|
| 1 | +apiVersion: v1 |
| 2 | +kind: ConfigMap |
| 3 | +metadata: |
| 4 | + name: {{ template "osf-pigeon.fullname" . }} |
| 5 | + labels: |
| 6 | + app: {{ template "osf-pigeon.name" . }} |
| 7 | + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} |
| 8 | + heritage: {{ .Release.Service }} |
| 9 | + release: {{ .Release.Name }} |
| 10 | +data: |
| 11 | + {{- define "osf-pigeon.inlineconfigs" }} |
| 12 | +nginx.conf: |- |
| 13 | + user nginx; |
| 14 | + worker_processes {{ .Values.nginx.workerCount }}; |
| 15 | +
|
| 16 | + load_module /usr/lib/nginx/modules/ngx_http_brotli_filter_module.so; |
| 17 | + {{- if .Values.nginx.vts.enabled }} |
| 18 | + load_module /usr/lib/nginx/modules/ngx_http_geoip_module.so; |
| 19 | + load_module /usr/lib/nginx/modules/ngx_http_vhost_traffic_status_module.so; |
| 20 | + {{- end }} |
| 21 | +
|
| 22 | + error_log /var/log/nginx/error.log warn; |
| 23 | + pid /var/run/nginx.pid; |
| 24 | +
|
| 25 | + events { |
| 26 | + worker_connections 1024; |
| 27 | + } |
| 28 | +
|
| 29 | + http { |
| 30 | + include /etc/nginx/mime.types; |
| 31 | + default_type application/octet-stream; |
| 32 | +
|
| 33 | + log_format main '$remote_addr - $upstream_cache_status $remote_user [$time_local] ' |
| 34 | + '"$request" $status $body_bytes_sent ' |
| 35 | + '"$http_referer" "$http_user_agent" "$http_x_forwarded_for" ' |
| 36 | + 'rt=$request_time uct="$upstream_connect_time" uht="$upstream_header_time" urt="$upstream_response_time"'; |
| 37 | + access_log /var/log/nginx/access.log main; |
| 38 | +
|
| 39 | + real_ip_header {{ .Values.nginx.realIpHeader }}; |
| 40 | + real_ip_recursive {{ .Values.nginx.realIpRecursive }}; |
| 41 | + {{- range .Values.nginx.proxySourceRanges }} |
| 42 | + set_real_ip_from {{ . }}; |
| 43 | + {{- end }} |
| 44 | +
|
| 45 | + {{- if .Values.nginx.vts.enabled }} |
| 46 | + geoip_country /etc/nginx/GeoIP.dat; |
| 47 | + geoip_city /etc/nginx/GeoLiteCity.dat; |
| 48 | + geoip_proxy_recursive on; |
| 49 | + {{- range .Values.nginx.proxySourceRanges }} |
| 50 | + geoip_proxy {{ . }}; |
| 51 | + {{- end }} |
| 52 | +
|
| 53 | + vhost_traffic_status_zone shared:vhost_traffic_status:{{ .Values.nginx.vts.statusZoneSize }}; |
| 54 | + vhost_traffic_status_filter_by_set_key {{ .Values.nginx.vts.defaultFilterKey }}; |
| 55 | + {{- end }} |
| 56 | +
|
| 57 | + sendfile on; |
| 58 | + tcp_nopush on; |
| 59 | + tcp_nodelay on; |
| 60 | + keepalive_timeout 620s; |
| 61 | + keepalive_requests 10000; |
| 62 | + types_hash_max_size 2048; |
| 63 | + server_tokens off; |
| 64 | +
|
| 65 | + gzip on; |
| 66 | + gzip_proxied any; |
| 67 | + gzip_disable "msie6"; |
| 68 | + gzip_min_length 1400; |
| 69 | + gzip_vary on; |
| 70 | + gzip_buffers 4 32k; |
| 71 | + gzip_types text/plain text/css image/svg+xml application/javascript application/x-javascript text/xml text/javascript application/json application/vnd.api+json; |
| 72 | +
|
| 73 | + brotli on; |
| 74 | + brotli_types text/plain text/css image/svg+xml application/javascript application/x-javascript text/xml text/javascript application/json application/vnd.api+json; |
| 75 | +
|
| 76 | + {{- if .Values.nginx.vts.enabled }} |
| 77 | + server { |
| 78 | + listen {{ .Values.nginx.vts.internalPort }}; |
| 79 | + server_name _; |
| 80 | +
|
| 81 | + location /healthz { |
| 82 | + access_log off; |
| 83 | + return 200; |
| 84 | + } |
| 85 | +
|
| 86 | + location /nginx_status { |
| 87 | + vhost_traffic_status_display; |
| 88 | + vhost_traffic_status_display_format html; |
| 89 | + } |
| 90 | + } |
| 91 | + {{- end }} |
| 92 | +
|
| 93 | + server { |
| 94 | + listen {{ .Values.service.internalPort }}; |
| 95 | + keepalive_timeout 620s; |
| 96 | + client_max_body_size 25M; |
| 97 | + server_name _; |
| 98 | +
|
| 99 | + if ($http_x_forwarded_proto = "http") { |
| 100 | + return 301 https://$host$request_uri; |
| 101 | + } |
| 102 | +
|
| 103 | + location = /healthz { |
| 104 | + access_log off; |
| 105 | + return 200; |
| 106 | + } |
| 107 | +
|
| 108 | + location = /robots.txt { |
| 109 | + alias /usr/share/nginx/html/robots.txt; |
| 110 | + } |
| 111 | +
|
| 112 | + location / { |
| 113 | + # Disable caching of application requests |
| 114 | + add_header Cache-Control "no-cache, no-store, max-age=0, must-revalidate"; |
| 115 | + add_header Expires "Mon, 01 Jan 1990 00:00:00 GMT"; |
| 116 | + add_header Pragma "no-cache"; |
| 117 | +
|
| 118 | + # Mitigate HTTPoxy Vulnerability |
| 119 | + # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/ |
| 120 | + proxy_set_header Proxy ""; |
| 121 | +
|
| 122 | + proxy_buffering off; |
| 123 | + proxy_request_buffering off; |
| 124 | + proxy_set_header Host $host; |
| 125 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 126 | + proxy_pass http://127.0.0.1:{{ .Values.service.externalPort }}; |
| 127 | + } |
| 128 | + } |
| 129 | + } |
| 130 | +{{- end -}} |
| 131 | + {{- range $key, $value := .Values.configEnvs }} |
| 132 | + {{ $key }}: {{ $value | quote }} |
| 133 | + {{- end }} |
| 134 | + {{- range $key, $value := merge .Values.configFiles (include "osf-pigeon.inlineconfigs" . | fromYaml) ((.Files.Glob "files/*").AsConfig | fromYaml) }} |
| 135 | + {{ $key }}: |- |
| 136 | + {{- $value | nindent 4 }} |
| 137 | + {{- end }} |
0 commit comments