Commit e0d27d99 authored by Valian's avatar Valian
Browse files

support for BACKENDS environment variable for the most common use case

parent 538bf902
......@@ -12,7 +12,9 @@ RUN apk --no-cache add bash openssl \
-subj '/CN=sni-support-required-for-valid-ssl' \
-keyout /etc/ssl/resty-auto-ssl-fallback.key \
-out /etc/ssl/resty-auto-ssl-fallback.crt \
&& openssl dhparam -out /usr/local/openresty/nginx/conf/dhparam.pem 2048
&& openssl dhparam -out /usr/local/openresty/nginx/conf/dhparam.pem 2048 \
# let's remove default open resty configuration, we'll conditionally add modified version in entrypoint.sh
&& rm /etc/nginx/conf.d/default.conf
COPY nginx.conf snippets /usr/local/openresty/nginx/conf/
COPY entrypoint.sh /entrypoint.sh
......
#!/bin/sh
#!/bin/bash
RESTY_CONF_DIR="/usr/local/openresty/nginx/conf"
NGINX_CONF_DIR="/etc/nginx/conf.d"
# openresty will change it later on his own, right now we're just giving it access
chmod 777 /etc/resty-auto-ssl
......@@ -8,11 +11,48 @@ if [ ! -f "/etc/resty-auto-ssl/dhparam.pem" ]; then
if [ -n "$DIFFIE_HELLMAN" ]; then
openssl dhparam -out /etc/resty-auto-ssl/dhparam.pem 2048
else
cp /usr/local/openresty/nginx/conf/dhparam.pem /etc/resty-auto-ssl/dhparam.pem
cp ${RESTY_CONF_DIR}/dhparam.pem /etc/resty-auto-ssl/dhparam.pem
fi
fi
envsubst '$ALLOWED_DOMAINS' < /usr/local/openresty/nginx/conf/resty-http.conf > /usr/local/openresty/nginx/conf/resty-http.conf.copy
mv /usr/local/openresty/nginx/conf/resty-http.conf.copy /usr/local/openresty/nginx/conf/resty-http.conf
# if $BACKENDS is defined, we should prepare configuration files
# example usage:
#
# -e BACKENDS="db.example.com=localhost:5432;app.example.com=http://localhost:8080"
#
# it will create 2 files:
#
# 1. /etc/nginx/conf.d/db.example.com.conf using $SERVER_ENDPOINT=localhost:5432 and $SERVER_NAME=db.example.com
# 2. /etc/nginx/conf.d/app.example.com.conf using $SERVER_ENDPOINT=localhost:8080 and $SERVER_NAME=app.example.com
if [ -n "$BACKENDS" ]; then
# lets read all backends, separated by ';'
IFS=\; read -a BACKENDS_SEPARATED <<<"$BACKENDS"
# for each backend (in form of server_name=endpoint:port) we create proper file
for NAME_EQ_ENDPOINT in "${BACKENDS_SEPARATED[@]}"; do
RAW_SERVER_ENDPOINT=${NAME_EQ_ENDPOINT#*=}
export SERVER_NAME=${NAME_EQ_ENDPOINT%=*}
export SERVER_ENDPOINT=${RAW_SERVER_ENDPOINT#*//} # it clears url scheme, like http:// or https://
envsubst '$SERVER_NAME $SERVER_ENDPOINT' \
< ${RESTY_CONF_DIR}/server-backend.conf \
> ${NGINX_CONF_DIR}/${SERVER_NAME}.conf
done
unset SERVER_NAME SERVER_ENDPOINT
# if $BACKENDS isn't defined, let's check if $NGINX_CONF_DIR is empty
elif [ ! "$(ls -A ${NGINX_CONF_DIR})" ]; then
# if yes, just copy default server (similar to default from docker-openresty, but using https)
cp ${RESTY_CONF_DIR}/server-default.conf ${NGINX_CONF_DIR}/default.conf
fi
# let's substitute $ALLOWED_DOMAINS into OpenResty configuration
envsubst '$ALLOWED_DOMAINS' \
< ${RESTY_CONF_DIR}/resty-http.conf \
> ${RESTY_CONF_DIR}/resty-http.conf.copy \
&& mv ${RESTY_CONF_DIR}/resty-http.conf.copy ${RESTY_CONF_DIR}/resty-http.conf
exec "$@"
\ No newline at end of file
......@@ -4,14 +4,11 @@ events {
http {
include resty-http.conf;
server {
listen 443 ssl;
include mime.types;
default_type application/octet-stream;
sendfile on;
include ssl.conf;
include resty-server-https.conf;
}
include resty-http.conf;
server {
listen 80 default_server;
......@@ -19,4 +16,5 @@ http {
include resty-server-http.conf;
}
include /etc/nginx/conf.d/*.conf;
}
\ No newline at end of file
......@@ -4,4 +4,6 @@ ssl_certificate_by_lua_block {
}
ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
\ No newline at end of file
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
include ssl.conf;
\ No newline at end of file
# this configuration will be used for each server
# specified using $BACKENDS variable
# more in README
server {
listen 443 ssl;
server_name $SERVER_NAME;
include resty-server-https.conf;
location / {
proxy_pass http://$SERVER_ENDPOINT;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
\ No newline at end of file
# default open resty blank configuration, just to show that it's working
server {
listen 443 ssl default_server;
include resty-server-https.conf;
error_page 500 502 503 504 /50x.html;
location / {
root /usr/local/openresty/nginx/html;
index index.html index.htm;
}
location = /50x.html {
root /usr/local/openresty/nginx/html;
}
}
\ No newline at end of file
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment