diff --git a/docker-compose.yml b/docker-compose.yml index a5c60631..124b7c6b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -45,6 +45,7 @@ services: env_file: - .env volumes: + - ./docker/nginx/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf:ro - ./docker/nginx/conf.d:/etc/nginx/conf.d:ro - ./docker/data/nginx/cache:/data/nginx/cache - ./docker/data/nginx/logs:/usr/local/openresty/nginx/logs diff --git a/docker/nginx/conf.d/client.conf b/docker/nginx/conf.d/client.conf index 52f4ed36..9cead372 100644 --- a/docker/nginx/conf.d/client.conf +++ b/docker/nginx/conf.d/client.conf @@ -130,6 +130,7 @@ server { location /skynet/skyfile { include /etc/nginx/conf.d/include/cors; + include /etc/nginx/conf.d/include/sia-auth; limit_conn uploads_by_ip 10; # ddos protection: max 10 uploads at a time client_max_body_size 1000M; # make sure to limit the size of upload to a sane value @@ -153,21 +154,11 @@ server { # proxy this call to siad endpoint (make sure the ip is correct) proxy_pass http://siad-upload/skynet/skyfile/$dir1/$dir2/$dir3/$dir4$is_args$args; - - rewrite_by_lua_block { - local b64 = require("ngx.base64") - -- put your apipassword here - local apipassword = "" - -- encode the user:password authorization string - -- (in our case user is empty so it is just :password) - local content = b64.encode_base64url(":" .. apipassword) - -- set authorization header with proper base64 encoded string - ngx.req.set_header("Authorization", "Basic " .. content) - } } location ~ "/skynet/skyfile/(.+)" { include /etc/nginx/conf.d/include/cors; + include /etc/nginx/conf.d/include/sia-auth; limit_conn uploads_by_ip 10; # ddos protection: max 10 uploads at a time client_max_body_size 1000M; # make sure to limit the size of upload to a sane value @@ -182,17 +173,6 @@ server { # proxy this call to siad endpoint (make sure the ip is correct) proxy_pass http://siad-upload/skynet/skyfile/$siapath$is_args$args; - - rewrite_by_lua_block { - local b64 = require("ngx.base64") - -- put your apipassword here - local apipassword = "" - -- encode the user:password authorization string - -- (in our case user is empty so it is just :password) - local content = b64.encode_base64url(":" .. apipassword) - -- set authorization header with proper base64 encoded string - ngx.req.set_header("Authorization", "Basic " .. content) - } } location ~ "^/([a-zA-Z0-9-_]{46}(/.*)?)$" { diff --git a/docker/nginx/conf.d/include/cors b/docker/nginx/conf.d/include/cors index 1ebe6617..1490624b 100644 --- a/docker/nginx/conf.d/include/cors +++ b/docker/nginx/conf.d/include/cors @@ -1,14 +1,8 @@ if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; - # - # Custom headers and headers various browsers *should* be OK with but aren't - # add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'; - # - # Tell client that this pre-flight info is valid for 20 days - # - add_header 'Access-Control-Max-Age' 1728000; + add_header 'Access-Control-Max-Age' 1728000; # valid for 20 days add_header 'Content-Type' 'text/plain; charset=utf-8'; add_header 'Content-Length' 0; return 204; diff --git a/docker/nginx/conf.d/include/sia-auth b/docker/nginx/conf.d/include/sia-auth new file mode 100644 index 00000000..8983bb1f --- /dev/null +++ b/docker/nginx/conf.d/include/sia-auth @@ -0,0 +1,10 @@ +rewrite_by_lua_block { + -- local b64 = require("ngx.base64") + -- pull apipassword from SIA_API_AUTHORIZATION environment variable + -- local apipassword = os.getenv("SIA_API_AUTHORIZATION") + -- encode the user:password authorization string + -- (in our case user is empty so it is just :password) + -- local content = b64.encode_base64url(":" .. apipassword) + -- set authorization header with proper base64 encoded string + ngx.req.set_header("Authorization", "Basic " .. os.getenv("SIA_API_AUTHORIZATION")) +} diff --git a/docker/nginx/nginx.conf b/docker/nginx/nginx.conf new file mode 100644 index 00000000..1fb6a5f0 --- /dev/null +++ b/docker/nginx/nginx.conf @@ -0,0 +1,64 @@ +# nginx.conf -- docker-openresty +# +# This file is installed to: +# `/usr/local/openresty/nginx/conf/nginx.conf` +# and is the file loaded by nginx at startup, +# unless the user specifies otherwise. +# +# It tracks the upstream OpenResty's `nginx.conf`, but removes the `server` +# section and adds this directive: +# `include /etc/nginx/conf.d/*.conf;` +# +# The `docker-openresty` file `nginx.vh.default.conf` is copied to +# `/etc/nginx/conf.d/default.conf`. It contains the `server section +# of the upstream `nginx.conf`. +# +# See https://github.com/openresty/docker-openresty/blob/master/README.md#nginx-config-files +# + +# expose environment variables +env SIA_API_AUTHORIZATION; + +#user nobody; +worker_processes 1; + +#error_log logs/error.log; +#error_log logs/error.log notice; +#error_log logs/error.log info; + +#pid logs/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + include mime.types; + default_type application/octet-stream; + + #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + # '$status $body_bytes_sent "$http_referer" ' + # '"$http_user_agent" "$http_x_forwarded_for"'; + + #access_log logs/access.log main; + + # See Move default writable paths to a dedicated directory (#119) + # https://github.com/openresty/docker-openresty/issues/119 + client_body_temp_path /var/run/openresty/nginx-client-body; + proxy_temp_path /var/run/openresty/nginx-proxy; + fastcgi_temp_path /var/run/openresty/nginx-fastcgi; + uwsgi_temp_path /var/run/openresty/nginx-uwsgi; + scgi_temp_path /var/run/openresty/nginx-scgi; + + sendfile on; + #tcp_nopush on; + + #keepalive_timeout 0; + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; +}