2023-01-25 23:49:23 +01:00
|
|
|
# nginx-proxy{{ if $.Env.NGINX_PROXY_VERSION }} version : {{ $.Env.NGINX_PROXY_VERSION }}{{ end }}
|
|
|
|
|
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Global values. Values are stored in this map rather than in individual
|
|
|
|
|
* global variables so that the values can be easily passed to embedded
|
|
|
|
|
* templates. (Go templates cannot access variables outside of their own
|
|
|
|
|
* scope.)
|
|
|
|
|
*/}}
|
|
|
|
|
{{- $globals := dict }}
|
|
|
|
|
{{- $_ := set $globals "containers" $ }}
|
|
|
|
|
{{- $_ := set $globals "Env" $.Env }}
|
|
|
|
|
{{- $_ := set $globals "Docker" $.Docker }}
|
|
|
|
|
{{- $_ := set $globals "CurrentContainer" (where $globals.containers "ID" $globals.Docker.CurrentContainerID | first) }}
|
2023-02-02 00:56:16 +01:00
|
|
|
{{- $_ := set $globals "default_cert_ok" (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- $_ := set $globals "external_http_port" (coalesce $globals.Env.HTTP_PORT "80") }}
|
|
|
|
|
{{- $_ := set $globals "external_https_port" (coalesce $globals.Env.HTTPS_PORT "443") }}
|
|
|
|
|
{{- $_ := set $globals "sha1_upstream_name" (parseBool (coalesce $globals.Env.SHA1_UPSTREAM_NAME "false")) }}
|
|
|
|
|
{{- $_ := set $globals "default_root_response" (coalesce $globals.Env.DEFAULT_ROOT "404") }}
|
|
|
|
|
{{- $_ := set $globals "trust_downstream_proxy" (parseBool (coalesce $globals.Env.TRUST_DOWNSTREAM_PROXY "true")) }}
|
|
|
|
|
{{- $_ := set $globals "access_log" (or (and (not $globals.Env.DISABLE_ACCESS_LOGS) "access_log /var/log/nginx/access.log vhost;") "") }}
|
|
|
|
|
{{- $_ := set $globals "enable_ipv6" (parseBool (coalesce $globals.Env.ENABLE_IPV6 "false")) }}
|
|
|
|
|
{{- $_ := set $globals "ssl_policy" (or ($globals.Env.SSL_POLICY) "Mozilla-Intermediate") }}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- $_ := set $globals "vhosts" (dict) }}
|
2023-01-27 01:13:36 +01:00
|
|
|
{{- $_ := set $globals "networks" (dict) }}
|
2023-03-10 11:05:21 +01:00
|
|
|
# Networks available to the container running docker-gen (which are assumed to
|
|
|
|
|
# match the networks available to the container running nginx):
|
|
|
|
|
{{- /*
|
|
|
|
|
* Note: $globals.CurrentContainer may be nil in some circumstances due to
|
|
|
|
|
* <https://github.com/nginx-proxy/docker-gen/issues/458>. For more context
|
|
|
|
|
* see <https://github.com/nginx-proxy/nginx-proxy/issues/2189>.
|
|
|
|
|
*/}}
|
|
|
|
|
{{- if $globals.CurrentContainer }}
|
|
|
|
|
{{- range sortObjectsByKeysAsc $globals.CurrentContainer.Networks "Name" }}
|
|
|
|
|
{{- $_ := set $globals.networks .Name . }}
|
2023-01-27 01:13:36 +01:00
|
|
|
# {{ .Name }}
|
2023-03-10 11:05:21 +01:00
|
|
|
{{- else }}
|
|
|
|
|
# (none)
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- else }}
|
|
|
|
|
# /!\ WARNING: Failed to find the Docker container running docker-gen. All
|
|
|
|
|
# upstream (backend) application containers will appear to be
|
|
|
|
|
# unreachable. Try removing the -only-exposed and -only-published
|
|
|
|
|
# arguments to docker-gen if you pass either of those. See
|
|
|
|
|
# <https://github.com/nginx-proxy/docker-gen/issues/458>.
|
2023-01-27 01:13:36 +01:00
|
|
|
{{- end }}
|
2022-05-17 06:56:06 +02:00
|
|
|
|
2023-01-31 21:07:59 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Template used as a function to get a container's IP address. This
|
|
|
|
|
* template only outputs debug comments; the IP address is "returned" by
|
|
|
|
|
* storing the value in the provided dot dict.
|
|
|
|
|
*
|
|
|
|
|
* The provided dot dict is expected to have the following entries:
|
|
|
|
|
* - "globals": Global values.
|
|
|
|
|
* - "container": The container's RuntimeContainer struct.
|
|
|
|
|
*
|
|
|
|
|
* The return value will be added to the dot dict with key "ip".
|
|
|
|
|
*/}}
|
|
|
|
|
{{- define "container_ip" }}
|
|
|
|
|
{{- $ip := "" }}
|
|
|
|
|
# networks:
|
|
|
|
|
{{- range sortObjectsByKeysAsc $.container.Networks "Name" }}
|
2023-02-17 07:52:05 +01:00
|
|
|
{{- /*
|
|
|
|
|
* TODO: Only ignore the "ingress" network for Swarm tasks (in case
|
|
|
|
|
* the user is not using Swarm mode and names a network "ingress").
|
|
|
|
|
*/}}
|
|
|
|
|
{{- if eq .Name "ingress" }}
|
|
|
|
|
# {{ .Name }} (ignored)
|
|
|
|
|
{{- continue }}
|
|
|
|
|
{{- end }}
|
2023-04-23 15:09:33 +02:00
|
|
|
{{- if eq .Name "host" }}
|
2023-05-09 19:31:42 +02:00
|
|
|
{{- /* Handle containers in host nework mode */}}
|
|
|
|
|
{{- if (index $.globals.networks "host") }}
|
|
|
|
|
# both container and proxy are in host network mode, using localhost IP
|
|
|
|
|
{{- $ip = "127.0.0.1" }}
|
|
|
|
|
{{- continue }}
|
|
|
|
|
{{- end }}
|
2023-05-09 00:58:05 +02:00
|
|
|
{{- range sortObjectsByKeysAsc $.globals.CurrentContainer.Networks "Name" }}
|
2023-12-19 19:20:56 +01:00
|
|
|
{{- if and . .Gateway (not .Internal) }}
|
2023-05-09 00:58:05 +02:00
|
|
|
# container is in host network mode, using {{ .Name }} gateway IP
|
|
|
|
|
{{- $ip = .Gateway }}
|
|
|
|
|
{{- break }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- if $ip }}
|
|
|
|
|
{{- continue }}
|
|
|
|
|
{{- end }}
|
2023-04-23 15:09:33 +02:00
|
|
|
{{- end }}
|
2023-01-31 21:07:59 +01:00
|
|
|
{{- if and (not (index $.globals.networks .Name)) (not $.globals.networks.host) }}
|
|
|
|
|
# {{ .Name }} (unreachable)
|
|
|
|
|
{{- continue }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- /*
|
|
|
|
|
* Do not emit multiple `server` directives for this container if it
|
|
|
|
|
* is reachable over multiple networks. This avoids accidentally
|
|
|
|
|
* inflating the effective round-robin weight of a server due to the
|
|
|
|
|
* redundant upstream addresses that nginx sees as belonging to
|
|
|
|
|
* distinct servers.
|
|
|
|
|
*/}}
|
|
|
|
|
{{- if $ip }}
|
|
|
|
|
# {{ .Name }} (ignored; reachable but redundant)
|
|
|
|
|
{{- continue }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
# {{ .Name }} (reachable)
|
|
|
|
|
{{- if and . .IP }}
|
|
|
|
|
{{- $ip = .IP }}
|
|
|
|
|
{{- else }}
|
|
|
|
|
# /!\ No IP for this network!
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- else }}
|
|
|
|
|
# (none)
|
|
|
|
|
{{- end }}
|
|
|
|
|
# IP address: {{ if $ip }}{{ $ip }}{{ else }}(none usable){{ end }}
|
|
|
|
|
{{- $_ := set $ "ip" $ip }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
|
|
|
|
|
{{- /*
|
|
|
|
|
* Template used as a function to get the port of the server in the given
|
|
|
|
|
* container. This template only outputs debug comments; the port is
|
|
|
|
|
* "returned" by storing the value in the provided dot dict.
|
|
|
|
|
*
|
|
|
|
|
* The provided dot dict is expected to have the following entries:
|
|
|
|
|
* - "container": The container's RuntimeContainer struct.
|
|
|
|
|
*
|
|
|
|
|
* The return value will be added to the dot dict with key "port".
|
|
|
|
|
*/}}
|
|
|
|
|
{{- define "container_port" }}
|
|
|
|
|
{{- /* If only 1 port exposed, use that as a default, else 80. */}}
|
2023-02-20 22:46:24 +01:00
|
|
|
# exposed ports:{{ range sortObjectsByKeysAsc $.container.Addresses "Port" }} {{ .Port }}/{{ .Proto }}{{ else }} (none){{ end }}
|
2023-01-31 21:07:59 +01:00
|
|
|
{{- $default_port := when (eq (len $.container.Addresses) 1) (first $.container.Addresses).Port "80" }}
|
|
|
|
|
# default port: {{ $default_port }}
|
|
|
|
|
{{- $port := or $.container.Env.VIRTUAL_PORT $default_port }}
|
|
|
|
|
# using port: {{ $port }}
|
|
|
|
|
{{- $addr_obj := where $.container.Addresses "Port" $port | first }}
|
|
|
|
|
{{- if and $addr_obj $addr_obj.HostPort }}
|
|
|
|
|
# /!\ WARNING: Virtual port published on host. Clients
|
|
|
|
|
# might be able to bypass nginx-proxy and
|
|
|
|
|
# access the container's server directly.
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- $_ := set $ "port" $port }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- define "ssl_policy" }}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- if eq .ssl_policy "Mozilla-Modern" }}
|
|
|
|
|
ssl_protocols TLSv1.3;
|
2023-12-08 22:41:29 +01:00
|
|
|
{{- /*
|
|
|
|
|
* This ssl_ciphers directive is not used but necessary to get TLSv1.3 only.
|
|
|
|
|
* see https://serverfault.com/questions/1023766/nginx-with-only-tls1-3-cipher-suites
|
|
|
|
|
*/}}
|
|
|
|
|
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384;
|
|
|
|
|
ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
|
{{- else if eq .ssl_policy "Mozilla-Intermediate" }}
|
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
2023-05-22 12:21:35 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305';
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
|
{{- else if eq .ssl_policy "Mozilla-Old" }}
|
|
|
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
|
|
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
2023-12-08 17:59:26 +01:00
|
|
|
{{- else if eq .ssl_policy "AWS-TLS13-1-3-2021-06" }}
|
|
|
|
|
ssl_protocols TLSv1.3;
|
2023-12-08 22:41:29 +01:00
|
|
|
{{- /*
|
|
|
|
|
* This ssl_ciphers directive is not used but necessary to get TLSv1.3 only.
|
|
|
|
|
* see https://serverfault.com/questions/1023766/nginx-with-only-tls1-3-cipher-suites
|
|
|
|
|
*/}}
|
2023-12-08 22:06:07 +01:00
|
|
|
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384;
|
|
|
|
|
ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS13-1-2-2021-06" }}
|
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
2023-12-08 22:06:07 +01:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384';
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS13-1-2-Res-2021-06" }}
|
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
2023-12-08 22:06:07 +01:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS13-1-2-Ext1-2021-06" }}
|
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
2023-12-08 22:06:07 +01:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES128-SHA256:AES256-GCM-SHA384:AES256-SHA256';
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS13-1-2-Ext2-2021-06" }}
|
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
2023-12-08 22:06:07 +01:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS13-1-1-2021-06" }}
|
|
|
|
|
ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
|
2023-12-08 22:06:07 +01:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS13-1-0-2021-06" }}
|
|
|
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
|
2023-12-08 22:06:07 +01:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_prefer_server_ciphers on;
|
2023-07-12 23:44:40 +02:00
|
|
|
{{- else if eq .ssl_policy "AWS-FS-1-2-Res-2020-10" }}
|
2023-12-08 16:44:26 +01:00
|
|
|
ssl_protocols TLSv1.2;
|
2023-07-12 23:44:40 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-FS-1-2-Res-2019-08" }}
|
2023-12-08 16:44:26 +01:00
|
|
|
ssl_protocols TLSv1.2;
|
2023-07-12 23:44:40 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-FS-1-2-2019-08" }}
|
2023-12-08 16:44:26 +01:00
|
|
|
ssl_protocols TLSv1.2;
|
2023-07-12 23:44:40 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-FS-1-1-2019-08" }}
|
2023-12-08 16:44:26 +01:00
|
|
|
ssl_protocols TLSv1.1 TLSv1.2;
|
2023-07-12 23:44:40 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-FS-2018-06" }}
|
2023-12-08 16:44:26 +01:00
|
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
2023-07-12 23:44:40 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS-1-2-Ext-2018-06" }}
|
2023-12-08 16:44:26 +01:00
|
|
|
ssl_protocols TLSv1.2;
|
2023-07-12 23:44:40 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- else if eq .ssl_policy "AWS-TLS-1-2-2017-01" }}
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_protocols TLSv1.2;
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES128-SHA256:AES256-GCM-SHA384:AES256-SHA256';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-TLS-1-1-2017-01" }}
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_protocols TLSv1.1 TLSv1.2;
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-2016-08" }}
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-2015-05" }}
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DES-CBC3-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-2015-03" }}
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- else if eq .ssl_policy "AWS-2015-02" }}
|
2023-12-08 17:59:26 +01:00
|
|
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DHE-DSS-AES128-SHA';
|
|
|
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
|
{{- end }}
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- end }}
|
2015-07-15 17:21:10 +02:00
|
|
|
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- define "location" }}
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- $override := printf "/etc/nginx/vhost.d/%s_%s_location_override" .Host (sha1 .Path) }}
|
|
|
|
|
{{- if and (eq .Path "/") (not (exists $override)) }}
|
|
|
|
|
{{- $override = printf "/etc/nginx/vhost.d/%s_location_override" .Host }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- if exists $override }}
|
|
|
|
|
include {{ $override }};
|
|
|
|
|
{{- else }}
|
2023-12-26 17:58:24 +01:00
|
|
|
{{- $keepalive := coalesce (first (keys (groupByLabel .Containers "com.github.nginx-proxy.nginx-proxy.keepalive"))) "disabled" }}
|
2022-05-17 07:19:32 +02:00
|
|
|
location {{ .Path }} {
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- if eq .NetworkTag "internal" }}
|
2022-05-17 07:19:32 +02:00
|
|
|
# Only allow traffic from internal clients
|
|
|
|
|
include /etc/nginx/network_internal.conf;
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- if eq .Proto "uwsgi" }}
|
2022-05-17 07:19:32 +02:00
|
|
|
include uwsgi_params;
|
|
|
|
|
uwsgi_pass {{ trim .Proto }}://{{ trim .Upstream }};
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- else if eq .Proto "fastcgi" }}
|
2022-05-17 07:19:32 +02:00
|
|
|
root {{ trim .VhostRoot }};
|
|
|
|
|
include fastcgi_params;
|
|
|
|
|
fastcgi_pass {{ trim .Upstream }};
|
2023-12-26 17:58:24 +01:00
|
|
|
{{- if ne $keepalive "disabled" }}
|
2022-03-28 08:56:36 +02:00
|
|
|
fastcgi_keep_conn on;
|
|
|
|
|
{{- end }}
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- else if eq .Proto "grpc" }}
|
2022-05-17 07:19:32 +02:00
|
|
|
grpc_pass {{ trim .Proto }}://{{ trim .Upstream }};
|
2023-10-22 00:34:32 +02:00
|
|
|
{{- else if eq .Proto "grpcs" }}
|
|
|
|
|
grpc_pass {{ trim .Proto }}://{{ trim .Upstream }};
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- else }}
|
2022-05-17 07:19:32 +02:00
|
|
|
proxy_pass {{ trim .Proto }}://{{ trim .Upstream }}{{ trim .Dest }};
|
2023-12-26 17:58:24 +01:00
|
|
|
set $upstream_keepalive {{ if ne $keepalive "disabled" }}true{{ else }}false{{ end }};
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
|
2024-02-10 16:24:00 +01:00
|
|
|
{{- if (exists (printf "/etc/nginx/htpasswd/%s_%s" .Host (sha1 .Path) )) }}
|
2024-02-19 12:23:19 +01:00
|
|
|
auth_basic "Restricted {{ .Host }}{{ .Path }}";
|
2024-02-10 16:24:00 +01:00
|
|
|
auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s_%s" .Host (sha1 .Path)) }};
|
|
|
|
|
{{- else if (exists (printf "/etc/nginx/htpasswd/%s" .Host)) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
auth_basic "Restricted {{ .Host }}";
|
|
|
|
|
auth_basic_user_file {{ (printf "/etc/nginx/htpasswd/%s" .Host) }};
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- if (exists (printf "/etc/nginx/vhost.d/%s_%s_location" .Host (sha1 .Path) )) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
include {{ printf "/etc/nginx/vhost.d/%s_%s_location" .Host (sha1 .Path) }};
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- else if (exists (printf "/etc/nginx/vhost.d/%s_location" .Host)) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
include {{ printf "/etc/nginx/vhost.d/%s_location" .Host}};
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- else if (exists "/etc/nginx/vhost.d/default_location") }}
|
2022-05-17 07:19:32 +02:00
|
|
|
include /etc/nginx/vhost.d/default_location;
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
}
|
2023-01-28 08:27:18 +01:00
|
|
|
{{- end }}
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- end }}
|
2021-05-23 22:52:57 +02:00
|
|
|
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- define "upstream" }}
|
2022-04-06 12:54:27 +02:00
|
|
|
upstream {{ .Upstream }} {
|
2023-12-26 18:18:00 +01:00
|
|
|
{{- $servers := 0 }}
|
2023-03-21 07:49:27 +01:00
|
|
|
{{- $loadbalance := first (keys (groupByLabel .Containers "com.github.nginx-proxy.nginx-proxy.loadbalance")) }}
|
|
|
|
|
{{- if $loadbalance }}
|
|
|
|
|
# From the container's loadbalance label:
|
|
|
|
|
{{ $loadbalance }}
|
|
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- range $container := .Containers }}
|
2023-01-26 22:53:52 +01:00
|
|
|
# Container: {{ $container.Name }}
|
2023-01-31 21:07:59 +01:00
|
|
|
{{- $args := dict "globals" $.globals "container" $container }}
|
|
|
|
|
{{- template "container_ip" $args }}
|
|
|
|
|
{{- $ip := $args.ip }}
|
|
|
|
|
{{- $args := dict "container" $container }}
|
|
|
|
|
{{- template "container_port" $args }}
|
|
|
|
|
{{- $port := $args.port }}
|
2023-01-28 06:19:21 +01:00
|
|
|
{{- if $ip }}
|
2023-12-26 18:18:00 +01:00
|
|
|
{{- $servers = add1 $servers }}
|
2023-01-28 06:19:21 +01:00
|
|
|
server {{ $ip }}:{{ $port }};
|
|
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
|
|
|
|
{{- /* nginx-proxy/nginx-proxy#1105 */}}
|
2023-12-26 18:43:05 +01:00
|
|
|
{{- if lt $servers 1 }}
|
2022-05-17 07:19:32 +02:00
|
|
|
# Fallback entry
|
|
|
|
|
server 127.0.0.1 down;
|
|
|
|
|
{{- end }}
|
2023-12-26 17:58:24 +01:00
|
|
|
{{- $keepalive := coalesce (first (keys (groupByLabel .Containers "com.github.nginx-proxy.nginx-proxy.keepalive"))) "disabled" }}
|
2023-12-26 18:18:00 +01:00
|
|
|
{{- if and (ne $keepalive "disabled") (gt $servers 0) }}
|
|
|
|
|
{{- if eq $keepalive "auto" }}
|
|
|
|
|
keepalive {{ mul $servers 2 }};
|
|
|
|
|
{{- else }}
|
2022-03-28 08:56:36 +02:00
|
|
|
keepalive {{ $keepalive }};
|
2023-12-26 18:18:00 +01:00
|
|
|
{{- end }}
|
2022-03-28 08:56:36 +02:00
|
|
|
{{- end }}
|
2022-04-06 12:54:27 +02:00
|
|
|
}
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- end }}
|
2021-05-23 22:52:57 +02:00
|
|
|
|
2014-10-26 02:13:04 +02:00
|
|
|
# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
|
|
|
|
|
# scheme used to connect to this server
|
2014-10-23 00:18:46 +02:00
|
|
|
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
|
2023-01-15 04:59:33 +01:00
|
|
|
default {{ if $globals.trust_downstream_proxy }}$http_x_forwarded_proto{{ else }}$scheme{{ end }};
|
2022-05-17 07:19:32 +02:00
|
|
|
'' $scheme;
|
2014-10-23 00:18:46 +02:00
|
|
|
}
|
|
|
|
|
|
2021-12-10 06:08:18 +01:00
|
|
|
map $http_x_forwarded_host $proxy_x_forwarded_host {
|
2023-07-22 10:42:17 +02:00
|
|
|
default {{ if $globals.trust_downstream_proxy }}$http_x_forwarded_host{{ else }}$host{{ end }};
|
|
|
|
|
'' $host;
|
2021-12-10 06:08:18 +01:00
|
|
|
}
|
|
|
|
|
|
2016-09-29 17:33:21 +02:00
|
|
|
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
|
2016-09-29 22:06:53 +02:00
|
|
|
# server port the client connected to
|
2016-09-29 17:33:21 +02:00
|
|
|
map $http_x_forwarded_port $proxy_x_forwarded_port {
|
2023-01-15 04:59:33 +01:00
|
|
|
default {{ if $globals.trust_downstream_proxy }}$http_x_forwarded_port{{ else }}$server_port{{ end }};
|
2022-05-17 07:19:32 +02:00
|
|
|
'' $server_port;
|
2016-09-29 17:33:21 +02:00
|
|
|
}
|
|
|
|
|
|
2024-02-10 15:23:35 +01:00
|
|
|
# Include the port in the Host header sent to the container if it is non-standard
|
|
|
|
|
map $server_port $host_port {
|
|
|
|
|
default :$server_port;
|
|
|
|
|
80 '';
|
|
|
|
|
443 '';
|
|
|
|
|
}
|
|
|
|
|
|
2022-03-28 08:56:36 +02:00
|
|
|
# If the request from the downstream client has an "Upgrade:" header (set to any
|
|
|
|
|
# non-empty value), pass "Connection: upgrade" to the upstream (backend) server.
|
|
|
|
|
# Otherwise, the value for the "Connection" header depends on whether the user
|
|
|
|
|
# has enabled keepalive to the upstream server.
|
2014-10-26 02:13:17 +02:00
|
|
|
map $http_upgrade $proxy_connection {
|
2022-05-17 07:19:32 +02:00
|
|
|
default upgrade;
|
2022-03-28 08:56:36 +02:00
|
|
|
'' $proxy_connection_noupgrade;
|
|
|
|
|
}
|
|
|
|
|
map $upstream_keepalive $proxy_connection_noupgrade {
|
|
|
|
|
# Preserve nginx's default behavior (send "Connection: close").
|
|
|
|
|
default close;
|
|
|
|
|
# Use an empty string to cancel nginx's default behavior.
|
|
|
|
|
true '';
|
|
|
|
|
}
|
|
|
|
|
# Abuse the map directive (see <https://stackoverflow.com/q/14433309>) to ensure
|
|
|
|
|
# that $upstream_keepalive is always defined. This is necessary because:
|
|
|
|
|
# - The $proxy_connection variable is indirectly derived from
|
|
|
|
|
# $upstream_keepalive, so $upstream_keepalive must be defined whenever
|
|
|
|
|
# $proxy_connection is resolved.
|
|
|
|
|
# - The $proxy_connection variable is used in a proxy_set_header directive in
|
|
|
|
|
# the http block, so it is always fully resolved for every request -- even
|
|
|
|
|
# those where proxy_pass is not used (e.g., unknown virtual host).
|
|
|
|
|
map "" $upstream_keepalive {
|
|
|
|
|
# The value here should not matter because it should always be overridden in
|
|
|
|
|
# a location block (see the "location" template) for all requests where the
|
|
|
|
|
# value actually matters.
|
|
|
|
|
default false;
|
2014-10-26 02:13:17 +02:00
|
|
|
}
|
|
|
|
|
|
2016-10-03 16:21:31 +02:00
|
|
|
# Apply fix for very long server names
|
|
|
|
|
server_names_hash_bucket_size 128;
|
|
|
|
|
|
|
|
|
|
# Default dhparam
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- if (exists "/etc/nginx/dhparam/dhparam.pem") }}
|
2017-01-12 04:39:04 +01:00
|
|
|
ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- end }}
|
2016-10-03 16:21:31 +02:00
|
|
|
|
2018-10-24 18:10:24 +02:00
|
|
|
# Set appropriate X-Forwarded-Ssl header based on $proxy_x_forwarded_proto
|
|
|
|
|
map $proxy_x_forwarded_proto $proxy_x_forwarded_ssl {
|
2022-05-17 07:19:32 +02:00
|
|
|
default off;
|
|
|
|
|
https on;
|
2016-02-11 21:54:32 +01:00
|
|
|
}
|
|
|
|
|
|
2015-01-05 13:31:26 +01:00
|
|
|
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
2014-11-02 14:29:32 +01:00
|
|
|
|
Add more control over log_format config directive
Introduces 3 new environmental variables:
- `LOG_FORMAT`
- `LOG_FORMAT_ESCAPE`
- `LOG_JSON`
`LOG_FORMAT` and `LOG_FORMAT_ESCAPE` default to standard values.
When `LOG_JSON` is set, defaults are changed to: `{"time_local":"$time_iso8601","client_ip":"$http_x_forwarded_for","remote_addr":"$remote_addr","request":"$request","status":"$status","body_bytes_sent":"$body_bytes_sent","request_time":"$request_time","upstream_response_time":"$upstream_response_time","upstream_addr":"$upstream_addr","http_referrer":"$http_referer","http_user_agent":"$http_user_agent","request_id":"$request_id"}`and `json`.
See `nginx.tmpl` and https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format for details
2023-03-14 12:11:33 +01:00
|
|
|
|
|
|
|
|
{{- /* See https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format for details and variables
|
|
|
|
|
* LOG_FORMAT_ESCAPE sets the escape part of the log format
|
|
|
|
|
* LOG_FORMAT sets the log format
|
|
|
|
|
*/}}
|
2024-02-10 17:54:14 +01:00
|
|
|
{{- $logEscape := printf "escape=%s" (or $globals.Env.LOG_FORMAT_ESCAPE "default") }}
|
|
|
|
|
{{- $logFormat := or $globals.Env.LOG_FORMAT `$host $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$upstream_addr"` }}
|
Add more control over log_format config directive
Introduces 3 new environmental variables:
- `LOG_FORMAT`
- `LOG_FORMAT_ESCAPE`
- `LOG_JSON`
`LOG_FORMAT` and `LOG_FORMAT_ESCAPE` default to standard values.
When `LOG_JSON` is set, defaults are changed to: `{"time_local":"$time_iso8601","client_ip":"$http_x_forwarded_for","remote_addr":"$remote_addr","request":"$request","status":"$status","body_bytes_sent":"$body_bytes_sent","request_time":"$request_time","upstream_response_time":"$upstream_response_time","upstream_addr":"$upstream_addr","http_referrer":"$http_referer","http_user_agent":"$http_user_agent","request_id":"$request_id"}`and `json`.
See `nginx.tmpl` and https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format for details
2023-03-14 12:11:33 +01:00
|
|
|
|
2024-02-10 17:54:14 +01:00
|
|
|
{{- if parseBool (or $globals.Env.LOG_JSON "false") }}
|
|
|
|
|
{{- /* LOG_JSON is a shorthand
|
|
|
|
|
* that sets logging defaults to JSON format
|
|
|
|
|
*/}}
|
Add more control over log_format config directive
Introduces 3 new environmental variables:
- `LOG_FORMAT`
- `LOG_FORMAT_ESCAPE`
- `LOG_JSON`
`LOG_FORMAT` and `LOG_FORMAT_ESCAPE` default to standard values.
When `LOG_JSON` is set, defaults are changed to: `{"time_local":"$time_iso8601","client_ip":"$http_x_forwarded_for","remote_addr":"$remote_addr","request":"$request","status":"$status","body_bytes_sent":"$body_bytes_sent","request_time":"$request_time","upstream_response_time":"$upstream_response_time","upstream_addr":"$upstream_addr","http_referrer":"$http_referer","http_user_agent":"$http_user_agent","request_id":"$request_id"}`and `json`.
See `nginx.tmpl` and https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format for details
2023-03-14 12:11:33 +01:00
|
|
|
# JSON Logging enabled (via LOG_JSON env variable)
|
2024-02-10 17:54:14 +01:00
|
|
|
{{- $logEscape = printf "escape=%s" (or $globals.Env.LOG_FORMAT_ESCAPE "json") }}
|
|
|
|
|
{{- $logFormat = or $globals.Env.LOG_FORMAT `{"time_local":"$time_iso8601","client_ip":"$http_x_forwarded_for","remote_addr":"$remote_addr","request":"$request","status":"$status","body_bytes_sent":"$body_bytes_sent","request_time":"$request_time","upstream_response_time":"$upstream_response_time","upstream_addr":"$upstream_addr","http_referrer":"$http_referer","http_user_agent":"$http_user_agent","request_id":"$request_id"}` }}
|
Add more control over log_format config directive
Introduces 3 new environmental variables:
- `LOG_FORMAT`
- `LOG_FORMAT_ESCAPE`
- `LOG_JSON`
`LOG_FORMAT` and `LOG_FORMAT_ESCAPE` default to standard values.
When `LOG_JSON` is set, defaults are changed to: `{"time_local":"$time_iso8601","client_ip":"$http_x_forwarded_for","remote_addr":"$remote_addr","request":"$request","status":"$status","body_bytes_sent":"$body_bytes_sent","request_time":"$request_time","upstream_response_time":"$upstream_response_time","upstream_addr":"$upstream_addr","http_referrer":"$http_referer","http_user_agent":"$http_user_agent","request_id":"$request_id"}`and `json`.
See `nginx.tmpl` and https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format for details
2023-03-14 12:11:33 +01:00
|
|
|
{{- end }}
|
|
|
|
|
|
|
|
|
|
log_format vhost {{ $logEscape }} '{{ or $globals.Env.LOG_FORMAT $logFormat }}';
|
2014-12-07 02:46:25 +01:00
|
|
|
|
2015-08-23 18:00:58 +02:00
|
|
|
access_log off;
|
2014-11-02 14:29:32 +01:00
|
|
|
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- template "ssl_policy" (dict "ssl_policy" $globals.ssl_policy) }}
|
2021-05-23 22:52:57 +02:00
|
|
|
error_log /dev/stderr;
|
2019-08-29 22:14:14 +02:00
|
|
|
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- if $globals.Env.RESOLVERS }}
|
|
|
|
|
resolver {{ $globals.Env.RESOLVERS }};
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- end }}
|
2016-10-01 16:42:58 +02:00
|
|
|
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- if (exists "/etc/nginx/proxy.conf") }}
|
2015-08-14 19:29:44 +02:00
|
|
|
include /etc/nginx/proxy.conf;
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- else }}
|
2014-10-26 06:06:54 +01:00
|
|
|
# HTTP 1.1 support
|
|
|
|
|
proxy_http_version 1.1;
|
2024-02-10 15:23:35 +01:00
|
|
|
proxy_set_header Host $host$host_port;
|
2014-10-26 06:06:54 +01:00
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
|
|
|
proxy_set_header Connection $proxy_connection;
|
|
|
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
|
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
2021-12-10 06:08:18 +01:00
|
|
|
proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
|
2014-10-26 06:06:54 +01:00
|
|
|
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
|
2016-02-11 21:54:32 +01:00
|
|
|
proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
|
2016-09-29 17:33:21 +02:00
|
|
|
proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
|
2021-05-23 22:52:57 +02:00
|
|
|
proxy_set_header X-Original-URI $request_uri;
|
2016-07-19 17:03:41 +02:00
|
|
|
|
|
|
|
|
# Mitigate httpoxy attack (see README for details)
|
2016-07-18 19:34:37 +02:00
|
|
|
proxy_set_header Proxy "";
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- end }}
|
2014-10-26 06:06:54 +01:00
|
|
|
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Precompute some information about each vhost. This is done early because
|
|
|
|
|
* the creation of fallback servers depends on DEFAULT_HOST, HTTPS_METHOD,
|
|
|
|
|
* and whether there are any missing certs.
|
|
|
|
|
*/}}
|
|
|
|
|
{{- range $vhost, $containers := groupByMulti $globals.containers "Env.VIRTUAL_HOST" "," }}
|
|
|
|
|
{{- $vhost := trim $vhost }}
|
|
|
|
|
{{- if not $vhost }}
|
|
|
|
|
{{- /* Ignore containers with VIRTUAL_HOST set to the empty string. */}}
|
|
|
|
|
{{- continue }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- $certName := first (groupByKeys $containers "Env.CERT_NAME") }}
|
|
|
|
|
{{- $vhostCert := closest (dir "/etc/nginx/certs") (printf "%s.crt" $vhost) }}
|
|
|
|
|
{{- $vhostCert = trimSuffix ".crt" $vhostCert }}
|
|
|
|
|
{{- $vhostCert = trimSuffix ".key" $vhostCert }}
|
|
|
|
|
{{- $cert := or $certName $vhostCert }}
|
|
|
|
|
{{- $cert_ok := and (ne $cert "") (exists (printf "/etc/nginx/certs/%s.crt" $cert)) (exists (printf "/etc/nginx/certs/%s.key" $cert)) }}
|
|
|
|
|
{{- $default := eq $globals.Env.DEFAULT_HOST $vhost }}
|
|
|
|
|
{{- $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) $globals.Env.HTTPS_METHOD "redirect" }}
|
2023-07-18 22:44:36 +02:00
|
|
|
{{- $http3 := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http3.enable"))) $globals.Env.ENABLE_HTTP3 "false")}}
|
|
|
|
|
{{- $_ := set $globals.vhosts $vhost (dict
|
|
|
|
|
"cert" $cert
|
|
|
|
|
"cert_ok" $cert_ok
|
|
|
|
|
"containers" $containers
|
|
|
|
|
"default" $default
|
|
|
|
|
"https_method" $https_method
|
|
|
|
|
"http3" $http3
|
|
|
|
|
) }}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- end }}
|
|
|
|
|
|
|
|
|
|
{{- /*
|
|
|
|
|
* If needed, create a catch-all fallback server to send an error code to
|
|
|
|
|
* clients that request something from an unknown vhost.
|
2023-04-08 00:05:48 +02:00
|
|
|
*
|
|
|
|
|
* This server must appear first in the generated config because nginx uses
|
|
|
|
|
* the first `server` directive to handle requests that don't match any of
|
|
|
|
|
* the other `server` directives. An alternative approach would be to add
|
|
|
|
|
* the `default_server` option to the `listen` directives inside this
|
|
|
|
|
* `server`, but some users inject a custom `server` directive that uses
|
|
|
|
|
* `default_server`. Using `default_server` here would cause nginx to fail
|
|
|
|
|
* to start for those users. See
|
|
|
|
|
* <https://github.com/nginx-proxy/nginx-proxy/issues/2212>.
|
2023-02-05 00:59:38 +01:00
|
|
|
*/}}
|
|
|
|
|
{{- block "fallback_server" $globals }}
|
|
|
|
|
{{- $globals := . }}
|
|
|
|
|
{{- $http_exists := false }}
|
|
|
|
|
{{- $https_exists := false }}
|
|
|
|
|
{{- $default_http_exists := false }}
|
|
|
|
|
{{- $default_https_exists := false }}
|
2023-07-18 22:44:36 +02:00
|
|
|
{{- $http3 := false }}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- range $vhost := $globals.vhosts }}
|
|
|
|
|
{{- $http := or (ne $vhost.https_method "nohttp") (not $vhost.cert_ok) }}
|
|
|
|
|
{{- $https := ne $vhost.https_method "nohttps" }}
|
|
|
|
|
{{- $http_exists = or $http_exists $http }}
|
|
|
|
|
{{- $https_exists = or $https_exists $https }}
|
|
|
|
|
{{- $default_http_exists = or $default_http_exists (and $http $vhost.default) }}
|
|
|
|
|
{{- $default_https_exists = or $default_https_exists (and $https $vhost.default) }}
|
2023-07-18 22:44:36 +02:00
|
|
|
{{- $http3 = or $http3 $vhost.http3 }}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- end }}
|
|
|
|
|
{{- $fallback_http := and $http_exists (not $default_http_exists) }}
|
|
|
|
|
{{- $fallback_https := and $https_exists (not $default_https_exists) }}
|
|
|
|
|
{{- /*
|
|
|
|
|
* If there are no vhosts at all, create fallbacks for both plain http
|
|
|
|
|
* and https so that clients get something more useful than a connection
|
|
|
|
|
* refused error.
|
|
|
|
|
*/}}
|
|
|
|
|
{{- if and (not $http_exists) (not $https_exists) }}
|
|
|
|
|
{{- $fallback_http = true }}
|
|
|
|
|
{{- $fallback_https = true }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- if or $fallback_http $fallback_https }}
|
2014-06-03 23:32:29 +02:00
|
|
|
server {
|
2022-05-17 07:19:32 +02:00
|
|
|
server_name _; # This is just an invalid value which will never trigger on a real hostname.
|
|
|
|
|
server_tokens off;
|
2023-07-22 10:42:17 +02:00
|
|
|
{{ $globals.access_log }}
|
2023-07-04 07:54:38 +02:00
|
|
|
http2 on;
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- if $fallback_http }}
|
2023-04-08 00:05:48 +02:00
|
|
|
listen {{ $globals.external_http_port }}; {{- /* Do not add `default_server` (see comment above). */}}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- if $globals.enable_ipv6 }}
|
2023-04-08 00:05:48 +02:00
|
|
|
listen [::]:{{ $globals.external_http_port }}; {{- /* Do not add `default_server` (see comment above). */}}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- end }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
{{- if $fallback_https }}
|
2023-07-04 07:54:38 +02:00
|
|
|
listen {{ $globals.external_https_port }} ssl; {{- /* Do not add `default_server` (see comment above). */}}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- if $globals.enable_ipv6 }}
|
2023-07-04 07:54:38 +02:00
|
|
|
listen [::]:{{ $globals.external_https_port }} ssl; {{- /* Do not add `default_server` (see comment above). */}}
|
2023-07-22 10:42:17 +02:00
|
|
|
{{- end }}
|
|
|
|
|
{{- if $http3 }}
|
|
|
|
|
http3 on;
|
|
|
|
|
listen {{ $globals.external_https_port }} quic reuseport; {{- /* Do not add `default_server` (see comment above). */}}
|
|
|
|
|
{{- if $globals.enable_ipv6 }}
|
2023-07-18 22:44:36 +02:00
|
|
|
listen [::]:{{ $globals.external_https_port }} quic reuseport; {{- /* Do not add `default_server` (see comment above). */}}
|
|
|
|
|
{{- end }}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- end }}
|
2023-05-08 23:14:09 +02:00
|
|
|
ssl_session_cache shared:SSL:50m;
|
|
|
|
|
ssl_session_tickets off;
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- end }}
|
|
|
|
|
{{- if $globals.default_cert_ok }}
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_certificate /etc/nginx/certs/default.crt;
|
|
|
|
|
ssl_certificate_key /etc/nginx/certs/default.key;
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- else }}
|
2023-02-03 04:02:06 +01:00
|
|
|
# No default.crt certificate found for this vhost, so force nginx to emit a
|
|
|
|
|
# TLS error if the client connects via https.
|
|
|
|
|
{{- /* See the comment in the main `server` directive for rationale. */}}
|
|
|
|
|
ssl_ciphers aNULL;
|
|
|
|
|
set $empty "";
|
|
|
|
|
ssl_certificate data:$empty;
|
|
|
|
|
ssl_certificate_key data:$empty;
|
|
|
|
|
if ($https) {
|
|
|
|
|
return 444;
|
|
|
|
|
}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- end }}
|
2023-02-03 04:02:06 +01:00
|
|
|
return 503;
|
2022-04-19 21:37:53 +02:00
|
|
|
}
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- end }}
|
|
|
|
|
{{- end }}
|
2015-08-26 10:35:47 +02:00
|
|
|
|
2023-02-05 00:59:38 +01:00
|
|
|
{{- range $host, $vhost := $globals.vhosts }}
|
|
|
|
|
{{- $cert := $vhost.cert }}
|
|
|
|
|
{{- $cert_ok := $vhost.cert_ok }}
|
|
|
|
|
{{- $containers := $vhost.containers }}
|
|
|
|
|
{{- $default_server := when $vhost.default "default_server" "" }}
|
|
|
|
|
{{- $https_method := $vhost.https_method }}
|
2023-07-18 22:32:50 +02:00
|
|
|
{{- $http2 := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http2.enable"))) $globals.Env.ENABLE_HTTP2 "true")}}
|
2023-07-18 22:44:36 +02:00
|
|
|
{{- $http3 := parseBool (or (first (keys (groupByLabel $containers "com.github.nginx-proxy.nginx-proxy.http3.enable"))) $globals.Env.ENABLE_HTTP3 "false")}}
|
2017-06-09 20:55:39 +02:00
|
|
|
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- $is_regexp := hasPrefix "~" $host }}
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- $upstream_name := when (or $is_regexp $globals.sha1_upstream_name) (sha1 $host) $host }}
|
2021-05-23 22:52:57 +02:00
|
|
|
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- $paths := groupBy $containers "Env.VIRTUAL_PATH" }}
|
|
|
|
|
{{- $nPaths := len $paths }}
|
|
|
|
|
{{- if eq $nPaths 0 }}
|
|
|
|
|
{{- $paths = dict "/" $containers }}
|
|
|
|
|
{{- end }}
|
2022-04-05 10:59:54 +02:00
|
|
|
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- range $path, $containers := $paths }}
|
|
|
|
|
{{- $upstream := $upstream_name }}
|
|
|
|
|
{{- if gt $nPaths 0 }}
|
|
|
|
|
{{- $sum := sha1 $path }}
|
|
|
|
|
{{- $upstream = printf "%s-%s" $upstream $sum }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
# {{ $host }}{{ $path }}
|
2023-01-31 21:07:59 +01:00
|
|
|
{{ template "upstream" (dict "globals" $globals "Upstream" $upstream "Containers" $containers) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
2014-05-05 18:59:23 +02:00
|
|
|
|
2023-01-09 23:21:35 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Get the SERVER_TOKENS defined by containers w/ the same vhost,
|
|
|
|
|
* falling back to "".
|
|
|
|
|
*/}}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- $server_tokens := trim (or (first (groupByKeys $containers "Env.SERVER_TOKENS")) "") }}
|
2021-05-10 23:35:53 +02:00
|
|
|
|
2023-01-09 23:21:35 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Get the SSL_POLICY defined by containers w/ the same vhost, falling
|
|
|
|
|
* back to empty string (use default).
|
|
|
|
|
*/}}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- $ssl_policy := or (first (groupByKeys $containers "Env.SSL_POLICY")) "" }}
|
2017-10-27 10:09:32 +02:00
|
|
|
|
2023-01-09 23:21:35 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Get the HSTS defined by containers w/ the same vhost, falling back to
|
|
|
|
|
* "max-age=31536000".
|
|
|
|
|
*/}}
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- $hsts := or (first (groupByKeys $containers "Env.HSTS")) (or $globals.Env.HSTS "max-age=31536000") }}
|
2017-11-09 04:30:24 +01:00
|
|
|
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- /* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}}
|
|
|
|
|
{{- $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }}
|
2017-06-24 08:48:05 +02:00
|
|
|
|
2023-02-02 00:17:43 +01:00
|
|
|
{{- if and $cert_ok (eq $https_method "redirect") }}
|
Add SSL support
This adds SSL support for containers. It supports single host
certificates, wildcards and SNI using naming conventions for
certificates or optionally specify a cert name (for SNI). The SSL
cipher configuration is based on mozilla intermediate profile which
should provide compatibility with clients back to Firefox 1, Chrome 1,
IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7. The
configuration also enables OCSP stapling, HSTS, and ssl session caches.
To enable SSL, nginx-proxy should be started w/ -p 443:443 and -v
/path/to/certs:/etc/nginx/certs. Certificates must be named:
<virtualhost>.crt and <virtualhost>.key where <virtualhost> matches
the a value of VIRTUAL_HOST on a container.
For wildcard certificates, the certificate and private key should be
named after the wildcard domain with .crt and .key suffixes. For example,
*.example.com should be name example.com.crt and example.com.key.
For SNI where a certificate may be used for multiple domain names, the
container can specify a CERT_NAME env var that corresponds to the base
file name of the certificate and key. For example, if you have a cert
allowing *.example.com and *.bar.com, it can be name shared.crt and
shared.key. A container can use that cert by having CERT_NAME=shared and
VIRTUAL_HOST=foo.example.com. The name "shared" is arbitrary and can
be whatever makes sense.
The behavior for the proxy when port 80 and 443 is defined is as
follows:
* If a container has a usable cert, port 80 will redirect to
443 for that container to always prefer HTTPS when available.
* If the container does not have a usable cert 503 will be returned.
In the last case, a self-signed or generic cert can be defined as
"default.crt" and "default.key" which will allow a client browser to
at least make a SSL connection.
2014-11-26 18:38:51 +01:00
|
|
|
server {
|
2022-05-17 07:19:32 +02:00
|
|
|
server_name {{ $host }};
|
|
|
|
|
{{- if $server_tokens }}
|
|
|
|
|
server_tokens {{ $server_tokens }};
|
|
|
|
|
{{- end }}
|
2023-07-22 10:42:17 +02:00
|
|
|
{{ $globals.access_log }}
|
2023-01-15 04:59:33 +01:00
|
|
|
listen {{ $globals.external_http_port }} {{ $default_server }};
|
|
|
|
|
{{- if $globals.enable_ipv6 }}
|
|
|
|
|
listen [::]:{{ $globals.external_http_port }} {{ $default_server }};
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
|
|
|
|
|
|
|
|
|
# Do not HTTPS redirect Let's Encrypt ACME challenge
|
|
|
|
|
location ^~ /.well-known/acme-challenge/ {
|
|
|
|
|
auth_basic off;
|
|
|
|
|
auth_request off;
|
|
|
|
|
allow all;
|
|
|
|
|
root /usr/share/nginx/html;
|
|
|
|
|
try_files $uri =404;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
location / {
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- if eq $globals.external_https_port "443" }}
|
2022-05-17 07:19:32 +02:00
|
|
|
return 301 https://$host$request_uri;
|
|
|
|
|
{{- else }}
|
2023-01-15 04:59:33 +01:00
|
|
|
return 301 https://$host:{{ $globals.external_https_port }}$request_uri;
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
|
|
|
|
}
|
Add SSL support
This adds SSL support for containers. It supports single host
certificates, wildcards and SNI using naming conventions for
certificates or optionally specify a cert name (for SNI). The SSL
cipher configuration is based on mozilla intermediate profile which
should provide compatibility with clients back to Firefox 1, Chrome 1,
IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7. The
configuration also enables OCSP stapling, HSTS, and ssl session caches.
To enable SSL, nginx-proxy should be started w/ -p 443:443 and -v
/path/to/certs:/etc/nginx/certs. Certificates must be named:
<virtualhost>.crt and <virtualhost>.key where <virtualhost> matches
the a value of VIRTUAL_HOST on a container.
For wildcard certificates, the certificate and private key should be
named after the wildcard domain with .crt and .key suffixes. For example,
*.example.com should be name example.com.crt and example.com.key.
For SNI where a certificate may be used for multiple domain names, the
container can specify a CERT_NAME env var that corresponds to the base
file name of the certificate and key. For example, if you have a cert
allowing *.example.com and *.bar.com, it can be name shared.crt and
shared.key. A container can use that cert by having CERT_NAME=shared and
VIRTUAL_HOST=foo.example.com. The name "shared" is arbitrary and can
be whatever makes sense.
The behavior for the proxy when port 80 and 443 is defined is as
follows:
* If a container has a usable cert, port 80 will redirect to
443 for that container to always prefer HTTPS when available.
* If the container does not have a usable cert 503 will be returned.
In the last case, a self-signed or generic cert can be defined as
"default.crt" and "default.key" which will allow a client browser to
at least make a SSL connection.
2014-11-26 18:38:51 +01:00
|
|
|
}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
Add SSL support
This adds SSL support for containers. It supports single host
certificates, wildcards and SNI using naming conventions for
certificates or optionally specify a cert name (for SNI). The SSL
cipher configuration is based on mozilla intermediate profile which
should provide compatibility with clients back to Firefox 1, Chrome 1,
IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7. The
configuration also enables OCSP stapling, HSTS, and ssl session caches.
To enable SSL, nginx-proxy should be started w/ -p 443:443 and -v
/path/to/certs:/etc/nginx/certs. Certificates must be named:
<virtualhost>.crt and <virtualhost>.key where <virtualhost> matches
the a value of VIRTUAL_HOST on a container.
For wildcard certificates, the certificate and private key should be
named after the wildcard domain with .crt and .key suffixes. For example,
*.example.com should be name example.com.crt and example.com.key.
For SNI where a certificate may be used for multiple domain names, the
container can specify a CERT_NAME env var that corresponds to the base
file name of the certificate and key. For example, if you have a cert
allowing *.example.com and *.bar.com, it can be name shared.crt and
shared.key. A container can use that cert by having CERT_NAME=shared and
VIRTUAL_HOST=foo.example.com. The name "shared" is arbitrary and can
be whatever makes sense.
The behavior for the proxy when port 80 and 443 is defined is as
follows:
* If a container has a usable cert, port 80 will redirect to
443 for that container to always prefer HTTPS when available.
* If the container does not have a usable cert 503 will be returned.
In the last case, a self-signed or generic cert can be defined as
"default.crt" and "default.key" which will allow a client browser to
at least make a SSL connection.
2014-11-26 18:38:51 +01:00
|
|
|
|
2014-05-05 18:59:23 +02:00
|
|
|
server {
|
2022-05-17 07:19:32 +02:00
|
|
|
server_name {{ $host }};
|
|
|
|
|
{{- if $server_tokens }}
|
|
|
|
|
server_tokens {{ $server_tokens }};
|
|
|
|
|
{{- end }}
|
2023-07-22 10:42:17 +02:00
|
|
|
{{ $globals.access_log }}
|
2023-07-18 22:32:50 +02:00
|
|
|
{{- if $http2 }}
|
2023-07-04 07:54:38 +02:00
|
|
|
http2 on;
|
2023-07-18 22:32:50 +02:00
|
|
|
{{- end }}
|
2023-02-02 00:17:43 +01:00
|
|
|
{{- if or (eq $https_method "nohttps") (not $cert_ok) (eq $https_method "noredirect") }}
|
2023-01-15 04:59:33 +01:00
|
|
|
listen {{ $globals.external_http_port }} {{ $default_server }};
|
|
|
|
|
{{- if $globals.enable_ipv6 }}
|
|
|
|
|
listen [::]:{{ $globals.external_http_port }} {{ $default_server }};
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
2022-04-19 21:37:53 +02:00
|
|
|
{{- end }}
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- if ne $https_method "nohttps" }}
|
2023-07-04 07:54:38 +02:00
|
|
|
listen {{ $globals.external_https_port }} ssl {{ $default_server }};
|
2023-01-15 04:59:33 +01:00
|
|
|
{{- if $globals.enable_ipv6 }}
|
2023-07-04 07:54:38 +02:00
|
|
|
listen [::]:{{ $globals.external_https_port }} ssl {{ $default_server }};
|
2023-07-22 10:42:17 +02:00
|
|
|
{{- end }}
|
|
|
|
|
|
|
|
|
|
{{- if $http3 }}
|
|
|
|
|
http3 on;
|
|
|
|
|
add_header alt-svc 'h3=":{{ $globals.external_https_port }}"; ma=86400;';
|
|
|
|
|
listen {{ $globals.external_https_port }} quic {{ $default_server }};
|
|
|
|
|
{{- if $globals.enable_ipv6 }}
|
2023-07-18 22:44:36 +02:00
|
|
|
listen [::]:{{ $globals.external_https_port }} quic {{ $default_server }};
|
|
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
|
|
|
|
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- if $cert_ok }}
|
|
|
|
|
{{- template "ssl_policy" (dict "ssl_policy" $ssl_policy) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
|
|
|
|
|
ssl_session_timeout 5m;
|
|
|
|
|
ssl_session_cache shared:SSL:50m;
|
|
|
|
|
ssl_session_tickets off;
|
|
|
|
|
|
|
|
|
|
ssl_certificate /etc/nginx/certs/{{ (printf "%s.crt" $cert) }};
|
|
|
|
|
ssl_certificate_key /etc/nginx/certs/{{ (printf "%s.key" $cert) }};
|
|
|
|
|
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- if (exists (printf "/etc/nginx/certs/%s.dhparam.pem" $cert)) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_dhparam {{ printf "/etc/nginx/certs/%s.dhparam.pem" $cert }};
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- if (exists (printf "/etc/nginx/certs/%s.chain.pem" $cert)) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
ssl_stapling on;
|
|
|
|
|
ssl_stapling_verify on;
|
|
|
|
|
ssl_trusted_certificate {{ printf "/etc/nginx/certs/%s.chain.pem" $cert }};
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- end }}
|
2022-05-17 07:19:32 +02:00
|
|
|
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- if (not (or (eq $https_method "noredirect") (eq $hsts "off"))) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
set $sts_header "";
|
|
|
|
|
if ($https) {
|
|
|
|
|
set $sts_header "{{ trim $hsts }}";
|
|
|
|
|
}
|
|
|
|
|
add_header Strict-Transport-Security $sts_header always;
|
2023-02-03 04:02:06 +01:00
|
|
|
{{- end }}
|
|
|
|
|
{{- else if $globals.default_cert_ok }}
|
|
|
|
|
# No certificate found for this vhost, so use the default certificate and
|
|
|
|
|
# return an error code if the user connects via https.
|
|
|
|
|
ssl_certificate /etc/nginx/certs/default.crt;
|
|
|
|
|
ssl_certificate_key /etc/nginx/certs/default.key;
|
|
|
|
|
if ($https) {
|
|
|
|
|
return 500;
|
|
|
|
|
}
|
|
|
|
|
{{- else }}
|
|
|
|
|
# No certificate found for this vhost, so force nginx to emit a TLS error if
|
|
|
|
|
# the client connects via https.
|
|
|
|
|
{{- /*
|
|
|
|
|
* The alternative is to not provide an https server for this
|
|
|
|
|
* vhost, which would either cause the user to see the wrong
|
|
|
|
|
* vhost (if there is another vhost with a certificate) or a
|
|
|
|
|
* connection refused error (if there is no other vhost with a
|
|
|
|
|
* certificate). A TLS error is easier to troubleshoot, and is
|
|
|
|
|
* safer than serving the wrong vhost. Also see
|
|
|
|
|
* <https://serverfault.com/a/1044022>.
|
|
|
|
|
*/}}
|
|
|
|
|
ssl_ciphers aNULL;
|
|
|
|
|
set $empty "";
|
|
|
|
|
ssl_certificate data:$empty;
|
|
|
|
|
ssl_certificate_key data:$empty;
|
|
|
|
|
if ($https) {
|
|
|
|
|
return 444;
|
|
|
|
|
}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
|
|
|
|
{{- end }}
|
|
|
|
|
|
|
|
|
|
{{- if (exists (printf "/etc/nginx/vhost.d/%s" $host)) }}
|
|
|
|
|
include {{ printf "/etc/nginx/vhost.d/%s" $host }};
|
|
|
|
|
{{- else if (exists "/etc/nginx/vhost.d/default") }}
|
|
|
|
|
include /etc/nginx/vhost.d/default;
|
2022-04-19 21:37:53 +02:00
|
|
|
{{- end }}
|
Add SSL support
This adds SSL support for containers. It supports single host
certificates, wildcards and SNI using naming conventions for
certificates or optionally specify a cert name (for SNI). The SSL
cipher configuration is based on mozilla intermediate profile which
should provide compatibility with clients back to Firefox 1, Chrome 1,
IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7. The
configuration also enables OCSP stapling, HSTS, and ssl session caches.
To enable SSL, nginx-proxy should be started w/ -p 443:443 and -v
/path/to/certs:/etc/nginx/certs. Certificates must be named:
<virtualhost>.crt and <virtualhost>.key where <virtualhost> matches
the a value of VIRTUAL_HOST on a container.
For wildcard certificates, the certificate and private key should be
named after the wildcard domain with .crt and .key suffixes. For example,
*.example.com should be name example.com.crt and example.com.key.
For SNI where a certificate may be used for multiple domain names, the
container can specify a CERT_NAME env var that corresponds to the base
file name of the certificate and key. For example, if you have a cert
allowing *.example.com and *.bar.com, it can be name shared.crt and
shared.key. A container can use that cert by having CERT_NAME=shared and
VIRTUAL_HOST=foo.example.com. The name "shared" is arbitrary and can
be whatever makes sense.
The behavior for the proxy when port 80 and 443 is defined is as
follows:
* If a container has a usable cert, port 80 will redirect to
443 for that container to always prefer HTTPS when available.
* If the container does not have a usable cert 503 will be returned.
In the last case, a self-signed or generic cert can be defined as
"default.crt" and "default.key" which will allow a client browser to
at least make a SSL connection.
2014-11-26 18:38:51 +01:00
|
|
|
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- range $path, $containers := $paths }}
|
2023-01-09 23:21:35 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Get the VIRTUAL_PROTO defined by containers w/ the same
|
|
|
|
|
* vhost-vpath, falling back to "http".
|
|
|
|
|
*/}}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- $proto := trim (or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http") }}
|
|
|
|
|
|
2023-01-09 23:21:35 +01:00
|
|
|
{{- /*
|
|
|
|
|
* Get the NETWORK_ACCESS defined by containers w/ the same vhost,
|
|
|
|
|
* falling back to "external".
|
|
|
|
|
*/}}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- $network_tag := or (first (groupByKeys $containers "Env.NETWORK_ACCESS")) "external" }}
|
|
|
|
|
{{- $upstream := $upstream_name }}
|
|
|
|
|
{{- $dest := "" }}
|
|
|
|
|
{{- if gt $nPaths 0 }}
|
|
|
|
|
{{- $sum := sha1 $path }}
|
|
|
|
|
{{- $upstream = printf "%s-%s" $upstream $sum }}
|
|
|
|
|
{{- $dest = (or (first (groupByKeys $containers "Env.VIRTUAL_DEST")) "") }}
|
|
|
|
|
{{- end }}
|
2023-07-18 22:44:36 +02:00
|
|
|
{{- template "location" (dict
|
|
|
|
|
"Path" $path
|
|
|
|
|
"Proto" $proto
|
|
|
|
|
"Upstream" $upstream
|
|
|
|
|
"Host" $host
|
|
|
|
|
"VhostRoot" $vhost_root
|
|
|
|
|
"Dest" $dest
|
|
|
|
|
"NetworkTag" $network_tag
|
|
|
|
|
"Containers" $containers
|
|
|
|
|
) }}
|
2022-05-17 07:19:32 +02:00
|
|
|
{{- end }}
|
2023-01-19 00:27:35 +01:00
|
|
|
{{- if and (not (contains $paths "/")) (ne $globals.default_root_response "none")}}
|
2022-05-17 07:19:32 +02:00
|
|
|
location / {
|
2023-01-15 04:59:33 +01:00
|
|
|
return {{ $globals.default_root_response }};
|
2022-05-17 07:19:32 +02:00
|
|
|
}
|
|
|
|
|
{{- end }}
|
Add SSL support
This adds SSL support for containers. It supports single host
certificates, wildcards and SNI using naming conventions for
certificates or optionally specify a cert name (for SNI). The SSL
cipher configuration is based on mozilla intermediate profile which
should provide compatibility with clients back to Firefox 1, Chrome 1,
IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7. The
configuration also enables OCSP stapling, HSTS, and ssl session caches.
To enable SSL, nginx-proxy should be started w/ -p 443:443 and -v
/path/to/certs:/etc/nginx/certs. Certificates must be named:
<virtualhost>.crt and <virtualhost>.key where <virtualhost> matches
the a value of VIRTUAL_HOST on a container.
For wildcard certificates, the certificate and private key should be
named after the wildcard domain with .crt and .key suffixes. For example,
*.example.com should be name example.com.crt and example.com.key.
For SNI where a certificate may be used for multiple domain names, the
container can specify a CERT_NAME env var that corresponds to the base
file name of the certificate and key. For example, if you have a cert
allowing *.example.com and *.bar.com, it can be name shared.crt and
shared.key. A container can use that cert by having CERT_NAME=shared and
VIRTUAL_HOST=foo.example.com. The name "shared" is arbitrary and can
be whatever makes sense.
The behavior for the proxy when port 80 and 443 is defined is as
follows:
* If a container has a usable cert, port 80 will redirect to
443 for that container to always prefer HTTPS when available.
* If the container does not have a usable cert 503 will be returned.
In the last case, a self-signed or generic cert can be defined as
"default.crt" and "default.key" which will allow a client browser to
at least make a SSL connection.
2014-11-26 18:38:51 +01:00
|
|
|
}
|
2022-05-17 06:56:06 +02:00
|
|
|
{{- end }}
|
