[add] initial commit
This commit is contained in:
141
proxy/files/entrypoint.sh
Normal file
141
proxy/files/entrypoint.sh
Normal file
@@ -0,0 +1,141 @@
|
||||
#!/bin/sh
|
||||
|
||||
# configuration
|
||||
web_root_path="/service/html"
|
||||
cert_root_path="/service/ssl"
|
||||
temp_path="/service/temp"
|
||||
nginx_pid="/tmp/nginx.pid"
|
||||
server_retries=10
|
||||
log_file="" # leave empty for stdout
|
||||
|
||||
# variables
|
||||
domain_file="$temp_path/domains.txt"
|
||||
certs_updated="$cert_root_path/.updated"
|
||||
|
||||
#functions
|
||||
function log()
|
||||
{
|
||||
local time=$(date +%F_%T)
|
||||
local prefix="LOG"
|
||||
case $1 in
|
||||
ERR | ERROR)
|
||||
prefix="ERR"
|
||||
shift
|
||||
;;
|
||||
WAR | WARNING)
|
||||
prefix="WAR"
|
||||
shift
|
||||
;;
|
||||
esac
|
||||
local func=$1; shift
|
||||
# remove any \n
|
||||
#local text=$(echo "$@"| tr '\n' '#' | sed 's|#|\\n |g')
|
||||
case "$log_file" in
|
||||
"")
|
||||
echo "[$time]:[$prefix]:[$0][$func]: $@" 2>&1
|
||||
;;
|
||||
*)
|
||||
echo "[$time]:[$prefix]:[$0][$func]: $@" >> log_path
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
function var_to_file()
|
||||
{
|
||||
local var=$1
|
||||
local file=$2
|
||||
log var_to_file "ENV VAR -> [$file]: $var"
|
||||
echo -e "$var" > $file
|
||||
}
|
||||
|
||||
function env_domain_file()
|
||||
{
|
||||
log env_domain_file "ENV DOMAINS: $DOMAINS"
|
||||
echo -e "$DOMAINS" > $1
|
||||
}
|
||||
|
||||
function read_file()
|
||||
{
|
||||
local func=$1
|
||||
local file=$2
|
||||
local result=0
|
||||
|
||||
while read -r line || [[ -n "$line" ]]; do
|
||||
# skip empty lines if READ_EMPTY_LINES is not set
|
||||
[ -z ${READ_EMPTY_LINES+x} ] && [ "${#line}" -lt 1 ] && continue
|
||||
log read_file "LINE: $line"
|
||||
log read_file "FUNC START [$func]"
|
||||
if $func $line; then
|
||||
log read_file "FUNC END [$func]"
|
||||
else
|
||||
result=1
|
||||
log ERROR read_file "FUNC END [$func]"
|
||||
fi
|
||||
done < "$file"
|
||||
|
||||
return $result
|
||||
}
|
||||
|
||||
function cert_exists()
|
||||
{
|
||||
local domain=$1
|
||||
local cert_path="$cert_root_path/$domain"
|
||||
[ -f "$cert_path/fullchain.pem" ]
|
||||
}
|
||||
|
||||
function certs_daemon()
|
||||
{
|
||||
(
|
||||
# wait for nginx to start
|
||||
while [ ! -f "$nginx_pid" ]; do
|
||||
log certs_daemon "Waiting for nginx to start"
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# wait for inital cert update
|
||||
while [ ! -f "$certs_updated" ]; do
|
||||
log certs_daemon "Waiting for initial cert update"
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# reload nginx
|
||||
nginx -s reload
|
||||
|
||||
# cert watcher loop
|
||||
while inotifywait -e attrib "$certs_updated"; do
|
||||
log certs_daemon "Certs updated, reloading nginx"
|
||||
nginx -s reload
|
||||
done
|
||||
) &
|
||||
}
|
||||
|
||||
function nginx_handler()
|
||||
{
|
||||
local retries=0
|
||||
|
||||
# start the daemon (it forks itself)
|
||||
certs_daemon
|
||||
|
||||
# wait for certs to exist before starting nginx
|
||||
# just have nginx crash after n retries (default 10)
|
||||
while ! read_file cert_exists "$domain_file" && [ "$retries" -lt "$server_retries" ]; do
|
||||
log nginx_handler "Waiting for certs to be created"
|
||||
retries=$(( retries+1 ))
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# starting nginx in foreground
|
||||
log nginx_handler "Starting nginx in foreground"
|
||||
nginx -g "daemon off;"
|
||||
|
||||
}
|
||||
|
||||
function main()
|
||||
{
|
||||
log main "Starting nginx container"
|
||||
# TODO: load domains from nginx.conf
|
||||
env_domain_file "$domain_file"
|
||||
nginx_handler
|
||||
}
|
||||
|
||||
main $@
|
||||
6
proxy/files/index.html
Normal file
6
proxy/files/index.html
Normal file
@@ -0,0 +1,6 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>check</title>
|
||||
</head>
|
||||
<body>online</body>
|
||||
</html>
|
||||
68
proxy/files/nginx.conf
Normal file
68
proxy/files/nginx.conf
Normal file
@@ -0,0 +1,68 @@
|
||||
worker_processes 1;
|
||||
|
||||
events { worker_connections 1024; }
|
||||
|
||||
# required for non root
|
||||
pid /tmp/nginx.pid;
|
||||
|
||||
http {
|
||||
|
||||
# required for non root
|
||||
client_body_temp_path /tmp/client_temp;
|
||||
proxy_temp_path /tmp/proxy_temp_path;
|
||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
||||
scgi_temp_path /tmp/scgi_temp;
|
||||
|
||||
client_max_body_size 1m;
|
||||
|
||||
server {
|
||||
listen 8080 default_server;
|
||||
|
||||
# prevent redirecting to 8080 port
|
||||
# (e.g. when trailing slash is missed)
|
||||
port_in_redirect off;
|
||||
|
||||
# letsencrypt
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /service/html/certbot;
|
||||
}
|
||||
|
||||
location /check {
|
||||
# set alias (instead of root) to not append /check to path
|
||||
alias /service/html/check;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 302 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 8443 ssl;
|
||||
|
||||
# prevent redirecting to 8080 port
|
||||
# (e.g. when trailing slash is missed)
|
||||
port_in_redirect off;
|
||||
|
||||
server_name example.com www.example.com localhost;
|
||||
|
||||
ssl_certificate /service/ssl/example.com/fullchain.pem;
|
||||
ssl_certificate_key /service/ssl/example.com/privkey.pem;
|
||||
|
||||
location / {
|
||||
# allow for upstream to be offline by setting
|
||||
# docker dns resolver and a variable for the server
|
||||
resolver 127.0.0.11 valid=30s;
|
||||
set $kweb kweb;
|
||||
proxy_pass http://$kweb:8080;
|
||||
|
||||
proxy_redirect off;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $server_name;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user