Skip to content

Commit 7214314

Browse files
nbiancanbianca
committed
Use new Nginx config with outlets
This config has several 'include' statements that serve as extension outlets. Most of the "find & replace" instructions from templates files have been replaced to use outlets. This commit also deprecates IPv6 template in favour of an automatic implementation that relies on container's connectivity.
1 parent 32dc866 commit 7214314

11 files changed

+98
-124
lines changed

‎launcher‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ kernel_min_version='4.4.0'
9292
config_file=containers/"$config".yml
9393
cidbootstrap=cids/"$config"_bootstrap.cid
9494
local_discourse=local_discourse
95-
image="discourse/base:2.0.20250114-0014"
95+
image="discourse/base:2.0.20250122-1813"
9696
docker_path=`which docker.io 2> /dev/null || which docker`
9797
git_path=`which git`
9898

‎samples/standalone.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ templates:
1111
- "templates/postgres.template.yml"
1212
- "templates/redis.template.yml"
1313
- "templates/web.template.yml"
14-
## Uncomment the next line to enable the IPv6 listener
15-
#- "templates/web.ipv6.template.yml"
1614
- "templates/web.ratelimited.template.yml"
1715
## Uncomment these two lines if you wish to add Lets Encrypt (https)
1816
#- "templates/web.ssl.template.yml"

‎samples/web_only.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33

44
templates:
55
- "templates/web.template.yml"
6-
## Uncomment the next line to enable the IPv6 listener
7-
#- "templates/web.ipv6.template.yml"
86
- "templates/web.ratelimited.template.yml"
97
## Uncomment these two lines if you wish to add Lets Encrypt (https)
108
#- "templates/web.ssl.template.yml"

‎templates/offline-page.template.yml‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,14 @@ params:
77
offline_page_repository: https://github.com/discourse/discourse-offline-page.git
88

99
run:
10-
- replace:
11-
filename: "/etc/nginx/conf.d/discourse.conf"
12-
global: true
13-
from: /server.+{/
14-
to: |
15-
server {
16-
error_page 502 /error_page.html;
17-
location /error_page.html {
18-
root /var/www/discourse-offline-page/html;
19-
internal;
20-
}
10+
- file:
11+
path: "/etc/nginx/conf.d/outlets/server/offline-page.conf"
12+
contents: |
13+
error_page 502 /error_page.html;
14+
location /error_page.html {
15+
root /var/www/discourse-offline-page/html;
16+
internal;
17+
}
2118
2219
- exec:
2320
cmd: git clone $offline_page_repository /var/www/discourse-offline-page

‎templates/sshd.template.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
11
# This file is deprecated; you can remove it from your app.yml
2+
# TODO(2026-01-01): Remove this file
23
run:
4+
- exec: |-
5+
echo "Deprecation warning: sshd is no longer supported"
6+
echo "Remove templates/sshd.template.yml from your containers/*.yml files"

‎templates/web.ipv6.template.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
1+
# This file is deprecated; you can remove it from your app.yml
2+
# TODO(2026-01-01): Remove this file
13
run:
2-
- exec: echo "Enabling IPv6 listener"
3-
- replace:
4-
filename: "/etc/nginx/conf.d/discourse.conf"
5-
from: listen 80;
6-
to: |
7-
listen 80;
8-
listen [::]:80;
4+
- exec: |-
5+
echo "Deprecation warning: IPv6 is enabled by default when possible"
6+
echo "Remove templates/web.ipv6.template.yml from your containers/*.yml files"

‎templates/web.letsencrypt.ssl.template.yml‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -106,28 +106,22 @@ hooks:
106106
107107
/usr/sbin/nginx -c /etc/nginx/letsencrypt.conf -s stop
108108
109-
- replace:
110-
filename: "/etc/nginx/conf.d/discourse.conf"
111-
from: /ssl_certificate.+/
112-
to: |
113-
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer;
114-
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.cer;
115-
116109
- replace:
117110
filename: /shared/letsencrypt/account.conf
118111
from: /#?ACCOUNT_EMAIL=.+/
119112
to: |
120113
ACCOUNT_EMAIL=$$ENV_LETSENCRYPT_ACCOUNT_EMAIL
121114
122115
- replace:
123-
filename: "/etc/nginx/conf.d/discourse.conf"
124-
from: /ssl_certificate_key.+/
116+
filename: "/etc/nginx/conf.d/outlets/server/https.conf"
117+
from: /ssl_certificate.+/
125118
to: |
126-
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.key;
127-
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.key;
119+
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer;
120+
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.cer;
128121
129122
- replace:
130-
filename: "/etc/nginx/conf.d/discourse.conf"
131-
from: /add_header.+/
123+
filename: "/etc/nginx/conf.d/outlets/server/https.conf"
124+
from: /ssl_certificate_key.+/
132125
to: |
133-
add_header Strict-Transport-Security 'max-age=63072000';
126+
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.key;
127+
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.key;

‎templates/web.ratelimited.template.yml‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,18 @@ params:
66
conn_per_ip: 20
77

88
run:
9-
- replace:
10-
filename: "/etc/nginx/conf.d/discourse.conf"
11-
from: /server.+{/
12-
to: |
9+
- file:
10+
path: "/etc/nginx/conf.d/outlets/before-server/ratelimited.conf"
11+
contents: |
1312
limit_req_zone $binary_remote_addr zone=flood:10m rate=$reqs_per_secondr/s;
1413
limit_req_zone $binary_remote_addr zone=bot:10m rate=$reqs_per_minuter/m;
1514
limit_req_status 429;
1615
limit_conn_zone $binary_remote_addr zone=connperip:10m;
1716
limit_conn_status 429;
18-
server {
19-
- replace:
20-
filename: "/etc/nginx/conf.d/discourse.conf"
21-
from: "/location @discourse {/"
22-
to: |
23-
location @discourse {
17+
18+
- file:
19+
path: "/etc/nginx/conf.d/outlets/discourse/ratelimited.conf"
20+
contents: |
2421
limit_conn connperip $conn_per_ip;
2522
limit_req zone=flood burst=$burst_per_second nodelay;
2623
limit_req zone=bot burst=$burst_per_minute nodelay;

‎templates/web.socketed.template.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@ run:
1212
#!/bin/bash
1313
rm -rf /shared/nginx.http*.sock
1414
- replace:
15-
filename: "/etc/nginx/conf.d/discourse.conf"
16-
from: /listen 80;/
15+
filename: "/etc/nginx/conf.d/outlets/server/http.conf"
16+
from: /listen 80;(\nlisten \[::\]:80;)?/
1717
to: |
1818
listen unix:/shared/nginx.http.sock;
1919
set_real_ip_from unix:;
2020
- replace:
21-
filename: "/etc/nginx/conf.d/discourse.conf"
22-
from: /listen 443 ssl http2;/
21+
filename: "/etc/nginx/conf.d/outlets/server/https.conf"
22+
from: /listen 443 ssl;(\nlisten \[::\]:443 ssl;)?/
2323
to: |
24-
listen unix:/shared/nginx.https.sock ssl http2;
24+
listen unix:/shared/nginx.https.sock ssl;
2525
set_real_ip_from unix:;

‎templates/web.ssl.template.yml‎

Lines changed: 49 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,58 +1,51 @@
11
run:
22
- exec:
3-
cmd:
4-
- "mkdir -p /shared/ssl/"
5-
- replace:
6-
filename: "/etc/nginx/conf.d/discourse.conf"
7-
from: /server.+{/
8-
to: |
9-
server {
10-
listen 80;
11-
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
12-
}
13-
server {
14-
- replace:
15-
filename: "/etc/nginx/conf.d/discourse.conf"
16-
from: /listen 80;\s+gzip on;/m
17-
to: |
18-
listen 443 ssl;
19-
http2 on;
20-
SSL_TEMPLATE_SSL_BLOCK
21-
- replace:
22-
filename: "/etc/nginx/conf.d/discourse.conf"
23-
from: /listen 80;\s+listen \[::\]:80;\s+gzip on;/m
24-
to: |
25-
listen 443 ssl;
26-
listen [::]:443 ssl;
27-
http2 on;
28-
SSL_TEMPLATE_SSL_BLOCK
29-
- replace:
30-
hook: ssl
31-
filename: "/etc/nginx/conf.d/discourse.conf"
32-
from: /SSL_TEMPLATE_SSL_BLOCK/
33-
to: |
34-
35-
ssl_protocols TLSv1.2 TLSv1.3;
36-
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
37-
ssl_prefer_server_ciphers off;
38-
39-
ssl_certificate /shared/ssl/ssl.crt;
40-
ssl_certificate_key /shared/ssl/ssl.key;
41-
42-
ssl_session_tickets off;
43-
ssl_session_timeout 1d;
44-
ssl_session_cache shared:SSL:1m;
45-
46-
gzip on;
47-
48-
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
49-
50-
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
51-
rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
52-
}
53-
- replace:
54-
filename: "/etc/nginx/conf.d/discourse.conf"
55-
from: "location @discourse {"
56-
to: |
57-
location @discourse {
58-
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
3+
cmd:
4+
- "mkdir -p /shared/ssl/"
5+
6+
- file:
7+
path: "/etc/nginx/conf.d/outlets/before-server/redirect-http-to-https.conf"
8+
contents: |
9+
server {
10+
listen 80;
11+
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
12+
}
13+
14+
- exec: rm /etc/nginx/conf.d/outlets/server/http.conf
15+
16+
- file:
17+
hook: ssl
18+
path: "/etc/nginx/conf.d/outlets/server/https.conf"
19+
contents: |
20+
listen 443 ssl;
21+
http2 on;
22+
23+
ssl_protocols TLSv1.2 TLSv1.3;
24+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
25+
ssl_prefer_server_ciphers off;
26+
27+
ssl_certificate /shared/ssl/ssl.crt;
28+
ssl_certificate_key /shared/ssl/ssl.key;
29+
30+
ssl_session_tickets off;
31+
ssl_session_timeout 1d;
32+
ssl_session_cache shared:SSL:1m;
33+
34+
add_header Strict-Transport-Security 'max-age=31536000';
35+
36+
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
37+
rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
38+
}
39+
40+
- file:
41+
path: "/etc/nginx/conf.d/outlets/discourse/https.conf"
42+
contents: |
43+
add_header Strict-Transport-Security 'max-age=31536000';
44+
45+
- exec:
46+
cmd:
47+
- |-
48+
if [ -f "/proc/net/if_inet6" ] ; then
49+
sed -i 's/listen 80;/listen 80;\nlisten [::]:80;/g' /etc/nginx/conf.d/outlets/before-server/redirect-http-to-https.conf
50+
sed -i 's/listen 443 ssl;/listen 443 ssl;\nlisten [::]:443 ssl;/g' /etc/nginx/conf.d/outlets/server/https.conf
51+
fi

0 commit comments

Comments
 (0)