@samitouri / QOSAMI-X402Tunnel-1
Code Commits Issues Pulls Sessions CI/CD
main
main
template 152 lines 4.51 KB
Raw
1 # Portal relay + frontend edge nginx for the bundled Docker Compose stack.
2 # docker-compose.yml renders this template from environment variables.
3 #
4 # Traffic flow:
5 # :80 -> redirect to HTTPS
6 # :443 -> L4 SNI inspection
7 # ${PORTAL_HOST} -> nginx L7 TLS termination and path routing
8 # *.${PORTAL_HOST} -> portal SNI listener, raw TCP passthrough
9 #
10 # The browser-facing certificate is read from ./.portal-certs by docker-compose.
11 # That is the same default directory used by the relay certificate.
12
13 events {
14 worker_connections 4096;
15 }
16
17 stream {
18 map $ssl_preread_server_name $backend {
19 hostnames;
20 ${PORTAL_HOST} portal_web;
21 *.${PORTAL_HOST} portal_sni;
22 default portal_web;
23 }
24
25 upstream portal_web {
26 server 127.0.0.1:8443;
27 }
28
29 upstream portal_sni {
30 server portal:443;
31 }
32
33 server {
34 listen 443;
35 ssl_preread on;
36 proxy_pass $backend;
37 proxy_connect_timeout 5s;
38 proxy_timeout 86400s;
39 }
40 }
41
42 http {
43 access_log off;
44 error_log /var/log/nginx/error.log warn;
45
46 sendfile on;
47 tcp_nopush on;
48 tcp_nodelay on;
49 keepalive_timeout 65;
50
51 include /etc/nginx/mime.types;
52 default_type application/octet-stream;
53
54 gzip on;
55 gzip_vary on;
56 gzip_min_length 1024;
57 gzip_types text/plain text/css application/json application/javascript
58 text/xml application/xml application/xml+rss text/javascript;
59
60 server {
61 listen 8443 ssl;
62 server_name ${PORTAL_HOST};
63 server_tokens off;
64
65 ssl_certificate ${NGINX_CERT_FILE};
66 ssl_certificate_key ${NGINX_CERT_KEY};
67
68 ssl_protocols TLSv1.2 TLSv1.3;
69 ssl_ciphers HIGH:!aNULL:!MD5;
70 ssl_prefer_server_ciphers on;
71 ssl_session_cache shared:SSL:10m;
72 ssl_session_timeout 10m;
73
74 location = /sdk/connect {
75 proxy_pass https://portal:4017;
76 proxy_ssl_verify off;
77 proxy_ssl_server_name on;
78 proxy_ssl_name $host;
79 proxy_http_version 1.1;
80
81 proxy_set_header Host $host;
82 proxy_set_header X-Real-IP $remote_addr;
83 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
84 proxy_set_header X-Forwarded-Proto https;
85 proxy_set_header Upgrade $http_upgrade;
86 proxy_set_header Connection $http_connection;
87
88 proxy_buffering off;
89 proxy_request_buffering off;
90 proxy_read_timeout 86400s;
91 proxy_send_timeout 86400s;
92 }
93
94 location ~ ^/(sdk/|discovery(?:/|$)|v1/sign$) {
95 proxy_pass https://portal:4017;
96 proxy_ssl_verify off;
97 proxy_ssl_server_name on;
98 proxy_ssl_name $host;
99
100 proxy_set_header Host $host;
101 proxy_set_header X-Real-IP $remote_addr;
102 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
103 proxy_set_header X-Forwarded-Proto https;
104
105 proxy_read_timeout 60s;
106 }
107
108 location /api/ {
109 proxy_pass https://portal:4017;
110 proxy_ssl_verify off;
111 proxy_ssl_server_name on;
112 proxy_ssl_name $host;
113
114 proxy_set_header Host $host;
115 proxy_set_header X-Real-IP $remote_addr;
116 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
117 proxy_set_header X-Forwarded-Proto https;
118 proxy_set_header Authorization $http_authorization;
119
120 proxy_read_timeout 60s;
121 }
122
123 location /ui/ {
124 proxy_pass http://portal-api:8081;
125
126 proxy_set_header Host $host;
127 proxy_set_header X-Real-IP $remote_addr;
128 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
129 proxy_set_header X-Forwarded-Proto https;
130 proxy_set_header Authorization $http_authorization;
131
132 proxy_read_timeout 60s;
133 }
134
135 location / {
136 proxy_pass http://portal-frontend:8080;
137
138 proxy_set_header Host $host;
139 proxy_set_header X-Real-IP $remote_addr;
140 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
141 proxy_set_header X-Forwarded-Proto https;
142
143 proxy_read_timeout 60s;
144 }
145 }
146
147 server {
148 listen 80;
149 server_name _;
150 return 301 https://$host$request_uri;
151 }
152 }