mirror/ nginx-proxy
1
0
Fork 0
mirror of https://github.com/nginx-proxy/nginx-proxy synced 2024-05-09 09:06:16 +02:00
Code Issues
766 Commits 9 Branches 30 Tags 22 MiB
Commit Graph

766 Commits

Author SHA1 Message Date
Nicolas Duchon 83e3b25c46
Merge pull request #1797 from polarathene/feat/prefer-rfc-7919-dhparams 
feat: Use RFC 7919 DH groups + Remove DH generation
 2021-10-21 08:35:39 +02:00
Nicolas Duchon 36c4ed7632
test: replace test dhparam.pem with ffdhe3072.pem 2021-10-20 21:04:29 +02:00
Nicolas Duchon ab7ac0aadb
fix: backward compatibility w/ DHPARAM_GENERATION 
Also use true rather than 1 to stay consistent
with other boolean environment variables
 2021-10-20 19:15:27 +02:00
Nicolas Duchon 02396e3b58
Merge pull request #1791 from nginx-proxy/dependabot/pip/test/requirements/docker-5.0.3 
chore(deps): bump docker from 5.0.2 to 5.0.3 in /test/requirements
 2021-10-09 19:36:39 +02:00
dependabot[bot] b1b1b700ea
chore(deps): bump docker from 5.0.2 to 5.0.3 in /test/requirements 
Bumps [docker](https://github.com/docker/docker-py) from 5.0.2 to 5.0.3.
- [Release notes](https://github.com/docker/docker-py/releases)
- [Commits](https://github.com/docker/docker-py/compare/5.0.2...5.0.3)

---
updated-dependencies:
- dependency-name: docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-10-08 04:27:38 +00:00
Nicolas Duchon 42cf18734f
Merge pull request #1774 from nginx-proxy/dependabot/docker/nginx-1.21.3 
chore(deps): bump nginx from 1.21.1 to 1.21.3
 2021-09-30 19:17:25 +02:00
polarathene 41bd4076c0 chore: DRY up `test_dhparam.yml` 
Use YAML anchors for repeated values providing a single source of truth.

I would use `x-*` convention to store anchors above service containers, but this seems to require a compose config that defines the services (and version?) keys, which this test setup was failing to be compatible with for some reason..
 2021-09-29 15:20:08 +13:00
polarathene 391ca3e3b5 fix(Dockerfile): Remove `VOLUME` in Dockerfile 
Anonymous volumes are discouraged for reliable persistence.

Users should use named volumes or bind mounts instead. Potentially breaking change, users can also use explicit anonymous volumes instead of relying on implicit anonymous volumes.

`nginx-proxy` really should not be creating implicit anonymous volumes as in most cases it is undesirable.

`git blame` reveals this was added in 2014  by jwilder, with a message that implies implicit anonymous volumes was never intended..
 2021-09-28 21:59:53 +13:00
polarathene 0cd573f043 tests(`pytest.sh`): Update Syntax 
- Added clarification comment of the DIR command
- Quoted `ARGS` usage required wrapping `ARGS` assignment in an array to properly expand. This wasn't broken before, but is required change to keep ShellCheck  lint happy.
- Quote wrapped `DIR` usage, the volume target had an extra `/` before the `DIR` which seems unnecessary as `pwd` should return absolute path.
- Expanded `docker run` options to long-form.
 2021-09-28 21:59:53 +13:00
polarathene e81001615c tests: Improve error handling output and use regular string comparisons 
As this project isn't exactly python focused apart from the test suite, I'll assume other contributors are probably not as experienced with python either. Since this is a rather technical test, the extra comments should help grok the functionality without floundering around with the docs.

When the subprocess raises an exception due to an issue with the command (_eg using `-CAfile` arg to `openssl` with an invalid path_), the tests would output large walls of text that wasn't particularly helpful in troubleshooting the issue. `stderr` was also leaking out inbetween the test case results in the terminal, this has been resolved by ensuring that output is caught and piped, which keeps it available to python when an exception is raised. Identifying the actual error cause and location is now much nicer.

Updated the output to be plain string content instead of byte strings, this works fine :)
 2021-09-28 21:59:53 +13:00
polarathene 1d2f308cdf feat: Bring back ability to skip default DH params 
Adds back the ability to avoid using DH params, provided no file was explicitly supplied.

This used to be `DHPARAM_GENERATION=false`, the equivalent is now `DHPARAM_SKIP=1` (default 0). Previous name was no longer appropriate.

Ensures that if a user has explicitly provided their own dhparam file to still output a warning instead of the skip message, since `DHPARAM_SKIP=1` doesn't disable the support in nginx.
 2021-09-28 21:59:53 +13:00
polarathene fd35a09240 tests: Revise dhparams tests 
- `dhparam_generation` tests are no longer necessary, dropped.

Modified the remaining `dhparam` test to use multiple `nginx-proxy` images to verify correct behavior for different configs.

Tests now cover:

- Default (ffdhe4096) is used.
- Alternative via ENV (ffdhe2048) works correctly.
- Invalid group via ENV (1024-bit) fails.
- Custom DH params provided via file mount works with warning emitted.

---

- `assert_log_contains`: added a `container_name` arg with `nginxproxy` as the default value. This allows multiple nginx-proxy containers to utilize this method instead.

- Extracted out the `openssl` test (_to `negotiate_cipher()`_) and modified it to be a bit more flexible. It now takes a container with optional extra args to pass to `openssl` command called, as well as the `grep` string to match. This made the original test redundant, so I've dropped it.

- Added two methods to use `negotiate_cipher()`, one verifies a DHE cipher suite was negotiated and checks that a DH emphermal key was also mentioned in the output. The other method verifies the expectation of failing to negotiate a valid cipher if DH params have not been set, while verifying that non-DHE cipher suites can be successfully negotiated.

- Added a `get_env()` method for extracting attached environments on a container. This is useful for verifying invalid `DHPARAM_BITS` values (eg `1024`-bit).

- The original `Server Temp Key` assertion was incorrect, it was expecting a value that is unrelated to DHE cipher suite support (_`X25519` is related to ECDHE_). This is due to TLS 1.3 being negotiated where you cannot use custom DH params, nor influence the negotiated cipher due to this mechanism changing from TLS 1.3. TLS 1.3 does support DH params, but it internally negotiates RFC 7919 group between server and client instead. Thus to verify expectations, the connection via `openssl` is made explicitly with TLS 1.2 instead.
 2021-09-28 21:59:53 +13:00
polarathene 9299a2801e tests: Remove dhparam volume 
No longer necessary for the majority of tests.
 2021-09-28 21:50:11 +13:00
polarathene 004e4a5cda chore: Refactor `_setup_dh()` 
- `DHPARAM_FILE` is a local var not intended for overriding via ENV. Clarified that with `local` declaration.

- `FFDHE_GROUP` var uses default assignment (_`:=4096` instead of only substitute `:-4096`_), so that `DHPARAM_BITS` retains the default 4096 value in subsequent references if no custom size was provided.

- Refactored the conditional statements to only handle early failure conditions. Shifting out the RFC7919 support that can run after all checks have passed.

- Revised comments.
 2021-09-28 21:50:11 +13:00
polarathene a7a2d6e44b chore: Use direct URL instead of URL shortener 
Implicit URL is unnecessary (_and presently relies on Github redirecting from it's original mapped URL_).

Use an explicit URL instead to reduce the guesswork/trust of where the shortener was going to redirect to.
 2021-09-28 21:50:11 +13:00
polarathene 6f7eb8bd97 chore: 6/6 - Update shell syntax 
- `==` for string equality since we're using bash `[[ test ]]` already.
- Uppercase `socket_file` variable to be consistent with other internal variables used in the script.
- Convert `[ test ]` to `[[ test ]]` for consistency, improving maintenance. Double-bracket (_not posix compatible_) does not require quoted variables, ShellCheck lint knows this is safe too :)
- `-z` test for `$RESOLVERS` is native syntax to check for empty string value.
- Referenced variables should generally be wrapped like so `"${VAR}"`.
- Variable assignments with string values should be double quotes for content with variables, otherwise use single quotes (_no interpolation_).
- Converted my if statements to use the same style used in the rest of the file.
 2021-09-28 21:50:11 +13:00
polarathene 0f330b85b1 chore: 5/6 - Shift dhparam method to the bottom 
Minor change on error message.
 2021-09-28 21:50:11 +13:00
polarathene ed009c0ec8 chore: 4/6 - Extract grouped logic to their own methods 2021-09-28 21:50:11 +13:00
polarathene 091dd855af chore: 3/6 - Indent function content 
This is a white-space only change to ease review diff noise.
 2021-09-28 21:50:11 +13:00
polarathene 2e6d7561a3 chore: 2/6 - Handle CMD check early, wrap init logic into a function 2021-09-28 21:50:11 +13:00
polarathene 8aacd13241 chore: 1/6 - Inline failure at it's cause 
This change has been split into 6 iterative parts/commits to ease the review process.
 2021-09-28 21:50:11 +13:00
polarathene ac066a73e4 feat: Replace generated DH params with RFC 7919 standardized DHE groups 
- While the anonymous VOLUME can be dropped from Dockerfile, the path needs to be valid at run-time, might as well ensure it's available by creating the dhparam folder at build.

- Generation logic no longer necessary, dropped. 

- Standardized RFC 7919 groups added (2048, 3072, 4096), with 4096-bit remaining the default size. The DH logic can live in the entrypoint script as well. 

- Third-party supplied pre-generated DH params removed as they're not considered trustworthy compared to RFC 7919 groups.
 2021-09-28 21:30:02 +13:00
Nicolas Duchon b133403331
Merge pull request #1775 from kevinnls/patch-1 
fix link
 2021-09-10 16:19:02 +02:00
kevinnls dc9876b6c2
fix anchor 2021-09-10 19:27:33 +05:30
dependabot[bot] 583c71ec3d
chore(deps): bump nginx from 1.21.1 to 1.21.3 
Bumps nginx from 1.21.1 to 1.21.3.

---
updated-dependencies:
- dependency-name: nginx
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-09-10 04:12:34 +00:00
Nicolas Duchon 07abbb4c0d
Merge pull request #1770 from crazy-max/path-context 
Use path context
 2021-09-08 16:05:20 +02:00
CrazyMax 7b489159b3
Use path context 2021-09-08 14:25:56 +02:00
Nicolas Duchon e166a93a56
Merge pull request #1764 from nginx-proxy/dependabot/pip/test/requirements/docker-5.0.2 
chore(deps): bump docker from 5.0.0 to 5.0.2 in /test/requirements
 2021-09-08 12:18:40 +02:00
dependabot[bot] 083d86a79d
chore(deps): bump docker from 5.0.0 to 5.0.2 in /test/requirements 
Bumps [docker](https://github.com/docker/docker-py) from 5.0.0 to 5.0.2.
- [Release notes](https://github.com/docker/docker-py/releases)
- [Commits](https://github.com/docker/docker-py/compare/5.0.0...5.0.2)

---
updated-dependencies:
- dependency-name: docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-09-02 04:18:54 +00:00
Nicolas Duchon 481c5a2318
Merge pull request #1760 from nginx-proxy/python-docker-mod-check 
Ease version check on python docker module for tests
 2021-09-01 14:48:35 +02:00
Nicolas Duchon a1ff28cec8
CI: ease version check on python docker module 2021-09-01 09:31:02 +02:00
Nicolas Duchon 86c194e181
CI: disable fail-fast 2021-09-01 09:16:14 +02:00
Nicolas Duchon 52d208daf3
Merge pull request #1756 from nginx-proxy/dependabot/pip/test/requirements/pytest-6.2.5 
chore(deps): bump pytest from 6.2.4 to 6.2.5 in /test/requirements
 2021-09-01 08:59:38 +02:00
dependabot[bot] 308df38b14
chore(deps): bump pytest from 6.2.4 to 6.2.5 in /test/requirements 
Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.2.4 to 6.2.5.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.2.4...6.2.5)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-08-31 04:22:47 +00:00
Nicolas Duchon 7bb3fd56c6
Merge pull request #1753 from mnahinkhan/patch-1 
Update README.md
 2021-08-30 11:14:37 +02:00
Nahin Khan 7dfee13b56
Update README.md 2021-08-30 06:44:52 +03:00
Nicolas Duchon 8adbea8aec
Merge pull request #1736 from nginx-proxy/predictable-upstream 
Revert to predictable upstream names, optional SHA1 names
 2021-08-19 12:36:13 +02:00
Nicolas Duchon a33af34361
docs: predictable vs SHA1 upstream names 2021-08-19 11:41:30 +02:00
Nicolas Duchon e748ffdce4
feat: sha1 upstream names 2021-08-17 21:51:09 +02:00
Nicolas Duchon d10531e925
tests: predictable upstream names 2021-08-17 21:50:18 +02:00
Nicolas Duchon ded3cfc168
docs: don't prefix copy pastable commands with $ 
+ other small markdown fixes
 2021-08-17 11:29:21 +02:00
Nicolas Duchon eb3bb2ab07
docs: fix line feeds 2021-08-17 11:13:31 +02:00
Nicolas Duchon 0e3844ad1e
Merge pull request #1725 from nginx-proxy/fix-1693 
Use sha1 of hostname as upstream names
 2021-08-11 17:54:29 +02:00
Nicolas Duchon b6bd9e24a8
Merge pull request #1726 from nginx-proxy/dependabot/docker/golang-1.16.7 
chore(deps): bump golang from 1.16.6 to 1.16.7
 2021-08-08 14:10:10 +02:00
dependabot[bot] c36633320e
chore(deps): bump golang from 1.16.6 to 1.16.7 
Bumps golang from 1.16.6 to 1.16.7.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-08-06 04:11:55 +00:00
Nicolas Duchon 89d37882b6
fix: always use sha1 of hostname as upstream name 2021-08-04 22:28:00 +02:00
Nicolas Duchon ba86bc04f6
tests: check for raw IPv4/6 used as VIRTUAL_HOST 2021-08-04 22:25:55 +02:00
Nicolas Duchon 39a59e6168
Merge pull request #1724 from nginx-proxy/dockergen-0.7.7 
Bump docker-gen from 0.7.6 to 0.7.7
 2021-08-04 10:34:55 +02:00
Nicolas Duchon 8526d918ed
style: Dockerfiles linting 2021-08-04 08:49:23 +02:00
Nicolas Duchon 897e4135d3
build: docker-gen 0.7.6 -> 0.7.7 2021-08-04 08:48:25 +02:00