pascal/server_proxy
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[mod] proxy nginx config is now generated based on domains.env

Browse Source 
- domains and servers in domains.env are mapped 1:1
 - moved domains.env to ./files/domains.env
 - renamed kweb to web for a more generic approach
This commit is contained in:
Pascal
2020-05-27 15:58:21 -04:00
parent 3d778ff698
commit f3d17e931a
8 changed files with 130 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
certbot/files/domains.env
View File

@@ -1,2 +0,0 @@
DOMAINS=example.com www api test\n example.dev www api test
SERVER=kweb\n test

38
docker-compose.yml
View File

@@ -9,7 +9,10 @@ services:
USER_UID: ${UID_PROXY:-12001}
GROUP_UID: ${UID_PROXY:-12001}
env_file:
- ./certbot/files/domains.env
# contains DOMAINS and SERVER variable
# DOMAINS: rootA.com www api\nrootB.com www mail
# SERVER: webA webB
- ./files/domains.env
restart: always
image: proxy
container_name: proxy
@@ -17,7 +20,7 @@ services:
- "80:8080"
- "443:8443"
networks:
- service_kweb
- service_web
- service_certbot
volumes:
# cert volume
@@ -34,7 +37,12 @@ services:
USER_UID: ${UID_CERTBOT:-12002}
GROUP_UID: ${UID_PROXY:-12002}
env_file:
- ./certbot/files/domains.env
# contains DOMAINS and SERVER variable
# DOMAINS: rootA.com www api\nrootB.com www mail
# SERVER (not used by certbot): webA webB
- ./files/domains.env
# cerbot container will be set to testing
# unless PRODUCTION var is set (any value) in the environment
- ./production.env # set PRODUCTION= here
restart: always
image: certbot
@@ -53,19 +61,19 @@ services:
# TODO: put this in its own docker-compose
# as the proxy does not require it
kweb:
web:
build:
context: ./kweb
context: ./web
args:
USER_UID: ${UID_KWEB:-12003}
GROUP_UID: ${UID_KWEB:-12003}
USER_UID: ${UID_WEB:-12003}
GROUP_UID: ${UID_WEB:-12003}
restart: always
image: kweb
container_name: kweb
image: web
container_name: web
networks:
- service_kweb
- service_web
volumes:
- service_kweb:/service/html:ro
- service_web:/service/html:ro
volumes:
# proxy volumes
@@ -83,11 +91,11 @@ volumes:
certbot_logs:
name: certbot_logs
# service volumes
service_kweb:
name: service_kweb
service_web:
name: service_web
networks:
service_kweb:
name: service_kweb
service_web:
name: service_web
service_certbot:
name: service_certbot

4
files/domains.env Normal file
View File

@@ -0,0 +1,4 @@
# domains are seperated with \n
DOMAINS=example.com www api test
# server values are seperated with ' ' (space) (one server per domain)
SERVER=web

105
proxy/files/entrypoint.sh
View File

@@ -9,9 +9,11 @@ server_retries=10
log_file="" # leave empty for stdout
# variables
config_file="$temp_path/nginx.conf"
domain_file="$temp_path/domains.txt"
certs_updated="$cert_root_path/.updated"
certs_daemon_pid=-1
server_configs=""
#functions
function log()
@@ -41,6 +43,24 @@ function log()
esac
}
# this is a helper function as dash does not support arrays
function get_element()
{
element="$1"
seperator="$2"; shift; shift
array=$@
old_IFS=$IFS
IFS="$seperator"
set -- $array
while [ "$element" -gt 0 ]; do
shift
element=$(( element - 1 ))
done
result=$1
IFS=$old_IFS
echo $result
}
function sleep_wait()
{
# waiting on sleep to be able to handle SIGTERM
@@ -85,13 +105,15 @@ function read_file()
local func=$1
local file=$2
local result=0
local count=0
while read -r line || [[ -n "$line" ]]; do
count=$(( count+1 ))
# skip empty lines if READ_EMPTY_LINES is not set
[ -z ${READ_EMPTY_LINES+x} ] && [ "${#line}" -lt 1 ] && continue
log read_file "LINE: $line"
log read_file "LINE[$count]: $line"
log read_file "FUNC START [$func]"
if $func $line; then
if $func $count $line; then
log read_file "FUNC END [$func]"
else
result=1
@@ -102,9 +124,77 @@ function read_file()
return $result
}
function rng()
{
rng_n=$(od -An -N2 -i < /dev/urandom)
echo $rng_n
}
function gen_server_config()
{
local server=$1; shift
local root_domain=$1; shift
local domain_list="$@"
local domain_count=0
local domains="$root_domain"
# no arrays in dash
local subdomain=$(get_element $domain_count " " $domain_list)
while [ ${#subdomain} -gt 0 ]; do
domains="$domains ${subdomain}.$root_domain"
domain_count=$(( domain_count + 1 ))
subdomain=$(get_element $domain_count " " $domain_list)
done
local rng_number=$(rng)
local server_var="
server {
listen 8443 ssl;
# prevent redirecting to 8080 port
# (e.g. when trailing slash is missed)
port_in_redirect off;
server_name $domains;
ssl_certificate /service/ssl/$root_domain/fullchain.pem;
ssl_certificate_key /service/ssl/$root_domain/privkey.pem;
location / {
# allow for upstream to be offline by setting
# docker dns resolver and a variable for the server
resolver 127.0.0.11 valid=30s;
set \$web_$rng_number $server;
proxy_pass http://\$web_$rng_number:8080;
proxy_redirect off;
proxy_set_header Host \$host;
proxy_set_header X-Real-IP \$remote_addr;
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host \$server_name;
}
}
"
echo "$server_var"
}
function server_config()
{
local server_number=$1; shift
local server_name=$(get_element $(( server_number-1 )) " " $SERVER)
local server_domain=$@
if [ ${#server_name} -eq 0 ]; then
log server_config "no name for server name for domains [$server_domain]"
return 1
fi
log server_config "creating config for [$server_name] with domains [$server_domain]"
server_configs="$server_configs$(gen_server_config $server_name $server_domain)"
}
function cert_exists()
{
local domain=$1
local domain=$2
local cert_path="$cert_root_path/$domain"
[ -f "$cert_path/fullchain.pem" ]
}
@@ -143,6 +233,13 @@ function nginx_handler()
# start the daemon (it forks itself)
certs_daemon
# generate server config
read_file server_config "$domain_file"
tmp_file="$temp_path/tmp.conf"
echo -e "$server_configs" > $tmp_file
awk 'NR==FNR { a[n++]=$0; next } /#<SERVER>/ { for (i=0;i<n;++i) print a[i]; next }1' \
$tmp_file /etc/nginx/nginx.conf > "$config_file"
# wait for certs to exist before starting nginx
# just have nginx crash after n retries (default 10)
while ! read_file cert_exists "$domain_file" && [ "$retries" -lt "$server_retries" ]; do
@@ -153,7 +250,7 @@ function nginx_handler()
# starting nginx in foreground
log nginx_handler "Starting nginx in foreground"
exec nginx -g "daemon off;"
exec nginx -c "$config_file" -g "daemon off;"
}
function main()

27
proxy/files/nginx.conf
View File

@@ -38,31 +38,8 @@ http {
}
}
server {
listen 8443 ssl;
# the following variable is automatically populated via entrypoint.sh
#<SERVER>
# prevent redirecting to 8080 port
# (e.g. when trailing slash is missed)
port_in_redirect off;
server_name example.com www.example.com localhost;
ssl_certificate /service/ssl/example.com/fullchain.pem;
ssl_certificate_key /service/ssl/example.com/privkey.pem;
location / {
# allow for upstream to be offline by setting
# docker dns resolver and a variable for the server
resolver 127.0.0.11 valid=30s;
set $kweb kweb;
proxy_pass http://$kweb:8080;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
}
}

0
kweb/Dockerfile → web/Dockerfile
View File

0
kweb/files/index.html → web/files/index.html
View File

0
kweb/files/nginx.conf → web/files/nginx.conf
View File