Add OneLab Helm chart, Argo CD Application, and GitOps values for k3s
Made-with: Cursor
This commit is contained in:
timotheereausanofi
174
app/proxy/proxy.conf
Normal file
174
app/proxy/proxy.conf
Normal file
@@ -0,0 +1,174 @@
|
||||
# Load the headers-more module
|
||||
load_module /etc/nginx/modules/ngx_http_headers_more_filter_module.so;
|
||||
|
||||
worker_processes 4;
|
||||
|
||||
events { worker_connections 1024; }
|
||||
|
||||
http {
|
||||
server_names_hash_bucket_size 128;
|
||||
include /etc/nginx/mime.types;
|
||||
|
||||
types {
|
||||
image/svg+xml svg svgz;
|
||||
}
|
||||
|
||||
client_max_body_size 600m;
|
||||
|
||||
# don't send the nginx version number in error pages and Server header
|
||||
server_tokens off;
|
||||
more_set_headers 'Server: OneLab';
|
||||
|
||||
sendfile on;
|
||||
|
||||
resolver 8.8.8.8;
|
||||
|
||||
limit_req_zone $binary_remote_addr zone=proxy_global:10m rate=50r/s;
|
||||
|
||||
upstream onelab {
|
||||
server host.docker.internal:8080;
|
||||
server maintenance:80 backup;
|
||||
}
|
||||
|
||||
# redirect all http traffic to https
|
||||
server {
|
||||
listen 80 default_server;
|
||||
{% if (onelab.services.revproxy.ipv6|default(true)) != false %}
|
||||
listen [::]:80 default_server;
|
||||
{% endif %}
|
||||
server_name {{ onelab.domain[8:] }};
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
include /etc/nginx/custom-http.conf;
|
||||
|
||||
server {
|
||||
listen 443 ssl default_server;
|
||||
{% if (onelab.services.revproxy.ipv6|default(true)) != false %}
|
||||
listen [::]:443 ssl default_server;
|
||||
{% endif %}
|
||||
http2 on;
|
||||
server_name {{ onelab.domain[8:] }};
|
||||
|
||||
ssl_certificate /etc/nginx/ssl/server.pem;
|
||||
ssl_certificate_key /etc/nginx/ssl/server.key;
|
||||
{% if docker_secrets is defined and "ssl_passphrase" in docker_secrets.stdout_lines %}
|
||||
ssl_password_file /run/secrets/ssl_passphrase;
|
||||
{% endif %}
|
||||
# ssl_client_certificate /etc/nginx/ssl/ca.crt;
|
||||
# ssl_verify_client off;
|
||||
|
||||
# enable session resumption to improve https performance
|
||||
# http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
|
||||
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
|
||||
|
||||
# enables server-side protection from BEAST attacks
|
||||
# http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html
|
||||
ssl_prefer_server_ciphers on;
|
||||
# disable SSLv3(enabled by default since nginx 0.8.19) since it's less secure then TLS http://en.wikipedia.org/wiki/Secure_Sockets_Layer#SSL_3.0
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
# ciphers chosen for forward secrecy and compatibility
|
||||
# http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html
|
||||
ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
|
||||
ssl_ecdh_curve X25519:P-384:P-256;
|
||||
|
||||
# enable ocsp stapling (mechanism by which a site can convey certificate revocation information to visitors in a privacy-preserving, scalable manner)
|
||||
# http://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
|
||||
resolver 8.8.8.8 8.8.4.4;
|
||||
ssl_stapling on;
|
||||
ssl_stapling_verify on;
|
||||
ssl_trusted_certificate /etc/nginx/ssl/chain.pem;
|
||||
|
||||
# read more here http://tautt.com/best-nginx-configuration-for-security/
|
||||
# config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
|
||||
# to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
|
||||
# also https://hstspreload.org/
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
|
||||
|
||||
# config to don't allow the browser to render the page inside an frame or iframe
|
||||
# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
|
||||
# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
|
||||
# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
|
||||
add_header X-Frame-Options SAMEORIGIN;
|
||||
|
||||
# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
|
||||
# to disable content-type sniffing on some browsers.
|
||||
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
|
||||
# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
|
||||
# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
|
||||
# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
|
||||
# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
|
||||
# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
|
||||
# this particular website if it was disabled by the user.
|
||||
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
|
||||
# you can tell the browser that it can only download content from the domains you explicitly allow
|
||||
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
|
||||
# https://www.owasp.org/index.php/Content_Security_Policy
|
||||
# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
|
||||
# directives for css and js(if you have inline css or js, you will need to keep it too).
|
||||
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
|
||||
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://app.intercom.io https://widget.intercom.io https://js.intercomcdn.com https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; img-src * data:; media-src *; style-src 'self' 'unsafe-inline' https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; font-src 'self' https://*.intercomcdn.com https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; frame-src *; connect-src 'self' https://*.intercom.io wss://*.intercom.io https://*.intercomcdn.com https://*.intercomcdn.eu https://*.intercomusercontent.com https://*.intercom-messenger.com wss://*.intercom-messenger.com https://*.google-analytics.com https://*.googletagmanager.com https://recaptcha.net https://*.recaptcha.net https://*.gstatic.com; object-src 'none'";
|
||||
|
||||
add_header Referrer-Policy "same-origin";
|
||||
|
||||
add_header Permissions-Policy "accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(self), usb=()";
|
||||
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_min_length 10240;
|
||||
gzip_proxied expired no-cache no-store private auth;
|
||||
gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
gzip_disable "MSIE [1-6]\.";
|
||||
|
||||
root /usr/onelab/;
|
||||
|
||||
include /etc/nginx/custom-server.conf;
|
||||
|
||||
location /not-supported {
|
||||
index not-supported.html not-supported.htm;
|
||||
try_files $uri $uri/ /not-supported.html =404;
|
||||
}
|
||||
|
||||
location /error-404 {
|
||||
index error-404.html error-404.htm;
|
||||
try_files $uri $uri/ /error-404.html =404;
|
||||
}
|
||||
|
||||
# Also used as workaround for a Docker swarm issue
|
||||
# https://github.com/moby/moby/issues/25526
|
||||
# Redirect to HTTP, but assume that we will be on the same server
|
||||
location / {
|
||||
limit_req zone=proxy_global burst=50 nodelay;
|
||||
|
||||
if ($http_user_agent ~* '(MSIE 11.0|MSIE 10.0|MSIE 9.0|MSIE 8.0|MSIE 7.0|MSIE 6.0)') {
|
||||
return 301 https://$host/not-supported;
|
||||
}
|
||||
|
||||
proxy_pass http://onelab;
|
||||
proxy_next_upstream error;
|
||||
proxy_redirect off;
|
||||
proxy_set_header Cookie $http_cookie;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $server_name;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# WebSocket support
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user