Skip to content

Commit 104c316

Browse files
author
Bennett Goble
committed
feat: initial commit
0 parents  commit 104c316

File tree

16 files changed

+1560
-0
lines changed

16 files changed

+1560
-0
lines changed

‎.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.git

‎.editorconfig‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
root = true
2+
3+
[*]
4+
end_of_line = lf
5+
insert_final_newline = true
6+
7+
[*.sh]
8+
indent_style = space
9+
indent_size = 2

‎.gitignore‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
2+
# Created by https://www.toptal.com/developers/gitignore/api/linux,macos,windows,go
3+
# Edit at https://www.toptal.com/developers/gitignore?templates=linux,macos,windows,go
4+
5+
### Go ###
6+
# If you prefer the allow list template instead of the deny list, see community template:
7+
# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
8+
#
9+
# Binaries for programs and plugins
10+
*.exe
11+
*.exe~
12+
*.dll
13+
*.so
14+
*.dylib
15+
16+
# Test binary, built with `go test -c`
17+
*.test
18+
19+
# Output of the go coverage tool, specifically when used with LiteIDE
20+
*.out
21+
22+
# Dependency directories (remove the comment below to include it)
23+
# vendor/
24+
25+
# Go workspace file
26+
go.work
27+
28+
### Go Patch ###
29+
/vendor/
30+
/Godeps/
31+
32+
### Linux ###
33+
*~
34+
35+
# temporary files which can be created if a process still has a handle open of a deleted file
36+
.fuse_hidden*
37+
38+
# KDE directory preferences
39+
.directory
40+
41+
# Linux trash folder which might appear on any partition or disk
42+
.Trash-*
43+
44+
# .nfs files are created when an open file is removed but is still being accessed
45+
.nfs*
46+
47+
### macOS ###
48+
# General
49+
.DS_Store
50+
.AppleDouble
51+
.LSOverride
52+
53+
# Icon must end with two \r
54+
Icon
55+
56+
57+
# Thumbnails
58+
._*
59+
60+
# Files that might appear in the root of a volume
61+
.DocumentRevisions-V100
62+
.fseventsd
63+
.Spotlight-V100
64+
.TemporaryItems
65+
.Trashes
66+
.VolumeIcon.icns
67+
.com.apple.timemachine.donotpresent
68+
69+
# Directories potentially created on remote AFP share
70+
.AppleDB
71+
.AppleDesktop
72+
Network Trash Folder
73+
Temporary Items
74+
.apdisk
75+
76+
### Windows ###
77+
# Windows thumbnail cache files
78+
Thumbs.db
79+
Thumbs.db:encryptable
80+
ehthumbs.db
81+
ehthumbs_vista.db
82+
83+
# Dump file
84+
*.stackdump
85+
86+
# Folder config file
87+
[Dd]esktop.ini
88+
89+
# Recycle Bin used on file shares
90+
$RECYCLE.BIN/
91+
92+
# Windows Installer files
93+
*.cab
94+
*.msi
95+
*.msix
96+
*.msm
97+
*.msp
98+
99+
# Windows shortcuts
100+
*.lnk
101+
102+
# End of https://www.toptal.com/developers/gitignore/api/linux,macos,windows,go
103+
test/test

‎Dockerfile‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
############
2+
# Base
3+
############
4+
FROM artifactory.secondlife.io/dockerhub/alpine:3 AS base
5+
RUN apk add --no-cache \
6+
bash \
7+
nginx \
8+
nginx-mod-http-headers-more
9+
COPY src /
10+
ENV LISTEN_PORT=80
11+
EXPOSE 80
12+
STOPSIGNAL SIGQUIT
13+
ENTRYPOINT ["/docker-entrypoint.sh"]
14+
CMD ["nginx", "-g", "daemon off;"]
15+
16+
############
17+
# Run tests
18+
############
19+
FROM base AS test
20+
RUN apk add --no-cache curl go
21+
COPY test /test
22+
WORKDIR /test
23+
RUN /test/test.sh
24+
25+
############
26+
# Final
27+
############
28+
FROM base

‎README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# nginx-proxy
2+
3+
A reverse proxy container with safe defaults for production environments.
4+
5+
## Use
6+
7+
Pair nginx-proxy with your favorite upstream server (wsgi, uwsgi, asgi, et al.)
8+
9+
| Environment Variable | Description | Required | Default | Example |
10+
|----------------------|-------------|----------|---------|---------|
11+
| `PROXY_REVERSE_URL` | Upstream server URL | Yes | | http://myapp:8080 |
12+
| `LISTEN_PORT` | Server port | Yes | 8080 | |
13+
| `SILENT` | Silence entrypoint output | No | | |
14+
15+
## Development
16+
17+
A test suite is baked into nginx-proxy's Dockerfile. You can run it by building
18+
the test layer: `docker build --target test .`
19+
20+
[nginx container]: https://hub.docker.com/_/nginx
21+
[mo]: https://github.com/tests-always-included/mo
22+
23+
### Differences from standard nginx container
24+
25+
Notable differences from the official [nginx container][]
26+
27+
- [mo][] is used to render nginx configuration templates so that image startup
28+
is aborted if a template variable is missing. This is an improvement over the
29+
official image, which uses `envsubst`.
30+
- alpine's official nginx package is used in order to ensure compatibility with
31+
distro-provided nginx modules. This is another enhancement, as the official
32+
image cannot be used with alpine's nginx modules.

‎src/docker-entrypoint.d/00-render-templates.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
3+
set -eo pipefail
4+
5+
source /docker-entrypoint.d/functions
6+
7+
for f in /etc/nginx/templates/*.template
8+
do
9+
final=$(basename "$f")
10+
final=${final%.template}
11+
final="/etc/nginx/conf.d/$final"
12+
cat "$f" | mo --fail-not-set --fail-on-function > "$final"
13+
log "$0: Rendered $f and moved it to $final"
14+
done

‎src/docker-entrypoint.d/functions‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
3+
# Shared functions for docker-entrypoint.d scripts
4+
5+
log() {
6+
if [ -z "$SILENT" ]; then
7+
echo "$(basename $0) $@"
8+
fi
9+
}

‎src/docker-entrypoint.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
run-parts --exit-on-error /docker-entrypoint.d
6+
7+
exec "$@"

‎src/etc/nginx/conf.d/00-log-format.conf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
log_format json_analytics escape=json '{'
2+
'"msec": "$msec", ' # request unixtime in seconds with a milliseconds resolution
3+
'"connection": "$connection", ' # connection serial number
4+
'"connection_requests": "$connection_requests", ' # number of requests made in connection
5+
'"pid": "$pid", ' # process pid
6+
'"request_id": "$request_id", ' # unique request id
7+
'"request_length": "$request_length", ' # request length (including headers and body)
8+
'"remote_addr": "$remote_addr", ' # client IP
9+
'"remote_user": "$remote_user", ' # client HTTP username
10+
'"remote_port": "$remote_port", ' # client port
11+
'"time_local": "$time_local", '
12+
'"time_iso8601": "$time_iso8601", ' # local time in the ISO 8601 standard format
13+
'"request": "$request", ' # full path no arguments if the request
14+
'"request_uri": "$request_uri", ' # full path and arguments if the request
15+
'"args": "$args", ' # args
16+
'"status": "$status", ' # response status code
17+
'"body_bytes_sent": "$body_bytes_sent", ' # number of body bytes exclude headers sent to a client
18+
'"bytes_sent": "$bytes_sent", ' # number of bytes sent to a client
19+
'"http_referer": "$http_referer", ' # HTTP referer
20+
'"http_user_agent": "$http_user_agent", ' # user agent
21+
'"http_x_forwarded_for": "$http_x_forwarded_for", ' # http_x_forwarded_for
22+
'"http_host": "$http_host", ' # request Host: header
23+
'"server_name": "$server_name", ' # name of the vhost serving the request
24+
'"request_time": "$request_time", ' # request processing time in seconds with msec resolution
25+
'"upstream": "$upstream_addr", ' # upstream backend server for proxied requests
26+
'"upstream_connect_time": "$upstream_connect_time", ' # upstream handshake time incl. TLS
27+
'"upstream_header_time": "$upstream_header_time", ' # time spent receiving upstream headers
28+
'"upstream_response_time": "$upstream_response_time", ' # time spend receiving upstream body
29+
'"upstream_response_length": "$upstream_response_length", ' # upstream response length
30+
'"upstream_cache_status": "$upstream_cache_status", ' # cache HIT/MISS where applicable
31+
'"ssl_protocol": "$ssl_protocol", ' # TLS protocol
32+
'"ssl_cipher": "$ssl_cipher", ' # TLS cipher
33+
'"scheme": "$scheme", ' # http or https
34+
'"request_method": "$request_method", ' # request method
35+
'"server_protocol": "$server_protocol", ' # request protocol, like HTTP/1.1 or HTTP/2.0
36+
'"pipe": "$pipe", ' # "p" if request was pipelined, "." otherwise
37+
'"gzip_ratio": "$gzip_ratio", '
38+
'"http_cf_ray": "$http_cf_ray",'
39+
'}';

‎src/etc/nginx/nginx.conf‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
user nginx;
2+
worker_processes auto;
3+
4+
error_log /dev/stderr;
5+
pid /var/run/nginx.pid;
6+
7+
# Used to zap Server header
8+
load_module /usr/lib/nginx/modules/ngx_http_headers_more_filter_module.so;
9+
10+
events {
11+
worker_connections 1024;
12+
}
13+
14+
http {
15+
include /etc/nginx/mime.types;
16+
default_type application/octet-stream;
17+
18+
# log_format main '$remote_addr - $remote_user [$time_local] "$request" '
19+
# '$status $body_bytes_sent "$http_referer" '
20+
# '"$http_user_agent" "$http_x_forwarded_for"';
21+
22+
#access_log /var/log/nginx/access.log main;
23+
24+
#sendfile on;
25+
#tcp_nopush on;
26+
27+
keepalive_timeout 65;
28+
#gzip on;
29+
30+
# Don't leak information about this server.
31+
server_tokens off;
32+
33+
# Disable etag
34+
etag off;
35+
36+
# Lower buffer size to possibly prevent DoS attacks and buffer overflow vulnerabilities.
37+
client_body_buffer_size 1k;
38+
client_header_buffer_size 1k;
39+
40+
# Nuke some headers we don't want leaking out
41+
more_clear_headers "X-Powered-By";
42+
more_clear_headers "X-Rack-Cache";
43+
more_clear_headers "X-Runtime";
44+
45+
# Nuke 'Server' header which is aggresively set on noncommercial nginx distributions
46+
# http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
47+
# https://github.com/openresty/headers-more-nginx-module
48+
more_clear_headers "Server";
49+
more_clear_headers "server";
50+
51+
include /etc/nginx/conf.d/*.conf;
52+
53+
# For docker logs to work, we need to output to stdout/stderr
54+
access_log /dev/stdout json_analytics;
55+
}

0 commit comments

Comments
 (0)