From 1d7527c919734716ebad396d11a08293b852178f Mon Sep 17 00:00:00 2001 From: dannyrb Date: Mon, 6 May 2019 13:03:00 -0400 Subject: [PATCH] Cleaning up nginx config file and adding notes --- docker/authproxy/config/nginx.conf | 217 ++++++++--------------------- 1 file changed, 59 insertions(+), 158 deletions(-) diff --git a/docker/authproxy/config/nginx.conf b/docker/authproxy/config/nginx.conf index 68f4ef951..7dc4fc0bf 100644 --- a/docker/authproxy/config/nginx.conf +++ b/docker/authproxy/config/nginx.conf @@ -1,20 +1,16 @@ -## Best: https://edhull.co.uk/blog/2018-06-06/keycloak-nginx -## -## - worker_processes 2; ## Default: 1 error_log /var/log/nginx/error.log; pid /var/run/nginx.pid; -# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. -include /usr/share/nginx/modules/*.conf; +include /usr/share/nginx/modules/*.conf; # See /usr/share/doc/nginx/README.dynamic. events { - # 4096? worker_connections 1024; ## Default: 1024 - use epoll; # - multi_accept on; # + use epoll; # http://nginx.org/en/docs/events.html + multi_accept on; # http://nginx.org/en/docs/ngx_core_module.html#multi_accept } +# Core Modules Docs: +# http://nginx.org/en/docs/http/ngx_http_core_module.html http { # include mime.types; @@ -27,8 +23,6 @@ http { # lua_ settings # lua_package_path '/usr/local/openresty/lualib/?.lua;;'; - # lua_package_path '/opt/openresty/lualib/?.lua;;'; - # lua_package_path '/usr/local/share/lua/5.3/?.lua;;'; lua_shared_dict discovery 1m; # cache for discovery metadata documents lua_shared_dict jwks 1m; # cache for JWKs # lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt; @@ -40,14 +34,10 @@ http { resolver 8.8.8.8 valid=30s ipv6=off; resolver_timeout 11s; - log_format main 'hi $remote_addr - $remote_user [$time_local] "$request" ' + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; - # recommended by other - # include /etc/nginx/conf.d/*.conf; - # index index.html index.htm; - # No idea what this is doing # https://stackoverflow.com/a/5877989/1867984 # upstream upstream_server { @@ -55,38 +45,32 @@ http { # server 127.0.0.1: # } - # Nginx `listener` block per keycloak client + # Nginx `listener` block server { - # old - # listen 80 default_server; - # listen [::]:80 default_server; - listen 80 default_server; # listen 443 ssl; + + # Domain to protect - server_name localhost 127.0.0.1; # mydomain.co.uk; + server_name localhost 127.0.0.1; # mydomain.com; proxy_intercept_errors off; # ssl_certificate /etc/letsencrypt/live/mydomain.co.uk/fullchain.pem; # ssl_certificate_key /etc/letsencrypt/live/mydomain.co.uk/privkey.pem; server_tokens off; - - # access_log logs/mydomain.log; - access_log /var/log/nginx/test.com.access.log; - error_log logs/mydomain.error.log; - - root /var/www/html; - index index.html index.htm; - - lua_code_cache off; - # There is a bug I found with sessions not sticking properly and causing spontaneous 403's - # For now, set the session secret hard-coded - # set $session_secret 723p4hR234t36VsCD8g565325IC0022G; - gzip on; gzip_types text/css application/javascript application/json image/svg+xml; gzip_comp_level 9; etag on; + lua_code_cache off; + + access_log /var/logs/nginx/mydomain.access.log; + error_log /var/logs/nginx/mydomain.error.log; + + # Static content to serve + root /var/www/html; + index index.html index.htm; + # Single Page App # Try files, fallback to index.html # @@ -104,31 +88,39 @@ http { # [PROTECTED] Reverse Proxy for `orthanc` # location /pacs/ { - - # Configure auth - # https://github.com/zmartzone/lua-resty-openidc - # https://gist.github.com/alhafoudh/e87392ee60cf14bb33962847f5a84b24 - # https://www.jerney.io/secure-apis-kong-keycloak-1/ set $session_check_ssi off; set $session_secret Eeko7aeb6iu5Wohch9Loo1aitha0ahd1; set $session_storage cookie; + # Sample configurations: + # https://github.com/zmartzone/lua-resty-openidc#sample-configuration-for-google-signin + # https://gist.github.com/alhafoudh/e87392ee60cf14bb33962847f5a84b24 + # https://www.jerney.io/secure-apis-kong-keycloak-1/ access_by_lua_block { local opts = { redirect_uri = "http://127.0.0.1/callback", discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration", client_id = "pacs", client_secret = "cd2b3a3c-a6c6-4a37-a15d-b2e5598735b6" + # accept_none_alg = true, + # ssl_verify = "no", + # redirect_uri_scheme = "http", + # logout_path = "/logout", + # redirect_after_logout_uri = "http://localhost:8080/auth/realms/internal/protocol/openid-connect/logout", + # edirect_after_logout_with_id_token_hint = false, + # session_contents = {id_token=true} } + # Call introspect for OAuth 2.0 Bearer Access Token validation local res, err = require("resty.openidc").authenticate(opts) if err then - ngx.status = 200 - ngx.print(err) - ngx.log(ngx.ERR, err) + # Helpful for debugging errors: + # ngx.print(err) + # ngx.log(ngx.ERR, err) + ngx.status = 403 ngx.say(err) - ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR) + ngx.exit(ngx.HTTP_FORBIDDEN) end ngx.req.set_header("X-User", res.id_token.sub) @@ -142,9 +134,24 @@ http { add_header Cache-Control private; proxy_pass http://orthanc:8042/; + + # By default, this endpoint is protected by CORS (cross-origin-resource-sharing) + # You can add headers to allow other domains to request this resource. + # See the "Updating CORS Settings" example below + } + + # Keycloak + # + location /auth/ { + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $http_host; + + proxy_pass http://keycloak:8080/auth/; } + # EXAMPLE: Reverse Proxy, no auth # [UNPROTECTED] reverse proxy for `orthanc` # # location /pacs/ { @@ -159,83 +166,9 @@ http { # # proxy_pass http://orthanc:8042; # } - - # location /pacs-protected/ { - - # # Configure auth - # access_by_lua ' - # local opts = { - # redirect_uri_path = "/pacs-protected/redirect_uri", - # accept_none_alg = true, - # discovery = "http://localhost:8080/auth/realms/internal/.well-known/openid-configuration", - # client_id = "pacs", - # client_secret = "ba0ea97a-765a-4bf0-a693-7059938f3229", - # ssl_verify = "no", - # redirect_uri_scheme = "http", - # logout_path = "/logout", - # redirect_after_logout_uri = "http://localhost:8080/auth/realms/internal/protocol/openid-connect/logout", - # redirect_after_logout_with_id_token_hint = false, - # session_contents = {id_token=true} - # } - - # local res, err = require("resty.openidc").authenticate(opts) - - # if err then - # ngx.status = 403 - # ngx.say(err) - # ngx.exit(ngx.HTTP_FORBIDDEN) - # end - # '; - - # proxy_set_header X-Real-IP $remote_addr; - # proxy_set_header X-Forwarded-For $remote_addr; - # proxy_set_header Host $host; - - # expires 0; - # add_header Cache-Control private; - - # proxy_pass http://orthanc:8042/; - # } - - # Keycloak + # EXAMPLE: Modifying headers to allow requests from other domains + # IE. Updating CORS settings # - location /auth/ { - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - - proxy_pass http://keycloak:8080/auth/; - } - - # Set `keycloak_endpoint` - # Use `client_id` and `client_secret` generate in keycloak - # access_by_lua ' - # local opts = { - # redirect_uri_path = "/redirect_uri", - # accept_none_alg = true, - # discovery = "https://keycloak_endpoint/auth/realms/internal_applications/.well-known/openid-configuration", - # client_id = "elk", - # client_secret = "!!! Set this to the secret from the JSON !!! ", - # ssl_verify = "no", - # redirect_uri_scheme = "https", - # logout_path = "/logout", - # redirect_after_logout_uri = "https://keycloak_endpoint/auth/realms/internal_applications/protocol/openid-connect/logout", - # redirect_after_logout_with_id_token_hint = false, - # session_contents = {id_token=true} - # } - # local res, err = require("resty.openidc").authenticate(opts) - - # if err then - # ngx.status = 403 - # ngx.say(err) - # ngx.exit(ngx.HTTP_FORBIDDEN) - # end - # '; - - # If the user is authenticated, then the normal nginx `proxy_pass` - # redirect will apply as normal - - # location /auth # location / { # if ($request_method = 'OPTIONS') { # add_header 'Access-Control-Allow-Origin' '*'; @@ -267,56 +200,24 @@ http { # add_header 'Access-Control-Allow-Headers' 'Authorization'; # add_header 'Access-Control-Allow-Credentials' true; # } - - # proxy_pass http://orthanc:8042; - # # proxy_pass http://upstream_server; + # # # proxy_http_version 1.1; - + # # # proxy_set_header Host $host; # # proxy_set_header X-Real-IP $remote_addr; # # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # # proxy_set_header X-Forwarded-Proto $scheme; + # + # proxy_pass http://orthanc:8042; # } - - - # discover & redirect_after_logout_uri - # are hitting keycloak (replace localhost:8888 with host, anmd use correct protocol) - # access_by_lua ' - # local opts = { - # redirect_uri_path = "/", - # discovery = "http://localhost:8888/auth/realms/master/.well-known/openid-configuration", - # client_id = "clientID", - # client_secret = "clientSecret", - # redirect_uri_scheme = "https", - # logout_path = "/logout", - # redirect_after_logout_uri = "http://localhost:8888/auth/realms/master/protocol/openid-connect/logout?redirect_uri=http%3A%2F%2Fianbull.com", - # redirect_after_logout_with_id_token_hint = false, - # session_contents = {id_token=true} - # } - # -- call introspect for OAuth 2.0 Bearer Access Token validation - # local res, err = require("resty.openidc").authenticate(opts) - # if err then - # ngx.status = 403 - # ngx.say(err) - # ngx.exit(ngx.HTTP_FORBIDDEN) - # end - # '; - - # I disbled caching so the browser won't cache the site. - # expires 0; - # add_header Cache-Control private; - - # location / { - # } - - # redirect server error pages to the static page /40x.html + # EXAMPLE: Redirect server error pages to the static page /40x.html # # error_page 404 /404.html; # location = /40x.html { # } - # redirect server error pages to the static page /50x.html + # EXAMPLE: Redirect server error pages to the static page /50x.html # # error_page 500 502 503 504 /50x.html; # location = /50x.html {