Merge pull request #1129 from progrium/validate-nginx

Validate nginx configuration before restarting nginx

docs/nginx.md

@@ -77,6 +77,12 @@ server {
 
 The above is a sample http configuration that adds an `X-Served-By` header to requests. The template file **must** be owned by the user `dokku:dokku`.
 
+A few tips for custom nginx templates:
+
+- Special characters - dollar signs, spaces inside of quotes, etc. - should be escaped with a single backslash or can cause deploy failures.
+- Templated files will be validated via `nginx -t`.
+- Application environment variables can be used within your nginx configuration.
+
 ## Customizing hostnames
 
 Applications typically have the following structure for their hostname:

plugins/common/functions

@@ -104,6 +104,7 @@ dokku_container_log_verbose_quiet() {
 
 verify_app_name() {
   local APP="$1"
+  [[ ! -n "$APP" ]] && dokku_log_fail "(verify_app_name) APP must not be null"
   [[ ! -d "$DOKKU_ROOT/$APP" ]] && dokku_log_fail "App $APP does not exist"
   IMAGE="dokku/$APP"
   return 0

plugins/domains/commands

@@ -45,7 +45,7 @@ case "$1" in
         VHOST=$(< "$DOKKU_ROOT/HOSTNAME")
       fi
       if [[ "$VHOST" =~ $RE_IPV4 ]] || [[ "$VHOST" =~ $RE_IPV6 ]];then
-        echo "unsupported vhost config found. disabling vhost support"
+        dokku_log_info2 "unsupported vhost config found. disabling vhost support"
         dokku config:set-norestart $APP NO_VHOST=1
       else
         if [[ -f "$DOKKU_ROOT/VHOST" ]]; then

plugins/nginx-vhosts/commands

@@ -2,6 +2,17 @@
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 source "$(dirname $0)/../common/functions"
 
+validate_nginx () {
+  set +e
+  sudo /usr/sbin/nginx -t > /dev/null 2>&1
+  exit_code=$?
+  set -e
+  if [[ "$exit_code" -ne "0" ]]; then
+    sudo /usr/sbin/nginx -t
+    exit "$exit_code"
+  fi
+}
+
 restart_nginx () {
   case "$DOKKU_DISTRO" in
     ubuntu)
@@ -17,6 +28,7 @@ restart_nginx () {
 case "$1" in
   nginx:build-config)
     APP="$2"; DOKKU_APP_LISTEN_PORT="$3"; DOKKU_APP_LISTEN_IP="${4}"
+    verify_app_name "$APP"
     VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"
     URLS_PATH="$DOKKU_ROOT/$APP/URLS"
     WILDCARD_SSL="$DOKKU_ROOT/tls"
@@ -97,7 +109,8 @@ EOF
         dokku_log_info1 "Running nginx-pre-reload"
         pluginhook nginx-pre-reload $APP $DOKKU_APP_LISTEN_PORT $DOKKU_APP_LISTEN_IP
 
-        echo "       Reloading nginx"
+        dokku_log_verbose "Reloading nginx"
+        validate_nginx
         restart_nginx
       fi
 

plugins/nginx-vhosts/install

@@ -1,19 +1,17 @@
 #!/usr/bin/env bash
 set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
 
-if [[ ! -f /etc/sudoers.d/dokku-nginx ]]; then
-  case "$DOKKU_DISTRO" in
-    ubuntu)
-      echo "%dokku ALL=(ALL) NOPASSWD:/etc/init.d/nginx reload" >> /etc/sudoers.d/dokku-nginx
-      ;;
+case "$DOKKU_DISTRO" in
+  ubuntu)
+    echo "%dokku ALL=(ALL) NOPASSWD:/etc/init.d/nginx reload, /usr/sbin/nginx -t" > /etc/sudoers.d/dokku-nginx
+    ;;
 
-    opensuse)
-      echo "%dokku ALL=(ALL) NOPASSWD:/sbin/service nginx reload" >> /etc/sudoers.d/dokku-nginx
-      ;;
-  esac
+  opensuse)
+    echo "%dokku ALL=(ALL) NOPASSWD:/sbin/service nginx reload, /usr/sbin/nginx -t" > /etc/sudoers.d/dokku-nginx
+    ;;
+esac
 
-  chmod 0440 /etc/sudoers.d/dokku-nginx
-fi
+chmod 0440 /etc/sudoers.d/dokku-nginx
 
 # if dokku.conf has not been created, create it
 if [[ ! -f /etc/nginx/conf.d/dokku.conf ]]; then

tests/unit/nginx-vhosts.bats

@@ -94,3 +94,12 @@ assert_http_success() {
   deploy_app
   assert_nonssl_domain "www.test.app.dokku.me"
 }
+
+@test "(nginx-vhosts) nginx:build-config (validate_nginx)" {
+  deploy_app
+  echo "some lame nginx config" > "$DOKKU_ROOT/$TEST_APP/nginx.conf.template"
+  run /bin/bash -c "dokku nginx:build-config $TEST_APP"
+  echo "output: "$output
+  echo "status: "$status
+  assert_failure
+}