From 1b84527f8c5fb38c5d338f1189302b952cc4b43e Mon Sep 17 00:00:00 2001 From: Assaf Arkin Date: Mon, 23 Mar 2015 13:34:03 -0700 Subject: [PATCH 1/3] ADDED Nginx configuration for running behind load balancer --- plugins/nginx-vhosts/commands | 6 +++++- .../templates/nginx.terminated.conf | 19 +++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 plugins/nginx-vhosts/templates/nginx.terminated.conf diff --git a/plugins/nginx-vhosts/commands b/plugins/nginx-vhosts/commands index be64d1751..c69bf40b5 100755 --- a/plugins/nginx-vhosts/commands +++ b/plugins/nginx-vhosts/commands @@ -111,7 +111,11 @@ EOF if [[ -n "$NONSSL_VHOSTS" ]]; then NOSSL_SERVER_NAME=$(echo $NONSSL_VHOSTS | tr '\n' ' ') xargs -i echo "-----> Configuring {}..." <<< "$NONSSL_VHOSTS" - [[ -z "$NGINX_CUSTOM_TEMPLATE" ]] && NGINX_TEMPLATE="$(dirname $0)/templates/nginx.conf.template" + if [[ -n "$DOKKU_SSL_TERMINATED" ]] && [[ -z "$NGINX_CUSTOM_TEMPLATE" ]]; then + NGINX_TEMPLATE="$(dirname $0)/templates/nginx.terminated.conf" + elif [[ -z "$NGINX_CUSTOM_TEMPLATE" ]]; then + NGINX_TEMPLATE="$(dirname $0)/templates/nginx.conf.template" + fi eval "cat <<< \"$(< $NGINX_TEMPLATE)\" >> $NGINX_CONF" fi diff --git a/plugins/nginx-vhosts/templates/nginx.terminated.conf b/plugins/nginx-vhosts/templates/nginx.terminated.conf new file mode 100644 index 000000000..bc7bc3a1d --- /dev/null +++ b/plugins/nginx-vhosts/templates/nginx.terminated.conf @@ -0,0 +1,19 @@ +# Nginx configuration when running behind a load balancer that terminates SSL +# connections (e.g. AWS ELB) +server { + listen [::]:80; + listen 80; + server_name $NOSSL_SERVER_NAME; + location / { + proxy_pass http://$APP; + proxy_http_version 1.1; + proxy_set_header Upgrade \$http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host \$http_host; + proxy_set_header X-Forwarded-Proto \$http_x_forwarded_proto; + proxy_set_header X-Forwarded-For \$http_x_forwarded_for; + proxy_set_header X-Forwarded-Port \$http_x_forwarded_port; + proxy_set_header X-Request-Start \$msec; + } + include $DOKKU_ROOT/$APP/nginx.conf.d/*.conf; +} From 170f44f3d7ac3a552a0fc214bc0a6c5d4e68d643 Mon Sep 17 00:00:00 2001 From: Assaf Arkin Date: Wed, 25 Mar 2015 09:58:40 -0700 Subject: [PATCH 2/3] Added documentation --- docs/nginx.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/nginx.md b/docs/nginx.md index 2bbbbe92e..5fcec99b2 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -55,6 +55,28 @@ dokku nginx:import-ssl myapp < archive-of-certs.tar This archive is expanded via `tar xvf`. It should contain `server.crt` and `server.key`. + +## Running behind a load balancer + +> New as of 0.3.17 + +Your application has access to the HTTP headers `X-Forwarded-Proto`, `X-Forwarded-For` and `X-Forwarded-Port`. These headers indicate the protocol of the original request (HTTP or HTTPS), the port number, and the IP address of the client making the request, respectively. The default configuration is for Nginx to set these headers. + +If your server runs behind an HTTP/S load balancer, then Nginx will see all requests as coming from the load balancer. If your load balancer sets the `X-Forwarded-` headers, you can tell Nginx to pass these headers from load balancer to your application by setting the `DOKKU_SSL_TERMINATED` environment variable: + +```shell +dokku config:set myapp DOKKU_SSL_TERMINATED=1 +``` + +Only use this option if: +1. All requests are terminated at the load balancer, and forwarded to Nginx +2. The load balancer is configured to send the `X-Forwarded-` headers (this may be off by default) + +If it's possible to make HTTP/S requests directly to Nginx, bypassing the load balancer, or if the load balancer is not configured to set these headers, then it becomes possible for a client to set these headers to arbitrary values. + +This could result in security issue, for example, if your application looks at the value of the `X-Forwarded-Proto` to determine if the request was made over HTTPS. + + ## Customizing the nginx configuration > New as of 0.3.17. From 964a84dc31af8d4d453310a07b140c3a3e2e4923 Mon Sep 17 00:00:00 2001 From: Michael Hobbs Date: Tue, 15 Sep 2015 10:32:10 -0700 Subject: [PATCH 3/3] rename ssl terminated template to conform to naming scheme --- docs/nginx.md | 2 +- plugins/nginx-vhosts/commands | 2 +- ...nginx.terminated.conf => nginx.conf.ssl_terminated.template} | 0 3 files changed, 2 insertions(+), 2 deletions(-) rename plugins/nginx-vhosts/templates/{nginx.terminated.conf => nginx.conf.ssl_terminated.template} (100%) diff --git a/docs/nginx.md b/docs/nginx.md index 5fcec99b2..1490a7c3b 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -79,7 +79,7 @@ This could result in security issue, for example, if your application looks at t ## Customizing the nginx configuration -> New as of 0.3.17. +> New as of 0.4.0. Dokku currently templates out an nginx configuration that is included in the `nginx-vhosts` plugin. If you'd like to provide a custom template for your application, you should copy the existing template - ssl or non-ssl - into your application repository's root directory as the file `nginx.conf.template`. The next time you deploy, Nginx will use your template instead of the default. diff --git a/plugins/nginx-vhosts/commands b/plugins/nginx-vhosts/commands index c69bf40b5..c6a47e6e9 100755 --- a/plugins/nginx-vhosts/commands +++ b/plugins/nginx-vhosts/commands @@ -112,7 +112,7 @@ EOF NOSSL_SERVER_NAME=$(echo $NONSSL_VHOSTS | tr '\n' ' ') xargs -i echo "-----> Configuring {}..." <<< "$NONSSL_VHOSTS" if [[ -n "$DOKKU_SSL_TERMINATED" ]] && [[ -z "$NGINX_CUSTOM_TEMPLATE" ]]; then - NGINX_TEMPLATE="$(dirname $0)/templates/nginx.terminated.conf" + NGINX_TEMPLATE="$(dirname $0)/templates/nginx.conf.ssl_terminated.template" elif [[ -z "$NGINX_CUSTOM_TEMPLATE" ]]; then NGINX_TEMPLATE="$(dirname $0)/templates/nginx.conf.template" fi diff --git a/plugins/nginx-vhosts/templates/nginx.terminated.conf b/plugins/nginx-vhosts/templates/nginx.conf.ssl_terminated.template similarity index 100% rename from plugins/nginx-vhosts/templates/nginx.terminated.conf rename to plugins/nginx-vhosts/templates/nginx.conf.ssl_terminated.template