Update from upstream
This commit is contained in:
Thiago Trennepohl
commit
a85e50c8d9
6 changed files with 65 additions and 8 deletions
|
|
@ -4,7 +4,7 @@ services:
|
|||
|
||||
env:
|
||||
global:
|
||||
- DOCKER_VERSION=1.10.1-0~trusty
|
||||
- DOCKER_VERSION=1.12.1-0~trusty
|
||||
|
||||
before_install:
|
||||
# list docker-engine versions
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
FROM nginx:1.9.15
|
||||
FROM nginx:1.11.3
|
||||
MAINTAINER Jason Wilder mail@jasonwilder.com
|
||||
|
||||
# Install wget and install/updates certificates
|
||||
|
|
|
|||
2
Makefile
2
Makefile
|
|
@ -3,7 +3,7 @@
|
|||
|
||||
update-dependencies:
|
||||
docker pull jwilder/docker-gen:0.7.3
|
||||
docker pull nginx:1.9.12
|
||||
docker pull nginx:1.11.3
|
||||
docker pull python:3
|
||||
docker pull rancher/socat-docker:latest
|
||||
docker pull appropriate/curl:latest
|
||||
|
|
|
|||
23
README.md
23
README.md
|
|
@ -1,4 +1,4 @@
|
|||
  [](https://travis-ci.org/jwilder/nginx-proxy) [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub')
|
||||
  [](https://travis-ci.org/jwilder/nginx-proxy) [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub') [](https://hub.docker.com/r/jwilder/nginx-proxy 'DockerHub')
|
||||
|
||||
|
||||
nginx-proxy sets up a container running nginx and [docker-gen][1]. docker-gen generates reverse proxy configs for nginx and reloads nginx when containers are started and stopped.
|
||||
|
|
@ -42,7 +42,7 @@ services:
|
|||
```shell
|
||||
$ docker-compose up
|
||||
$ curl -H "Host: whoami.local" localhost
|
||||
I''m 5b129ab83266
|
||||
I'm 5b129ab83266
|
||||
```
|
||||
|
||||
### Multiple Ports
|
||||
|
|
@ -78,6 +78,12 @@ In this example, the `my-nginx-proxy` container will be connected to `my-network
|
|||
|
||||
If you would like to connect to your backend using HTTPS instead of HTTP, set `VIRTUAL_PROTO=https` on the backend container.
|
||||
|
||||
### uWSGI Backends
|
||||
|
||||
If you would like to connect to uWSGI backend, set `VIRTUAL_PROTO=uwsgi` on the
|
||||
backend container. Your backend container should than listen on a port rather
|
||||
than a socket and expose that port.
|
||||
|
||||
### Default Host
|
||||
|
||||
To set the default host for nginx use the env var `DEFAULT_HOST=foo.bar.com` for example
|
||||
|
|
@ -92,6 +98,14 @@ image and the official [nginx](https://registry.hub.docker.com/_/nginx/) image.
|
|||
|
||||
You may want to do this to prevent having the docker socket bound to a publicly exposed container service.
|
||||
|
||||
You can demo this pattern with docker-compose:
|
||||
|
||||
```console
|
||||
$ docker-compose --file docker-compose-separate-containers.yml up
|
||||
$ curl -H "Host: whoami.local" localhost
|
||||
I'm 5b129ab83266
|
||||
```
|
||||
|
||||
To run nginx proxy as a separate container you'll need to have [nginx.tmpl](https://github.com/jwilder/nginx-proxy/blob/master/nginx.tmpl) on your host system.
|
||||
|
||||
First start nginx with a volume:
|
||||
|
|
@ -205,10 +219,15 @@ proxy_set_header Connection $proxy_connection;
|
|||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
|
||||
|
||||
# Mitigate httpoxy attack (see README for details)
|
||||
proxy_set_header Proxy "";
|
||||
```
|
||||
|
||||
***NOTE***: If you provide this file it will replace the defaults; you may want to check the .tmpl file to make sure you have all of the needed options.
|
||||
|
||||
***NOTE***: The default configuration blocks the `Proxy` HTTP request header from being sent to downstream servers. This prevents attackers from using the so-called [httpoxy attack](http://httpoxy.org). There is no legitimate reason for a client to send this header, and there are many vulnerable languages / platforms (`CVE-2016-5385`, `CVE-2016-5386`, `CVE-2016-5387`, `CVE-2016-5388`, `CVE-2016-1000109`, `CVE-2016-1000110`, `CERT-VU#797896`).
|
||||
|
||||
#### Proxy-wide
|
||||
|
||||
To add settings on a proxy-wide basis, add your configuration file under `/etc/nginx/conf.d` using a name ending in `.conf`.
|
||||
|
|
|
|||
23
docker-compose-separate-containers.yml
Normal file
23
docker-compose-separate-containers.yml
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
version: '2'
|
||||
services:
|
||||
nginx:
|
||||
image: nginx
|
||||
container_name: nginx
|
||||
ports:
|
||||
- "80:80"
|
||||
volumes:
|
||||
- /etc/nginx/conf.d
|
||||
|
||||
dockergen:
|
||||
image: jwilder/docker-gen
|
||||
command: -notify-sighup nginx -watch /etc/docker-gen/templates/nginx.tmpl /etc/nginx/conf.d/default.conf
|
||||
volumes_from:
|
||||
- nginx
|
||||
volumes:
|
||||
- /var/run/docker.sock:/tmp/docker.sock:ro
|
||||
- ./nginx.tmpl:/etc/docker-gen/templates/nginx.tmpl
|
||||
|
||||
whoami:
|
||||
image: jwilder/whoami
|
||||
environment:
|
||||
- VIRTUAL_HOST=whoami.local
|
||||
21
nginx.tmpl
21
nginx.tmpl
|
|
@ -51,6 +51,9 @@ proxy_set_header X-Real-IP $remote_addr;
|
|||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
|
||||
client_max_body_size 30M;
|
||||
# Mitigate httpoxy attack (see README for details)
|
||||
proxy_set_header Proxy "";
|
||||
|
||||
{{ end }}
|
||||
|
||||
server {
|
||||
|
|
@ -81,6 +84,7 @@ server {
|
|||
root /usr/share/nginx/html;
|
||||
}
|
||||
|
||||
ssl_session_tickets off;
|
||||
ssl_certificate /etc/nginx/certs/default.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/default.key;
|
||||
}
|
||||
|
|
@ -173,8 +177,8 @@ server {
|
|||
{{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $host))}}
|
||||
|
||||
{{/* vhostCert is actually a filename so remove any suffixes since they are added later */}}
|
||||
{{ $vhostCert := replace $vhostCert ".crt" "" -1 }}
|
||||
{{ $vhostCert := replace $vhostCert ".key" "" -1 }}
|
||||
{{ $vhostCert := trimSuffix ".crt" $vhostCert }}
|
||||
{{ $vhostCert := trimSuffix ".key" $vhostCert }}
|
||||
|
||||
{{/* Use the cert specified on the container or fallback to the best vhost match */}}
|
||||
{{ $cert := (coalesce $certName $vhostCert) }}
|
||||
|
|
@ -209,11 +213,12 @@ server {
|
|||
|
||||
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
|
||||
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
|
||||
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_timeout 5m;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_tickets off;
|
||||
|
||||
ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }};
|
||||
ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }};
|
||||
|
|
@ -233,7 +238,12 @@ server {
|
|||
{{ end }}
|
||||
|
||||
location / {
|
||||
{{ if eq $proto "uwsgi" }}
|
||||
include uwsgi_params;
|
||||
uwsgi_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ else }}
|
||||
proxy_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ end }}
|
||||
{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
|
||||
auth_basic "Restricted {{ $host }}";
|
||||
auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }};
|
||||
|
|
@ -272,7 +282,12 @@ server {
|
|||
{{ end }}
|
||||
|
||||
location / {
|
||||
{{ if eq $proto "uwsgi" }}
|
||||
include uwsgi_params;
|
||||
uwsgi_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ else }}
|
||||
proxy_pass {{ trim $proto }}://{{ trim $host }};
|
||||
{{ end }}
|
||||
{{ if (exists (printf "/etc/nginx/htpasswd/%s" $host)) }}
|
||||
auth_basic "Restricted {{ $host }}";
|
||||
auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" $host) }};
|
||||
|
|
|
|||
Loading…
Reference in a new issue