Skip to content

Commit 3c22348

Browse files
tgxworldtgxworld
authored
Revert "Use Nginx config with outlets (#913)" (#958)
This reverts commit 7b042d6. `web.socketed.template.yml` is broken
1 parent 7b042d6 commit 3c22348

10 files changed

+113
-97
lines changed

‎samples/standalone.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ templates:
1111
- "templates/postgres.template.yml"
1212
- "templates/redis.template.yml"
1313
- "templates/web.template.yml"
14+
## Uncomment the next line to enable the IPv6 listener
15+
#- "templates/web.ipv6.template.yml"
1416
- "templates/web.ratelimited.template.yml"
1517
## Uncomment these two lines if you wish to add Lets Encrypt (https)
1618
#- "templates/web.ssl.template.yml"

‎samples/web_only.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33

44
templates:
55
- "templates/web.template.yml"
6+
## Uncomment the next line to enable the IPv6 listener
7+
#- "templates/web.ipv6.template.yml"
68
- "templates/web.ratelimited.template.yml"
79
## Uncomment these two lines if you wish to add Lets Encrypt (https)
810
#- "templates/web.ssl.template.yml"

‎templates/offline-page.template.yml‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,17 @@ params:
77
offline_page_repository: https://github.com/discourse/discourse-offline-page.git
88

99
run:
10-
- file:
11-
path: "/etc/nginx/conf.d/outlets/server/30-offline-page.conf"
12-
contents: |
13-
error_page 502 /error_page.html;
14-
location /error_page.html {
15-
root /var/www/discourse-offline-page/html;
16-
internal;
17-
}
10+
- replace:
11+
filename: "/etc/nginx/conf.d/discourse.conf"
12+
global: true
13+
from: /server.+{/
14+
to: |
15+
server {
16+
error_page 502 /error_page.html;
17+
location /error_page.html {
18+
root /var/www/discourse-offline-page/html;
19+
internal;
20+
}
1821
1922
- exec:
2023
cmd: git clone $offline_page_repository /var/www/discourse-offline-page

‎templates/sshd.template.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,2 @@
11
# This file is deprecated; you can remove it from your app.yml
2-
# TODO(2026-01-01): Remove this file
32
run:
4-
- exec: |-
5-
echo "Deprecation warning: sshd is no longer supported"
6-
echo "Remove templates/sshd.template.yml from your containers/*.yml files"

‎templates/web.ipv6.template.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
1-
# This file is deprecated; you can remove it from your app.yml
2-
# TODO(2026-01-01): Remove this file
31
run:
4-
- exec: |-
5-
echo "Deprecation warning: IPv6 is enabled by default when possible"
6-
echo "Remove templates/web.ipv6.template.yml from your containers/*.yml files"
2+
- exec: echo "Enabling IPv6 listener"
3+
- replace:
4+
filename: "/etc/nginx/conf.d/discourse.conf"
5+
from: listen 80;
6+
to: |
7+
listen 80;
8+
listen [::]:80;

‎templates/web.letsencrypt.ssl.template.yml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -107,21 +107,27 @@ hooks:
107107
/usr/sbin/nginx -c /etc/nginx/letsencrypt.conf -s stop
108108
109109
- replace:
110-
filename: /shared/letsencrypt/account.conf
111-
from: /#?ACCOUNT_EMAIL=.+/
112-
to: |
113-
ACCOUNT_EMAIL=$$ENV_LETSENCRYPT_ACCOUNT_EMAIL
114-
115-
- replace:
116-
filename: "/etc/nginx/conf.d/outlets/server/20-https.conf"
110+
filename: "/etc/nginx/conf.d/discourse.conf"
117111
from: /ssl_certificate.+/
118112
to: |
119113
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer;
120114
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.cer;
121115
122116
- replace:
123-
filename: "/etc/nginx/conf.d/outlets/server/20-https.conf"
117+
filename: /shared/letsencrypt/account.conf
118+
from: /#?ACCOUNT_EMAIL=.+/
119+
to: |
120+
ACCOUNT_EMAIL=$$ENV_LETSENCRYPT_ACCOUNT_EMAIL
121+
122+
- replace:
123+
filename: "/etc/nginx/conf.d/discourse.conf"
124124
from: /ssl_certificate_key.+/
125125
to: |
126126
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.key;
127127
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.key;
128+
129+
- replace:
130+
filename: "/etc/nginx/conf.d/discourse.conf"
131+
from: /add_header.+/
132+
to: |
133+
add_header Strict-Transport-Security 'max-age=63072000';

‎templates/web.ratelimited.template.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,21 @@ params:
66
conn_per_ip: 20
77

88
run:
9-
- file:
10-
path: "/etc/nginx/conf.d/outlets/before-server/30-ratelimited.conf"
11-
contents: |
9+
- replace:
10+
filename: "/etc/nginx/conf.d/discourse.conf"
11+
from: /server.+{/
12+
to: |
1213
limit_req_zone $binary_remote_addr zone=flood:10m rate=$reqs_per_secondr/s;
1314
limit_req_zone $binary_remote_addr zone=bot:10m rate=$reqs_per_minuter/m;
1415
limit_req_status 429;
1516
limit_conn_zone $binary_remote_addr zone=connperip:10m;
1617
limit_conn_status 429;
17-
18-
- file:
19-
path: "/etc/nginx/conf.d/outlets/discourse/30-ratelimited.conf"
20-
contents: |
18+
server {
19+
- replace:
20+
filename: "/etc/nginx/conf.d/discourse.conf"
21+
from: "/location @discourse {/"
22+
to: |
23+
location @discourse {
2124
limit_conn connperip $conn_per_ip;
2225
limit_req zone=flood burst=$burst_per_second nodelay;
2326
limit_req zone=bot burst=$burst_per_minute nodelay;

‎templates/web.socketed.template.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@ run:
1212
#!/bin/bash
1313
rm -rf /shared/nginx.http*.sock
1414
- replace:
15-
filename: "/etc/nginx/conf.d/outlets/server/10-http.conf"
16-
from: /listen 80;(\nlisten \[::\]:80;)?/
15+
filename: "/etc/nginx/conf.d/discourse.conf"
16+
from: /listen 80;/
1717
to: |
1818
listen unix:/shared/nginx.http.sock;
1919
set_real_ip_from unix:;
2020
- replace:
21-
filename: "/etc/nginx/conf.d/outlets/server/20-https.conf"
22-
from: /listen 443 ssl;(\nlisten \[::\]:443 ssl;)?/
21+
filename: "/etc/nginx/conf.d/discourse.conf"
22+
from: /listen 443 ssl;/
2323
to: |
2424
listen unix:/shared/nginx.https.sock ssl;
2525
set_real_ip_from unix:;

‎templates/web.ssl.template.yml‎

Lines changed: 48 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,56 @@
11
run:
22
- exec:
3-
cmd:
4-
- "mkdir -p /shared/ssl/"
5-
- file:
6-
path: "/etc/nginx/conf.d/outlets/before-server/10-redirect-http-to-https.conf"
7-
contents: |
8-
server {
9-
listen 80;
10-
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
11-
}
12-
- exec: rm /etc/nginx/conf.d/outlets/server/10-http.conf
13-
- file:
14-
hook: ssl
15-
path: "/etc/nginx/conf.d/outlets/server/20-https.conf"
16-
contents: |
17-
listen 443 ssl;
18-
http2 on;
3+
cmd:
4+
- "mkdir -p /shared/ssl/"
5+
- replace:
6+
filename: "/etc/nginx/conf.d/discourse.conf"
7+
from: /listen 80;\s+listen \[::\]:80;/m
8+
to: |
9+
listen 443 ssl;
10+
listen [::]:443 ssl;
11+
http2 on;
12+
SSL_TEMPLATE_SSL_BLOCK
13+
- replace:
14+
filename: "/etc/nginx/conf.d/discourse.conf"
15+
from: /listen 80;/
16+
to: |
17+
listen 443 ssl;
18+
http2 on;
19+
SSL_TEMPLATE_SSL_BLOCK
20+
- replace:
21+
hook: ssl
22+
filename: "/etc/nginx/conf.d/discourse.conf"
23+
from: /SSL_TEMPLATE_SSL_BLOCK/
24+
to: |
1925
20-
ssl_protocols TLSv1.2 TLSv1.3;
21-
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
22-
ssl_prefer_server_ciphers off;
26+
ssl_protocols TLSv1.2 TLSv1.3;
27+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
28+
ssl_prefer_server_ciphers off;
2329
24-
ssl_certificate /shared/ssl/ssl.crt;
25-
ssl_certificate_key /shared/ssl/ssl.key;
30+
ssl_certificate /shared/ssl/ssl.crt;
31+
ssl_certificate_key /shared/ssl/ssl.key;
2632
27-
ssl_session_tickets off;
28-
ssl_session_timeout 1d;
29-
ssl_session_cache shared:SSL:1m;
33+
ssl_session_tickets off;
34+
ssl_session_timeout 1d;
35+
ssl_session_cache shared:SSL:1m;
3036
31-
add_header Strict-Transport-Security 'max-age=31536000';
37+
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
3238
33-
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
39+
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
3440
rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
35-
}
36-
- file:
37-
path: "/etc/nginx/conf.d/outlets/discourse/20-https.conf"
38-
contents: |
39-
add_header Strict-Transport-Security 'max-age=31536000';
40-
- exec:
41-
cmd:
42-
- |-
43-
if [ -f "/proc/net/if_inet6" ] ; then
44-
sed -i 's/listen 80;/listen 80;\nlisten [::]:80;/g' /etc/nginx/conf.d/outlets/before-server/10-redirect-http-to-https.conf
45-
sed -i 's/listen 443 ssl;/listen 443 ssl;\nlisten [::]:443 ssl;/g' /etc/nginx/conf.d/outlets/server/20-https.conf
46-
fi
41+
}
42+
- replace:
43+
filename: "/etc/nginx/conf.d/discourse.conf"
44+
from: "location @discourse {"
45+
to: |
46+
location @discourse {
47+
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
48+
- replace:
49+
filename: "/etc/nginx/conf.d/discourse.conf"
50+
from: /server.+{/
51+
to: |
52+
server {
53+
listen 80;
54+
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
55+
}
56+
server {

‎templates/web.template.yml‎

Lines changed: 15 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -135,40 +135,33 @@ run:
135135
- "cp $home/config/nginx.sample.conf /etc/nginx/conf.d/discourse.conf"
136136
- "rm /etc/nginx/sites-enabled/default"
137137
- "mkdir -p /var/nginx/cache"
138-
- "mkdir -p /etc/nginx/conf.d/outlets/before-server"
139-
- "mkdir -p /etc/nginx/conf.d/outlets/server"
140-
- "mkdir -p /etc/nginx/conf.d/outlets/discourse"
141-
142-
# Stop building the container if the Nginx outlets are missing
143-
- "grep -q 'outlets/before-server' /etc/nginx/conf.d/discourse.conf || ( >&2 echo 'The \"before-server\" Nginx outlet is missing. This version of discourse_docker is not compatible with the chosen Discourse version.' ; exit 1 )"
144-
- "grep -q 'outlets/server' /etc/nginx/conf.d/discourse.conf || ( >&2 echo 'The \"server\" Nginx outlet is missing. This version of discourse_docker is not compatible with the chosen Discourse version.' ; exit 1 )"
145-
- "grep -q 'outlets/discourse' /etc/nginx/conf.d/discourse.conf || ( >&2 echo 'The \"discourse\" Nginx outlet is missing. This version of discourse_docker is not compatible with the chosen Discourse version.' ; exit 1 )"
146138

147139
- replace:
148140
filename: /etc/nginx/nginx.conf
149141
from: pid /run/nginx.pid;
150142
to: daemon off;
151143

152144
- replace:
153-
filename: "/etc/nginx/nginx.conf"
154-
from: /worker_connections.+$/
155-
to: worker_connections $nginx_worker_connections;
145+
filename: "/etc/nginx/conf.d/discourse.conf"
146+
from: /upstream[^\}]+\}/m
147+
to: "upstream discourse {
148+
server 127.0.0.1:3000;
149+
}"
150+
151+
- replace:
152+
filename: "/etc/nginx/conf.d/discourse.conf"
153+
from: /server_name.+$/
154+
to: server_name _ ;
156155

157156
- replace:
158157
filename: "/etc/nginx/conf.d/discourse.conf"
159158
from: /client_max_body_size.+$/
160-
to: client_max_body_size $upload_size;
159+
to: client_max_body_size $upload_size ;
161160

162-
- exec:
163-
cmd:
164-
# Move `listen 80` to an outlet
165-
- sed -i 's#listen 80;##g' /etc/nginx/conf.d/discourse.conf
166-
- |-
167-
if [ -f "/proc/net/if_inet6" ]; then
168-
echo "listen 80;\nlisten [::]:80;" > /etc/nginx/conf.d/outlets/server/10-http.conf
169-
else
170-
echo "listen 80;" > /etc/nginx/conf.d/outlets/server/10-http.conf
171-
fi
161+
- replace:
162+
filename: "/etc/nginx/nginx.conf"
163+
from: /worker_connections.+$/
164+
to: worker_connections $nginx_worker_connections ;
172165

173166
- exec:
174167
cmd: echo "done configuring web"
@@ -229,7 +222,6 @@ run:
229222
hook: assets_precompile
230223
cmd:
231224
- su discourse -c 'SKIP_EMBER_CLI_COMPILE=1 bundle exec rake themes:update assets:precompile'
232-
233225
- replace:
234226
tag: precompile
235227
filename: /etc/service/unicorn/run

0 commit comments

Comments
 (0)