auth uploads

docker-compose.yml

@@ -45,6 +45,7 @@ services:
     env_file:
       - .env
     volumes:
+      - ./docker/nginx/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf:ro
       - ./docker/nginx/conf.d:/etc/nginx/conf.d:ro
       - ./docker/data/nginx/cache:/data/nginx/cache
       - ./docker/data/nginx/logs:/usr/local/openresty/nginx/logs

docker/nginx/conf.d/client.conf

@@ -130,6 +130,7 @@ server {
 
 	location /skynet/skyfile {
 		include /etc/nginx/conf.d/include/cors;
+		include /etc/nginx/conf.d/include/sia-auth;
 
 		limit_conn uploads_by_ip 10; # ddos protection: max 10 uploads at a time
 		client_max_body_size 1000M; # make sure to limit the size of upload to a sane value
@@ -153,21 +154,11 @@ server {
 
 		# proxy this call to siad endpoint (make sure the ip is correct)
 		proxy_pass http://siad-upload/skynet/skyfile/$dir1/$dir2/$dir3/$dir4$is_args$args;
-
-		rewrite_by_lua_block {
-			local b64 = require("ngx.base64")
-			-- put your apipassword here
-			local apipassword = ""
-			-- encode the user:password authorization string
-			-- (in our case user is empty so it is just :password)
-			local content = b64.encode_base64url(":" .. apipassword)
-			-- set authorization header with proper base64 encoded string
-			ngx.req.set_header("Authorization", "Basic " .. content)
-		}
 	}
 	
 	location ~ "/skynet/skyfile/(.+)" {
 		include /etc/nginx/conf.d/include/cors;
+		include /etc/nginx/conf.d/include/sia-auth;
 
 		limit_conn uploads_by_ip 10; # ddos protection: max 10 uploads at a time
 		client_max_body_size 1000M; # make sure to limit the size of upload to a sane value
@@ -182,17 +173,6 @@ server {
 
 		# proxy this call to siad endpoint (make sure the ip is correct)
 		proxy_pass http://siad-upload/skynet/skyfile/$siapath$is_args$args;
-
-		rewrite_by_lua_block {
-			local b64 = require("ngx.base64")
-			-- put your apipassword here
-			local apipassword = ""
-			-- encode the user:password authorization string
-			-- (in our case user is empty so it is just :password)
-			local content = b64.encode_base64url(":" .. apipassword)
-			-- set authorization header with proper base64 encoded string
-			ngx.req.set_header("Authorization", "Basic " .. content)
-		}
 	}
 
 	location ~ "^/([a-zA-Z0-9-_]{46}(/.*)?)$" {

docker/nginx/conf.d/include/cors

@@ -1,14 +1,8 @@
 if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' '*';
     add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
-    #
-    # Custom headers and headers various browsers *should* be OK with but aren't
-    #
     add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
-    #
-    # Tell client that this pre-flight info is valid for 20 days
-    #
-    add_header 'Access-Control-Max-Age' 1728000;
+    add_header 'Access-Control-Max-Age' 1728000; # valid for 20 days
     add_header 'Content-Type' 'text/plain; charset=utf-8';
     add_header 'Content-Length' 0;
     return 204;

docker/nginx/conf.d/include/sia-auth

@@ -0,0 +1,10 @@
+rewrite_by_lua_block {
+    -- local b64 = require("ngx.base64")
+    -- pull apipassword from SIA_API_AUTHORIZATION environment variable
+    -- local apipassword = os.getenv("SIA_API_AUTHORIZATION")
+    -- encode the user:password authorization string
+    -- (in our case user is empty so it is just :password)
+    -- local content = b64.encode_base64url(":" .. apipassword)
+    -- set authorization header with proper base64 encoded string
+    ngx.req.set_header("Authorization", "Basic " .. os.getenv("SIA_API_AUTHORIZATION"))
+}

docker/nginx/nginx.conf

@@ -0,0 +1,64 @@
+# nginx.conf  --  docker-openresty
+#
+# This file is installed to:
+#   `/usr/local/openresty/nginx/conf/nginx.conf`
+# and is the file loaded by nginx at startup,
+# unless the user specifies otherwise.
+#
+# It tracks the upstream OpenResty's `nginx.conf`, but removes the `server`
+# section and adds this directive:
+#     `include /etc/nginx/conf.d/*.conf;`
+#
+# The `docker-openresty` file `nginx.vh.default.conf` is copied to
+# `/etc/nginx/conf.d/default.conf`.  It contains the `server section
+# of the upstream `nginx.conf`.
+#
+# See https://github.com/openresty/docker-openresty/blob/master/README.md#nginx-config-files
+#
+
+# expose environment variables
+env SIA_API_AUTHORIZATION;
+
+#user  nobody;
+worker_processes  1;
+
+#error_log  logs/error.log;
+#error_log  logs/error.log  notice;
+#error_log  logs/error.log  info;
+
+#pid        logs/nginx.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+    #                  '$status $body_bytes_sent "$http_referer" '
+    #                  '"$http_user_agent" "$http_x_forwarded_for"';
+
+    #access_log  logs/access.log  main;
+
+    # See Move default writable paths to a dedicated directory (#119)
+    # https://github.com/openresty/docker-openresty/issues/119
+    client_body_temp_path /var/run/openresty/nginx-client-body;
+    proxy_temp_path       /var/run/openresty/nginx-proxy;
+    fastcgi_temp_path     /var/run/openresty/nginx-fastcgi;
+    uwsgi_temp_path       /var/run/openresty/nginx-uwsgi;
+    scgi_temp_path        /var/run/openresty/nginx-scgi;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/conf.d/*.conf;
+}