN tar -xzf nginx-1.6.1.tar.gz
+WORKDIR nginx-1.6.1
+RUN ./configure --with-http_ssl_module --with-http_auth_request_module && make && make install
+
+# install pystache
+RUN apt-get -y install python-pip
+RUN pip install pystache
+
+# nginx configuration
+ADD nginx/nginx.conf /usr/local/nginx/conf/nginx.conf
+ADD nginx/nginx.default /usr/local/nginx/conf/sites-enabled/default.template
+ADD start.sh /start.sh
+
+EXPOSE 80
+CMD /start.sh

README.md

@@ -0,0 +1,10 @@
+Nginx authentication proxy
+==========================
+
+Simple proxy used to send the request using the proxy_pass directive to an authentication backend specified using the AUTH_BACKEND environment variable. Traffic that passes the authentication backend will then be sent to the backend specified using the BACKEND environment variable.
+
+Running the docker container:
+```
+ubuntu@trusty-64:/nginx-auth# docker build -t nginx-auth
+ubuntu@trusty-64:/nginx-auth# docker run -e AUTH_BACKEND=https://someauthapi -e BACKEND=http://youprivateregistry -p 0.0.0.0:8080:80 nginx-auth
+```

nginx/nginx.conf

@@ -0,0 +1,74 @@
+user www-data;
+worker_rlimit_nofile 32768;
+pid /var/run/nginx.pid;
+
+events {
+  worker_connections 8192;
+}
+
+http {
+
+  ##
+  # Basic Settings
+  ##
+
+  sendfile on;
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+  types_hash_max_size 2048;
+  # server_tokens off;
+
+  # server_names_hash_bucket_size 64;
+  # server_name_in_redirect off;
+
+  include /usr/local/nginx/conf/mime.types;
+  default_type application/octet-stream;
+
+  ##
+  # Logging Settings
+  ##
+
+  access_log /dev/stdout;
+  error_log /dev/stdout;
+
+  ##
+  # Gzip Settings
+  ##
+
+  gzip on;
+  gzip_disable "msie6";
+
+  # gzip_vary on;
+  # gzip_proxied any;
+  # gzip_comp_level 6;
+  # gzip_buffers 16 8k;
+  # gzip_http_version 1.1;
+  # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+
+  ##
+  # nginx-naxsi config
+  ##
+  # Uncomment it if you installed nginx-naxsi
+  ##
+
+  #include /etc/nginx/naxsi_core.rules;
+
+  ##
+  # nginx-passenger config
+  ##
+  # Uncomment it if you installed nginx-passenger
+  ##
+  
+  #passenger_root /usr;
+  #passenger_ruby /usr/bin/ruby;
+
+  ##
+  # Virtual Host Configs
+  ##
+
+  include /usr/local/nginx/conf/conf.d/*.conf;
+  include /usr/local/nginx/conf/sites-enabled/default;
+}
+
+daemon off;

nginx/nginx.default

@@ -0,0 +1,39 @@
+server {
+  listen 80;
+  server_name _;
+
+  client_max_body_size 0; # disable any limits to avoid HTTP 413 for large image uploads
+
+  # required to avoid HTTP 411: see Issue #1486 (https://github.com/dotcloud/docker/issues/1486)
+  chunked_transfer_encoding on;
+
+  proxy_set_header Host      $http_host;   # required for docker client's sake
+  proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
+
+  root  /usr/local/nginx/html;
+  index  index.html index.htm;
+
+
+  location = /auth {
+    proxy_pass {{auth_backend}};
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    proxy_set_header X-Original-URI $request_uri;
+    proxy_set_header X-Docker-Token "";
+  }
+
+  location / {
+    proxy_pass {{backend}};
+    auth_request /auth;
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
+    proxy_buffering off;
+  }
+  location /v1/_ping {
+    auth_basic off;
+    proxy_pass {{backend}};
+  }
+  location /_ping {
+    auth_basic off;
+    proxy_pass {{backend}};
+  }
+}

start.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+NGINX=/usr/local/nginx
+
+pystache "`cat ${NGINX}/conf/sites-enabled/default.template`" "{\"auth_backend\":\"${AUTH_BACKEND}\", \"backend\":\"${BACKEND}\"}" > ${NGINX}/conf/sites-enabled/default
+
+${NGINX}/sbin/nginx