Use standard nginx.conf from lsio alpine nginx base image

2026-03-26 16:06:31 +09:00 · 2021-10-14 14:01:48 -05:00
parent e6628f05c3
commit 6123952de7
36 changed files with 520 additions and 837 deletions
--- a/root/defaults/nginx/authelia-location.conf.sample
+++ b/root/defaults/nginx/authelia-location.conf.sample
@@ -0,0 +1,15 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-location.conf.sample
+# Make sure that your authelia container is in the same user defined bridge network and is named authelia
+# Make sure that the authelia configuration.yml has 'path: "authelia"' defined
+
+auth_request /authelia/api/verify;
+auth_request_set $target_url $scheme://$http_host$request_uri;
+auth_request_set $user $upstream_http_remote_user;
+auth_request_set $groups $upstream_http_remote_groups;
+auth_request_set $name $upstream_http_remote_name;
+auth_request_set $email $upstream_http_remote_email;
+proxy_set_header Remote-User $user;
+proxy_set_header Remote-Groups $groups;
+proxy_set_header Remote-Name $name;
+proxy_set_header Remote-Email $email;
+error_page 401 =302 https://$http_host/authelia/?rd=$target_url;
--- a/root/defaults/nginx/authelia-server.conf.sample
+++ b/root/defaults/nginx/authelia-server.conf.sample
@@ -0,0 +1,31 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authelia-server.conf.sample
+# Make sure that your authelia container is in the same user defined bridge network and is named authelia
+
+location ^~ /authelia {
+
+    set $upstream_app authelia;
+    set $upstream_port 9091;
+    set $upstream_proto http;
+    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+}
+
+location = /authelia/api/verify {
+    internal;
+    if ($request_uri ~ [^a-zA-Z0-9_+-=\!@$%&*?~.:#'\;\(\)\[\]]) {
+        return 401;
+    }
+
+    set $upstream_app authelia;
+    set $upstream_port 9091;
+    set $upstream_proto http;
+    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
+
+    # Timeout if the real server is dead
+    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+    client_body_buffer_size 128k;
+    proxy_buffers 4 32k;
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    send_timeout 5m;
+}
--- a/root/defaults/nginx/error_pages.conf.sample
+++ b/root/defaults/nginx/error_pages.conf.sample
@@ -0,0 +1,6 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/error_pages.conf.sample
+
+error_page 502 = @lsio_error_502;
+location @lsio_error_502 {
+    alias /config/www/502.html;
+}
--- a/root/defaults/nginx/ldap-location.conf.sample
+++ b/root/defaults/nginx/ldap-location.conf.sample
@@ -0,0 +1,4 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/ldap-location.conf.sample
+
+auth_request /auth;
+error_page 401 =200 /ldaplogin;
--- a/root/defaults/nginx/ldap-server.conf.sample
+++ b/root/defaults/nginx/ldap-server.conf.sample
@@ -0,0 +1,90 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/ldap-server.conf.sample
+## this conf is meant to be used in conjunction with our ldap-auth image: https://github.com/linuxserver/docker-ldap-auth
+## see the heimdall example in the default site config for info on enabling ldap auth
+## for further instructions on this conf, see https://github.com/nginxinc/nginx-ldap-auth
+
+location /ldaplogin {
+
+    set $upstream_auth_app ldap-auth;
+    set $upstream_auth_port 9000;
+    set $upstream_auth_proto http;
+    proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
+    proxy_set_header X-Target $request_uri;
+}
+
+location = /auth {
+
+    set $upstream_auth_app ldap-auth;
+    set $upstream_auth_port 8888;
+    set $upstream_auth_proto http;
+    proxy_pass $upstream_auth_proto://$upstream_auth_app:$upstream_auth_port;
+
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+
+    #Before enabling the below caching options, make sure you have the line "proxy_cache_path cache/ keys_zone=auth_cache:10m;" at the bottom your default site config
+    #proxy_cache auth_cache;
+    #proxy_cache_valid 200 10m;
+    #proxy_cache_key "$http_authorization$cookie_nginxauth";
+
+    # As implemented in nginx-ldap-auth-daemon.py, the ldap-auth daemon
+    # communicates with a LDAP server, passing in the following
+    # parameters to specify which user account to authenticate. To
+    # eliminate the need to modify the Python code, this file contains
+    # 'proxy_set_header' directives that set the values of the
+    # parameters. Set or change them as instructed in the comments.
+    #
+    #    Parameter      Proxy header
+    #    -----------    ----------------
+    #    url            X-Ldap-URL
+    #    starttls       X-Ldap-Starttls
+    #    basedn         X-Ldap-BaseDN
+    #    binddn         X-Ldap-BindDN
+    #    bindpasswd     X-Ldap-BindPass
+    #    cookiename     X-CookieName
+    #    realm          X-Ldap-Realm
+    #    template       X-Ldap-Template
+    # (Required) Set the URL and port for connecting to the LDAP server,
+    # by replacing 'example.com'.
+    # Do not mix ldaps-style URL and X-Ldap-Starttls as it will not work.
+    proxy_set_header X-Ldap-URL "ldap://example.com";
+
+    # (Optional) Establish a TLS-enabled LDAP session after binding to the
+    # LDAP server.
+    # This is the 'proper' way to establish encrypted TLS connections, see
+    # http://www.openldap.org/faq/data/cache/185.html
+    #proxy_set_header X-Ldap-Starttls "true";
+
+    # (Required) Set the Base DN, by replacing the value enclosed in
+    # double quotes.
+    proxy_set_header X-Ldap-BaseDN "cn=Users,dc=test,dc=local";
+
+    # (Required) Set the Bind DN, by replacing the value enclosed in
+    # double quotes.
+    # If AD, use "root@test.local"
+    proxy_set_header X-Ldap-BindDN "cn=root,dc=test,dc=local";
+
+    # (Required) Set the Bind password, by replacing 'secret'.
+    proxy_set_header X-Ldap-BindPass "secret";
+
+    # (Required) The following directives set the cookie name and pass
+    # it, respectively. They are required for cookie-based
+    # authentication. Comment them out if using HTTP basic
+    # authentication.
+    proxy_set_header X-CookieName "nginxauth";
+    proxy_set_header Cookie nginxauth=$cookie_nginxauth;
+
+    # (Required if using Microsoft Active Directory as the LDAP server)
+    # Set the LDAP template by uncommenting the following directive.
+    #proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
+
+    # (Optional if using OpenLDAP as the LDAP server) Set the LDAP
+    # template by uncommenting the following directive and replacing
+    # '(cn=%(username)s)' which is the default set in
+    # nginx-ldap-auth-daemon.py.
+    #proxy_set_header X-Ldap-Template "(cn=%(username)s)";
+    # (Optional) Set the realm name, by uncommenting the following
+    # directive and replacing 'Restricted' which is the default set
+    # in nginx-ldap-auth-daemon.py.
+    #proxy_set_header X-Ldap-Realm    "Restricted";
+}
--- a/root/defaults/nginx/proxy.conf.sample
+++ b/root/defaults/nginx/proxy.conf.sample
@@ -0,0 +1,37 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
+
+include /config/nginx/error_pages.conf;
+
+# Timeout if the real server is dead
+proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+# Proxy Connection Settings
+proxy_buffers 32 4k;
+proxy_connect_timeout 240;
+proxy_headers_hash_bucket_size 128;
+proxy_headers_hash_max_size 1024;
+proxy_http_version 1.1;
+proxy_read_timeout 240;
+proxy_redirect http:// $scheme://;
+proxy_send_timeout 240;
+
+# Proxy Cache and Cookie Settings
+proxy_cache_bypass $cookie_session;
+#proxy_cookie_path / "/; Secure"; # enable at your own risk, may break certain apps
+proxy_no_cache $cookie_session;
+
+# Proxy Header Settings
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Early-Data $ssl_early_data;
+proxy_set_header Host $host;
+proxy_set_header Proxy "";
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Host $host:$server_port;
+proxy_set_header X-Forwarded-Method $request_method;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Forwarded-Server $host;
+proxy_set_header X-Forwarded-Ssl on;
+proxy_set_header X-Forwarded-Uri $request_uri;
+proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+proxy_set_header X-Real-IP $remote_addr;
--- a/root/defaults/nginx/site-confs/default.conf.sample
+++ b/root/defaults/nginx/site-confs/default.conf.sample
@@ -0,0 +1,66 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
+
+include /config/nginx/error_pages.conf;
+
+# redirect all traffic to https
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+# main server block
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name _;
+
+    root /config/www;
+    index index.html index.htm index.php;
+
+    include /config/nginx/error_pages.conf;
+
+    # enable subfolder method reverse proxy confs
+    include /config/nginx/proxy-confs/*.subfolder.conf;
+
+    # enable for ldap auth (requires ldap-location.conf in the location block)
+    #include /config/nginx/ldap-server.conf;
+
+    # enable for Authelia (requires authelia-location.conf in the location block)
+    #include /config/nginx/authelia-server.conf;
+
+    location / {
+        # enable for basic auth
+        #auth_basic "Restricted";
+        #auth_basic_user_file /config/nginx/.htpasswd;
+
+        # enable for ldap auth (requires ldap-server.conf in the server block)
+        #include /config/nginx/ldap-location.conf;
+
+        # enable for Authelia (requires authelia-server.conf in the server block)
+        #include /config/nginx/authelia-location.conf;
+
+        try_files $uri $uri/ /index.html /index.php?$args =404;
+    }
+
+    location ~ ^(.+\.php)(.*)$ {
+        fastcgi_split_path_info ^(.+\.php)(.*)$;
+        fastcgi_pass 127.0.0.1:9000;
+        fastcgi_index index.php;
+        include /etc/nginx/fastcgi_params;
+    }
+
+    # deny access to .htaccess/.htpasswd files
+    location ~ /\.ht {
+        deny all;
+    }
+}
+
+# enable subdomain method reverse proxy confs
+include /config/nginx/proxy-confs/*.subdomain.conf;
+# enable proxy cache for auth
+proxy_cache_path cache/ keys_zone=auth_cache:10m;