othmane/ohif-viewer
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Cleaning up nginx config file and adding notes

Browse Source
This commit is contained in:
dannyrb 2019-05-06 13:03:00 -04:00
parent 915fee5eb0
commit 1d7527c919
1 changed files with 59 additions and 158 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

217
docker/authproxy/config/nginx.conf
View File

@ -1,20 +1,16 @@
## Best: https://edhull.co.uk/blog/2018-06-06/keycloak-nginx
##
##
worker_processes 2; ## Default: 1 worker_processes 2; ## Default: 1
error_log /var/log/nginx/error.log; error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid; pid /var/run/nginx.pid;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic. include /usr/share/nginx/modules/*.conf; # See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
events { events {
# 4096?
worker_connections 1024; ## Default: 1024 worker_connections 1024; ## Default: 1024
use epoll; # use epoll; # http://nginx.org/en/docs/events.html
multi_accept on; # multi_accept on; # http://nginx.org/en/docs/ngx_core_module.html#multi_accept
} }
# Core Modules Docs:
# http://nginx.org/en/docs/http/ngx_http_core_module.html
http { http {
# #
include mime.types; include mime.types;
@ -27,8 +23,6 @@ http {
# lua_ settings # lua_ settings
# #
lua_package_path '/usr/local/openresty/lualib/?.lua;;'; lua_package_path '/usr/local/openresty/lualib/?.lua;;';
# lua_package_path '/opt/openresty/lualib/?.lua;;';
# lua_package_path '/usr/local/share/lua/5.3/?.lua;;';
lua_shared_dict discovery 1m; # cache for discovery metadata documents lua_shared_dict discovery 1m; # cache for discovery metadata documents
lua_shared_dict jwks 1m; # cache for JWKs lua_shared_dict jwks 1m; # cache for JWKs
# lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt; # lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
@ -40,14 +34,10 @@ http {
resolver 8.8.8.8 valid=30s ipv6=off; resolver 8.8.8.8 valid=30s ipv6=off;
resolver_timeout 11s; resolver_timeout 11s;
log_format main 'hi $remote_addr - $remote_user [$time_local] "$request" ' log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" ' '$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"'; '"$http_user_agent" "$http_x_forwarded_for"';
# recommended by other
# include /etc/nginx/conf.d/*.conf;
# index index.html index.htm;
# No idea what this is doing # No idea what this is doing
# https://stackoverflow.com/a/5877989/1867984 # https://stackoverflow.com/a/5877989/1867984
# upstream upstream_server { # upstream upstream_server {
@ -55,38 +45,32 @@ http {
# server 127.0.0.1: # server 127.0.0.1:
# } # }
# Nginx `listener` block per keycloak client # Nginx `listener` block
server { server {
# old
# listen 80 default_server;
# listen [::]:80 default_server;
listen 80 default_server; listen 80 default_server;
# listen 443 ssl; # listen 443 ssl;
# Domain to protect # Domain to protect
server_name localhost 127.0.0.1; # mydomain.co.uk; server_name localhost 127.0.0.1; # mydomain.com;
proxy_intercept_errors off; proxy_intercept_errors off;
# ssl_certificate /etc/letsencrypt/live/mydomain.co.uk/fullchain.pem; # ssl_certificate /etc/letsencrypt/live/mydomain.co.uk/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/mydomain.co.uk/privkey.pem; # ssl_certificate_key /etc/letsencrypt/live/mydomain.co.uk/privkey.pem;
server_tokens off; server_tokens off;
# access_log logs/mydomain.log;
access_log /var/log/nginx/test.com.access.log;
error_log logs/mydomain.error.log;
root /var/www/html;
index index.html index.htm;
lua_code_cache off;
# There is a bug I found with sessions not sticking properly and causing spontaneous 403's
# For now, set the session secret hard-coded
# set $session_secret 723p4hR234t36VsCD8g565325IC0022G;
gzip on; gzip on;
gzip_types text/css application/javascript application/json image/svg+xml; gzip_types text/css application/javascript application/json image/svg+xml;
gzip_comp_level 9; gzip_comp_level 9;
etag on; etag on;
lua_code_cache off;
access_log /var/logs/nginx/mydomain.access.log;
error_log /var/logs/nginx/mydomain.error.log;
# Static content to serve
root /var/www/html;
index index.html index.htm;
# Single Page App # Single Page App
# Try files, fallback to index.html # Try files, fallback to index.html
# #
@ -104,31 +88,39 @@ http {
# [PROTECTED] Reverse Proxy for `orthanc` # [PROTECTED] Reverse Proxy for `orthanc`
# #
location /pacs/ { location /pacs/ {
# Configure auth
# https://github.com/zmartzone/lua-resty-openidc
# https://gist.github.com/alhafoudh/e87392ee60cf14bb33962847f5a84b24
# https://www.jerney.io/secure-apis-kong-keycloak-1/
set $session_check_ssi off; set $session_check_ssi off;
set $session_secret Eeko7aeb6iu5Wohch9Loo1aitha0ahd1; set $session_secret Eeko7aeb6iu5Wohch9Loo1aitha0ahd1;
set $session_storage cookie; set $session_storage cookie;
# Sample configurations:
# https://github.com/zmartzone/lua-resty-openidc#sample-configuration-for-google-signin
# https://gist.github.com/alhafoudh/e87392ee60cf14bb33962847f5a84b24
# https://www.jerney.io/secure-apis-kong-keycloak-1/
access_by_lua_block { access_by_lua_block {
local opts = { local opts = {
redirect_uri = "http://127.0.0.1/callback", redirect_uri = "http://127.0.0.1/callback",
discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration", discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration",
client_id = "pacs", client_id = "pacs",
client_secret = "cd2b3a3c-a6c6-4a37-a15d-b2e5598735b6" client_secret = "cd2b3a3c-a6c6-4a37-a15d-b2e5598735b6"
# accept_none_alg = true,
# ssl_verify = "no",
# redirect_uri_scheme = "http",
# logout_path = "/logout",
# redirect_after_logout_uri = "http://localhost:8080/auth/realms/internal/protocol/openid-connect/logout",
# edirect_after_logout_with_id_token_hint = false,
# session_contents = {id_token=true}
} }
# Call introspect for OAuth 2.0 Bearer Access Token validation
local res, err = require("resty.openidc").authenticate(opts) local res, err = require("resty.openidc").authenticate(opts)
if err then if err then
ngx.status = 200 # Helpful for debugging errors:
ngx.print(err) # ngx.print(err)
ngx.log(ngx.ERR, err) # ngx.log(ngx.ERR, err)
ngx.status = 403
ngx.say(err) ngx.say(err)
ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR) ngx.exit(ngx.HTTP_FORBIDDEN)
end end
ngx.req.set_header("X-User", res.id_token.sub) ngx.req.set_header("X-User", res.id_token.sub)
@ -142,9 +134,24 @@ http {
add_header Cache-Control private; add_header Cache-Control private;
proxy_pass http://orthanc:8042/; proxy_pass http://orthanc:8042/;
# By default, this endpoint is protected by CORS (cross-origin-resource-sharing)
# You can add headers to allow other domains to request this resource.
# See the "Updating CORS Settings" example below
}
# Keycloak
#
location /auth/ {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_pass http://keycloak:8080/auth/;
} }
# EXAMPLE: Reverse Proxy, no auth
# [UNPROTECTED] reverse proxy for `orthanc` # [UNPROTECTED] reverse proxy for `orthanc`
# #
# location /pacs/ { # location /pacs/ {
@ -159,83 +166,9 @@ http {
# # proxy_pass http://orthanc:8042; # # proxy_pass http://orthanc:8042;
# } # }
# EXAMPLE: Modifying headers to allow requests from other domains
# location /pacs-protected/ { # IE. Updating CORS settings
# # Configure auth
# access_by_lua '
# local opts = {
# redirect_uri_path = "/pacs-protected/redirect_uri",
# accept_none_alg = true,
# discovery = "http://localhost:8080/auth/realms/internal/.well-known/openid-configuration",
# client_id = "pacs",
# client_secret = "ba0ea97a-765a-4bf0-a693-7059938f3229",
# ssl_verify = "no",
# redirect_uri_scheme = "http",
# logout_path = "/logout",
# redirect_after_logout_uri = "http://localhost:8080/auth/realms/internal/protocol/openid-connect/logout",
# redirect_after_logout_with_id_token_hint = false,
# session_contents = {id_token=true}
# }
# local res, err = require("resty.openidc").authenticate(opts)
# if err then
# ngx.status = 403
# ngx.say(err)
# ngx.exit(ngx.HTTP_FORBIDDEN)
# end
# ';
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-For $remote_addr;
# proxy_set_header Host $host;
# expires 0;
# add_header Cache-Control private;
# proxy_pass http://orthanc:8042/;
# }
# Keycloak
# #
location /auth/ {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_pass http://keycloak:8080/auth/;
}
# Set `keycloak_endpoint`
# Use `client_id` and `client_secret` generate in keycloak
# access_by_lua '
# local opts = {
# redirect_uri_path = "/redirect_uri",
# accept_none_alg = true,
# discovery = "https://keycloak_endpoint/auth/realms/internal_applications/.well-known/openid-configuration",
# client_id = "elk",
# client_secret = "!!! Set this to the secret from the JSON !!! ",
# ssl_verify = "no",
# redirect_uri_scheme = "https",
# logout_path = "/logout",
# redirect_after_logout_uri = "https://keycloak_endpoint/auth/realms/internal_applications/protocol/openid-connect/logout",
# redirect_after_logout_with_id_token_hint = false,
# session_contents = {id_token=true}
# }
# local res, err = require("resty.openidc").authenticate(opts)
# if err then
# ngx.status = 403
# ngx.say(err)
# ngx.exit(ngx.HTTP_FORBIDDEN)
# end
# ';
# If the user is authenticated, then the normal nginx `proxy_pass`
# redirect will apply as normal
# location /auth
# location / { # location / {
# if ($request_method = 'OPTIONS') { # if ($request_method = 'OPTIONS') {
# add_header 'Access-Control-Allow-Origin' '*'; # add_header 'Access-Control-Allow-Origin' '*';
@ -267,56 +200,24 @@ http {
# add_header 'Access-Control-Allow-Headers' 'Authorization'; # add_header 'Access-Control-Allow-Headers' 'Authorization';
# add_header 'Access-Control-Allow-Credentials' true; # add_header 'Access-Control-Allow-Credentials' true;
# } # }
#
# proxy_pass http://orthanc:8042;
# # proxy_pass http://upstream_server;
# # proxy_http_version 1.1; # # proxy_http_version 1.1;
#
# # proxy_set_header Host $host; # # proxy_set_header Host $host;
# # proxy_set_header X-Real-IP $remote_addr; # # proxy_set_header X-Real-IP $remote_addr;
# # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# # proxy_set_header X-Forwarded-Proto $scheme; # # proxy_set_header X-Forwarded-Proto $scheme;
#
# proxy_pass http://orthanc:8042;
# } # }
# EXAMPLE: Redirect server error pages to the static page /40x.html
# discover & redirect_after_logout_uri
# are hitting keycloak (replace localhost:8888 with host, anmd use correct protocol)
# access_by_lua '
# local opts = {
# redirect_uri_path = "/",
# discovery = "http://localhost:8888/auth/realms/master/.well-known/openid-configuration",
# client_id = "clientID",
# client_secret = "clientSecret",
# redirect_uri_scheme = "https",
# logout_path = "/logout",
# redirect_after_logout_uri = "http://localhost:8888/auth/realms/master/protocol/openid-connect/logout?redirect_uri=http%3A%2F%2Fianbull.com",
# redirect_after_logout_with_id_token_hint = false,
# session_contents = {id_token=true}
# }
# -- call introspect for OAuth 2.0 Bearer Access Token validation
# local res, err = require("resty.openidc").authenticate(opts)
# if err then
# ngx.status = 403
# ngx.say(err)
# ngx.exit(ngx.HTTP_FORBIDDEN)
# end
# ';
# I disbled caching so the browser won't cache the site.
# expires 0;
# add_header Cache-Control private;
# location / {
# }
# redirect server error pages to the static page /40x.html
# #
# error_page 404 /404.html; # error_page 404 /404.html;
# location = /40x.html { # location = /40x.html {
# } # }
# redirect server error pages to the static page /50x.html # EXAMPLE: Redirect server error pages to the static page /50x.html
# #
# error_page 500 502 503 504 /50x.html; # error_page 500 502 503 504 /50x.html;
# location = /50x.html { # location = /50x.html {