Skip to content

Commit 900902f

Browse files
nbiancanbianca
committed
Use Nginx config with outlets
This config has several 'include' statements that serve as extension outlets. Most of the "find & replace" instructions from templates files have been replaced to use outlets. This commit also deprecates IPv6 template in favour of an automatic implementation that relies on container's connectivity.
1 parent 09d5eb6 commit 900902f

10 files changed

+97
-113
lines changed

‎samples/standalone.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ templates:
1111
- "templates/postgres.template.yml"
1212
- "templates/redis.template.yml"
1313
- "templates/web.template.yml"
14-
## Uncomment the next line to enable the IPv6 listener
15-
#- "templates/web.ipv6.template.yml"
1614
- "templates/web.ratelimited.template.yml"
1715
## Uncomment these two lines if you wish to add Lets Encrypt (https)
1816
#- "templates/web.ssl.template.yml"

‎samples/web_only.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33

44
templates:
55
- "templates/web.template.yml"
6-
## Uncomment the next line to enable the IPv6 listener
7-
#- "templates/web.ipv6.template.yml"
86
- "templates/web.ratelimited.template.yml"
97
## Uncomment these two lines if you wish to add Lets Encrypt (https)
108
#- "templates/web.ssl.template.yml"

‎templates/offline-page.template.yml‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,14 @@ params:
77
offline_page_repository: https://github.com/discourse/discourse-offline-page.git
88

99
run:
10-
- replace:
11-
filename: "/etc/nginx/conf.d/discourse.conf"
12-
global: true
13-
from: /server.+{/
14-
to: |
15-
server {
16-
error_page 502 /error_page.html;
17-
location /error_page.html {
18-
root /var/www/discourse-offline-page/html;
19-
internal;
20-
}
10+
- file:
11+
path: "/etc/nginx/conf.d/outlets/server/offline-page.conf"
12+
contents: |
13+
error_page 502 /error_page.html;
14+
location /error_page.html {
15+
root /var/www/discourse-offline-page/html;
16+
internal;
17+
}
2118
2219
- exec:
2320
cmd: git clone $offline_page_repository /var/www/discourse-offline-page

‎templates/sshd.template.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
11
# This file is deprecated; you can remove it from your app.yml
2+
# TODO(2026-01-01): Remove this file
23
run:
4+
- exec: |-
5+
echo "Deprecation warning: sshd is no longer supported"
6+
echo "Remove templates/sshd.template.yml from your containers/*.yml files"

‎templates/web.ipv6.template.yml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
1+
# This file is deprecated; you can remove it from your app.yml
2+
# TODO(2026-01-01): Remove this file
13
run:
2-
- exec: echo "Enabling IPv6 listener"
3-
- replace:
4-
filename: "/etc/nginx/conf.d/discourse.conf"
5-
from: listen 80;
6-
to: |
7-
listen 80;
8-
listen [::]:80;
4+
- exec: |-
5+
echo "Deprecation warning: IPv6 is enabled by default when possible"
6+
echo "Remove templates/web.ipv6.template.yml from your containers/*.yml files"

‎templates/web.letsencrypt.ssl.template.yml‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -106,28 +106,22 @@ hooks:
106106
107107
/usr/sbin/nginx -c /etc/nginx/letsencrypt.conf -s stop
108108
109-
- replace:
110-
filename: "/etc/nginx/conf.d/discourse.conf"
111-
from: /ssl_certificate.+/
112-
to: |
113-
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer;
114-
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.cer;
115-
116109
- replace:
117110
filename: /shared/letsencrypt/account.conf
118111
from: /#?ACCOUNT_EMAIL=.+/
119112
to: |
120113
ACCOUNT_EMAIL=$$ENV_LETSENCRYPT_ACCOUNT_EMAIL
121114
122115
- replace:
123-
filename: "/etc/nginx/conf.d/discourse.conf"
124-
from: /ssl_certificate_key.+/
116+
filename: "/etc/nginx/conf.d/outlets/server/https.conf"
117+
from: /ssl_certificate.+/
125118
to: |
126-
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.key;
127-
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.key;
119+
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer;
120+
ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.cer;
128121
129122
- replace:
130-
filename: "/etc/nginx/conf.d/discourse.conf"
131-
from: /add_header.+/
123+
filename: "/etc/nginx/conf.d/outlets/server/https.conf"
124+
from: /ssl_certificate_key.+/
132125
to: |
133-
add_header Strict-Transport-Security 'max-age=63072000';
126+
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.key;
127+
ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME_ecc.key;

‎templates/web.ratelimited.template.yml‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,18 @@ params:
66
conn_per_ip: 20
77

88
run:
9-
- replace:
10-
filename: "/etc/nginx/conf.d/discourse.conf"
11-
from: /server.+{/
12-
to: |
9+
- file:
10+
path: "/etc/nginx/conf.d/outlets/before-server/ratelimited.conf"
11+
contents: |
1312
limit_req_zone $binary_remote_addr zone=flood:10m rate=$reqs_per_secondr/s;
1413
limit_req_zone $binary_remote_addr zone=bot:10m rate=$reqs_per_minuter/m;
1514
limit_req_status 429;
1615
limit_conn_zone $binary_remote_addr zone=connperip:10m;
1716
limit_conn_status 429;
18-
server {
19-
- replace:
20-
filename: "/etc/nginx/conf.d/discourse.conf"
21-
from: "/location @discourse {/"
22-
to: |
23-
location @discourse {
17+
18+
- file:
19+
path: "/etc/nginx/conf.d/outlets/discourse/ratelimited.conf"
20+
contents: |
2421
limit_conn connperip $conn_per_ip;
2522
limit_req zone=flood burst=$burst_per_second nodelay;
2623
limit_req zone=bot burst=$burst_per_minute nodelay;

‎templates/web.socketed.template.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,14 @@ run:
1212
#!/bin/bash
1313
rm -rf /shared/nginx.http*.sock
1414
- replace:
15-
filename: "/etc/nginx/conf.d/discourse.conf"
16-
from: /listen 80;/
15+
filename: "/etc/nginx/conf.d/outlets/server/http.conf"
16+
from: /listen 80;(\nlisten \[::\]:80;)?/
1717
to: |
1818
listen unix:/shared/nginx.http.sock;
1919
set_real_ip_from unix:;
2020
- replace:
21-
filename: "/etc/nginx/conf.d/discourse.conf"
22-
from: /listen 443 ssl;/
21+
filename: "/etc/nginx/conf.d/outlets/server/https.conf"
22+
from: /listen 443 ssl;(\nlisten \[::\]:443 ssl;)?/
2323
to: |
2424
listen unix:/shared/nginx.https.sock ssl;
2525
set_real_ip_from unix:;

‎templates/web.ssl.template.yml‎

Lines changed: 38 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,46 @@
11
run:
22
- exec:
3-
cmd:
4-
- "mkdir -p /shared/ssl/"
5-
- replace:
6-
filename: "/etc/nginx/conf.d/discourse.conf"
7-
from: /listen 80;\s+listen \[::\]:80;/m
8-
to: |
9-
listen 443 ssl;
10-
listen [::]:443 ssl;
11-
http2 on;
12-
SSL_TEMPLATE_SSL_BLOCK
13-
- replace:
14-
filename: "/etc/nginx/conf.d/discourse.conf"
15-
from: /listen 80;/
16-
to: |
17-
listen 443 ssl;
18-
http2 on;
19-
SSL_TEMPLATE_SSL_BLOCK
20-
- replace:
21-
hook: ssl
22-
filename: "/etc/nginx/conf.d/discourse.conf"
23-
from: /SSL_TEMPLATE_SSL_BLOCK/
24-
to: |
3+
cmd:
4+
- "mkdir -p /shared/ssl/"
5+
- file:
6+
path: "/etc/nginx/conf.d/outlets/before-server/redirect-http-to-https.conf"
7+
contents: |
8+
server {
9+
listen 80;
10+
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
11+
}
12+
- exec: rm /etc/nginx/conf.d/outlets/server/http.conf
13+
- file:
14+
hook: ssl
15+
path: "/etc/nginx/conf.d/outlets/server/https.conf"
16+
contents: |
17+
listen 443 ssl;
18+
http2 on;
2519
26-
ssl_protocols TLSv1.2 TLSv1.3;
27-
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
28-
ssl_prefer_server_ciphers off;
20+
ssl_protocols TLSv1.2 TLSv1.3;
21+
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
22+
ssl_prefer_server_ciphers off;
2923
30-
ssl_certificate /shared/ssl/ssl.crt;
31-
ssl_certificate_key /shared/ssl/ssl.key;
24+
ssl_certificate /shared/ssl/ssl.crt;
25+
ssl_certificate_key /shared/ssl/ssl.key;
3226
33-
ssl_session_tickets off;
34-
ssl_session_timeout 1d;
35-
ssl_session_cache shared:SSL:1m;
27+
ssl_session_tickets off;
28+
ssl_session_timeout 1d;
29+
ssl_session_cache shared:SSL:1m;
3630
37-
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
31+
add_header Strict-Transport-Security 'max-age=31536000';
3832
39-
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
33+
if ($http_host != $$ENV_DISCOURSE_HOSTNAME) {
4034
rewrite (.*) https://$$ENV_DISCOURSE_HOSTNAME$1 permanent;
41-
}
42-
- replace:
43-
filename: "/etc/nginx/conf.d/discourse.conf"
44-
from: "location @discourse {"
45-
to: |
46-
location @discourse {
47-
add_header Strict-Transport-Security 'max-age=31536000'; # remember the certificate for a year and automatically connect to HTTPS for this domain
48-
- replace:
49-
filename: "/etc/nginx/conf.d/discourse.conf"
50-
from: /server.+{/
51-
to: |
52-
server {
53-
listen 80;
54-
return 301 https://$$ENV_DISCOURSE_HOSTNAME$request_uri;
55-
}
56-
server {
35+
}
36+
- file:
37+
path: "/etc/nginx/conf.d/outlets/discourse/https.conf"
38+
contents: |
39+
add_header Strict-Transport-Security 'max-age=31536000';
40+
- exec:
41+
cmd:
42+
- |-
43+
if [ -f "/proc/net/if_inet6" ] ; then
44+
sed -i 's/listen 80;/listen 80;\nlisten [::]:80;/g' /etc/nginx/conf.d/outlets/before-server/redirect-http-to-https.conf
45+
sed -i 's/listen 443 ssl;/listen 443 ssl;\nlisten [::]:443 ssl;/g' /etc/nginx/conf.d/outlets/server/https.conf
46+
fi

‎templates/web.template.yml‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -135,33 +135,40 @@ run:
135135
- "cp $home/config/nginx.sample.conf /etc/nginx/conf.d/discourse.conf"
136136
- "rm /etc/nginx/sites-enabled/default"
137137
- "mkdir -p /var/nginx/cache"
138+
- "mkdir -p /etc/nginx/conf.d/outlets/before-server"
139+
- "mkdir -p /etc/nginx/conf.d/outlets/server"
140+
- "mkdir -p /etc/nginx/conf.d/outlets/discourse"
141+
142+
# Stop building the container if the Nginx outlets are missing
143+
- "grep -q 'outlets/before-server' /etc/nginx/conf.d/discourse.conf || ( >&2 echo 'The \"before-server\" Nginx outlet is missing. This version of discourse_docker is not compatible with the chosen Discourse version.' ; exit 1 )"
144+
- "grep -q 'outlets/server' /etc/nginx/conf.d/discourse.conf || ( >&2 echo 'The \"server\" Nginx outlet is missing. This version of discourse_docker is not compatible with the chosen Discourse version.' ; exit 1 )"
145+
- "grep -q 'outlets/discourse' /etc/nginx/conf.d/discourse.conf || ( >&2 echo 'The \"discourse\" Nginx outlet is missing. This version of discourse_docker is not compatible with the chosen Discourse version.' ; exit 1 )"
138146

139147
- replace:
140148
filename: /etc/nginx/nginx.conf
141149
from: pid /run/nginx.pid;
142150
to: daemon off;
143151

144152
- replace:
145-
filename: "/etc/nginx/conf.d/discourse.conf"
146-
from: /upstream[^\}]+\}/m
147-
to: "upstream discourse {
148-
server 127.0.0.1:3000;
149-
}"
150-
151-
- replace:
152-
filename: "/etc/nginx/conf.d/discourse.conf"
153-
from: /server_name.+$/
154-
to: server_name _ ;
153+
filename: "/etc/nginx/nginx.conf"
154+
from: /worker_connections.+$/
155+
to: worker_connections $nginx_worker_connections;
155156

156157
- replace:
157158
filename: "/etc/nginx/conf.d/discourse.conf"
158159
from: /client_max_body_size.+$/
159-
to: client_max_body_size $upload_size ;
160+
to: client_max_body_size $upload_size;
160161

161-
- replace:
162-
filename: "/etc/nginx/nginx.conf"
163-
from: /worker_connections.+$/
164-
to: worker_connections $nginx_worker_connections ;
162+
- exec:
163+
cmd:
164+
# Move `listen 80` to an outlet
165+
- sed -i 's#listen 80;##g' /etc/nginx/conf.d/discourse.conf
166+
- |-
167+
if [ -f "/proc/net/if_inet6" ]; then
168+
echo "listen 80;\nlisten [::]:80;" > /etc/nginx/conf.d/outlets/server/http.conf
169+
else
170+
echo "listen 80;" > /etc/nginx/conf.d/outlets/server/http.conf
171+
fi
165172
166173
- exec:
167174
cmd: echo "done configuring web"
@@ -222,6 +229,7 @@ run:
222229
hook: assets_precompile
223230
cmd:
224231
- su discourse -c 'SKIP_EMBER_CLI_COMPILE=1 bundle exec rake themes:update assets:precompile'
232+
225233
- replace:
226234
tag: precompile
227235
filename: /etc/service/unicorn/run

0 commit comments

Comments
 (0)