github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge branch 'upcoming' of github.com:dokku/dokku into upcoming

Browse Source
This commit is contained in:
Jose Diaz-Gonzalez
2019-10-07 18:55:29 -05:00
parent 94f5c04bf3 24c47e17f8
commit 844b86840a
154 changed files with 1998 additions and 1494 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
plugins/nginx-vhosts/functions
View File

@@ -11,18 +11,7 @@ source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/internal-functions"
get_nginx_location() {
declare desc="check that nginx is at the expected location and return it"
local NGINX_LOCATION
NGINX_LOCATION=$(which nginx 2>/dev/null)
if [[ -z "$NGINX_LOCATION" ]]; then
NGINX_LOCATION="/usr/sbin/nginx"
fi
if [[ ! -x "$NGINX_LOCATION" ]]; then
dokku_log_fail "Could not find nginx binary in \$PATH or at '${NGINX_LOCATION}'."
fi
echo "$NGINX_LOCATION"
fn-nginx-vhosts-nginx-location
}
validate_nginx() {
@@ -69,32 +58,18 @@ validate_nginx() {
restart_nginx() {
declare desc="restart nginx for given distros"
case "$DOKKU_DISTRO" in
debian)
sudo /usr/sbin/invoke-rc.d nginx reload >/dev/null
;;
ubuntu)
sudo /etc/init.d/nginx reload >/dev/null
;;
opensuse)
sudo /sbin/service nginx reload >/dev/null
;;
arch | centos | rhel)
sudo /usr/bin/systemctl reload nginx
;;
esac
fn-nginx-vhosts-nginx-init-cmd "reload"
}
nginx_logs() {
declare desc="display app nginx logs"
local APP="$2"
declare NGINX_LOGS_TYPE="${1#nginx:}" APP="$2"
local NGINX_LOG_ROOT="/var/log/nginx"
verify_app_name "$APP"
local NGINX_LOGS_TYPE=${1#nginx:}
fn-nginx-vhosts-uses-openresty && NGINX_LOG_ROOT="/var/log/openresty"
local NGINX_LOGS_TYPE=${NGINX_LOGS_TYPE%-logs}
local NGINX_LOGS_PATH="/var/log/nginx/$APP-$NGINX_LOGS_TYPE.log"
local NGINX_LOGS_PATH="$NGINX_LOG_ROOT/$APP-$NGINX_LOGS_TYPE.log"
if [[ $3 == "-t" ]]; then
local NGINX_LOGS_ARGS="-F"
@@ -259,6 +234,28 @@ is_http2_enabled() {
echo $HAS_SUPPORT
}
is_grpc_enabled() {
declare desc="detects whether the installed nginx version has grpc support"
local NGINX_VERSION="$1"
local MAJOR_VERSION MINOR_VERSION PATCH_VERSION
local HAS_SUPPORT=false
MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}')
MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}')
PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}')
if [[ "$MAJOR_VERSION" -ge "2" ]]; then
HAS_SUPPORT=true
elif [[ "$MAJOR_VERSION" -eq "1" ]]; then
if [[ "$MINOR_VERSION" -eq "13" ]] && [[ "$PATCH_VERSION" -ge "10" ]]; then
HAS_SUPPORT=true
elif [[ "$MINOR_VERSION" -ge "14" ]]; then
HAS_SUPPORT=true
fi
fi
echo $HAS_SUPPORT
}
nginx_build_config() {
declare desc="build nginx config to proxy app containers using sigil"
local APP="$1"
@@ -324,7 +321,7 @@ nginx_build_config() {
done
fi
local NGINX_LOCATION NGINX_VERSION SPDY_SUPPORTED HTTP2_SUPPORTED HTTP2_PUSH_SUPPORTED
local NGINX_LOCATION NGINX_VERSION SPDY_SUPPORTED HTTP2_SUPPORTED HTTP2_PUSH_SUPPORTED GRPC_SUPPORTED
NGINX_LOCATION=$(get_nginx_location)
if [[ -z "$NGINX_LOCATION" ]]; then
exit 1
@@ -333,9 +330,13 @@ nginx_build_config() {
SPDY_SUPPORTED="$(is_spdy_enabled "$NGINX_VERSION")"
HTTP2_SUPPORTED="$(is_http2_enabled "$NGINX_VERSION")"
HTTP2_PUSH_SUPPORTED="$(is_http2_push_enabled "$NGINX_VERSION")"
GRPC_SUPPORTED="$(is_grpc_enabled "$NGINX_VERSION")"
PROXY_PORT_MAP=$(echo "$PROXY_PORT_MAP" | xargs) # trailing spaces mess up default template
local NGINX_LOG_ROOT="/var/log/nginx"
fn-nginx-vhosts-uses-openresty && NGINX_LOG_ROOT="/var/log/openresty"
if [[ -z "$DOKKU_APP_LISTENERS" ]]; then
dokku_log_warn_quiet "No web listeners specified for $APP"
elif (is_deployed "$APP"); then
@@ -366,7 +367,9 @@ nginx_build_config() {
PASSED_LISTEN_IP_PORT="$PASSED_LISTEN_IP_PORT"
SPDY_SUPPORTED="$SPDY_SUPPORTED"
HTTP2_SUPPORTED="$HTTP2_SUPPORTED"
NGINX_LOG_ROOT="$NGINX_LOG_ROOT"
HTTP2_PUSH_SUPPORTED="$HTTP2_PUSH_SUPPORTED"
GRPC_SUPPORTED="$GRPC_SUPPORTED"
DOKKU_APP_LISTEN_PORT="$DOKKU_APP_LISTEN_PORT" DOKKU_APP_LISTEN_IP="$DOKKU_APP_LISTEN_IP"
APP_SSL_PATH="$APP_SSL_PATH" SSL_INUSE="$SSL_INUSE" SSL_SERVER_NAME="$SSL_SERVER_NAME"
# @TODO: Remove this after a few versions
@@ -381,11 +384,10 @@ nginx_build_config() {
dokku_log_info1 "Creating $SCHEME nginx.conf"
mv "$NGINX_CONF" "$DOKKU_ROOT/$APP/nginx.conf"
dokku_log_info1 "Running nginx-pre-reload"
plugn trigger nginx-pre-reload "$APP" "$DOKKU_APP_LISTEN_PORT" "$DOKKU_APP_LISTEN_IP"
dokku_log_verbose "Reloading nginx"
validate_nginx && restart_nginx
validate_nginx && restart_nginx >/dev/null
fi
if ([[ -n "$NONSSL_VHOSTS" ]] || [[ -n "$SSL_VHOSTS" ]]) && [[ "$IS_APP_VHOST_ENABLED" == "true" ]]; then
@@ -401,7 +403,7 @@ nginx_build_config() {
if (is_deployed "$APP"); then
dokku_log_info1 "reloading nginx after nginx.conf deletion"
validate_nginx && restart_nginx
validate_nginx && restart_nginx >/dev/null
fi
fi
fi

85
plugins/nginx-vhosts/install
View File

@@ -3,63 +3,81 @@ set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
source "$PLUGIN_AVAILABLE_PATH/config/functions"
source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/internal-functions"
NGINX_BIN="$(fn-nginx-vhosts-nginx-location)"
NGINX_ROOT="/etc/nginx"
NGINX_LOG_ROOT="/var/log/nginx"
NGINX_INIT_NAME="nginx"
NGINX_SUDOERS_FILE="/etc/sudoers.d/dokku-nginx"
if fn-nginx-vhosts-uses-openresty; then
NGINX_ROOT="/usr/local/openresty/nginx/conf"
NGINX_LOG_ROOT="/var/log/openresty"
NGINX_INIT_NAME="openresty"
NGINX_SUDOERS_FILE="/etc/sudoers.d/dokku-openresty"
fi
case "$DOKKU_DISTRO" in
debian)
echo "%dokku ALL=(ALL) NOPASSWD:/usr/sbin/invoke-rc.d nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/usr/sbin/invoke-rc.d $NGINX_INIT_NAME reload, $NGINX_BIN -t, ${NGINX_BIN} -t -c *" >"$NGINX_SUDOERS_FILE"
;;
ubuntu)
echo "%dokku ALL=(ALL) NOPASSWD:/etc/init.d/nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
if [[ -x /usr/bin/sv ]]; then
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/sv reload $NGINX_INIT_NAME, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
else
echo "%dokku ALL=(ALL) NOPASSWD:/etc/init.d/$NGINX_INIT_NAME reload, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
fi
;;
opensuse)
echo "%dokku ALL=(ALL) NOPASSWD:/sbin/service nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/sbin/service $NGINX_INIT_NAME reload, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
;;
arch)
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload nginx, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload $NGINX_INIT_NAME, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
;;
centos | rhel)
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload nginx, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" >/etc/sudoers.d/dokku-nginx
echo "Defaults:dokku !requiretty" >>/etc/sudoers.d/dokku-nginx
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload $NGINX_INIT_NAME, $NGINX_BIN -t, $NGINX_BIN -t -c *" >"$NGINX_SUDOERS_FILE"
echo "Defaults:dokku !requiretty" >>"$NGINX_SUDOERS_FILE"
;;
esac
chmod 0440 /etc/sudoers.d/dokku-nginx
chmod 0440 "$NGINX_SUDOERS_FILE"
# if dhparam.pem has not been created, create it the first time
if [[ ! -f /etc/nginx/dhparam.pem ]]; then
openssl dhparam -out /etc/nginx/dhparam.pem 2048
if [[ ! -f "$NGINX_ROOT/dhparam.pem" ]]; then
openssl dhparam -out "$NGINX_ROOT/dhparam.pem" 2048
fi
mkdir -p /etc/nginx/conf.d
chown root:root /etc/nginx/dhparam.pem
chown root:root /etc/nginx/conf.d
cat <<EOF >/etc/nginx/conf.d/dokku.conf
mkdir -p "$NGINX_ROOT/conf.d"
chown root:root "$NGINX_ROOT/dhparam.pem"
chown root:root "$NGINX_ROOT/conf.d"
cat <<EOF >"$NGINX_ROOT/conf.d/dokku.conf"
include $DOKKU_ROOT/*/nginx.conf;
server_tokens off;
# Settings from https://mozilla.github.io/server-side-tls/ssl-config-generator/
ssl_session_cache shared:SSL:20m;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 1d;
ssl_session_tickets on;
ssl_session_tickets off;
ssl_dhparam /etc/nginx/dhparam.pem;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
ssl_dhparam $NGINX_ROOT/dhparam.pem;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
EOF
# allow users to override their server_names_hash_bucket_size
if [[ ! -f /etc/nginx/conf.d/server_names_hash_bucket_size.conf ]]; then
echo 'server_names_hash_bucket_size 512;' >|/etc/nginx/conf.d/server_names_hash_bucket_size.conf
if [[ ! -f "$NGINX_ROOT/conf.d/server_names_hash_bucket_size.conf" ]]; then
echo 'server_names_hash_bucket_size 512;' >|"$NGINX_ROOT/conf.d/server_names_hash_bucket_size.conf"
fi
# revert dokku group changes
mkdir -p "$NGINX_LOG_ROOT"
gpasswd -a dokku adm
chgrp --quiet -R adm /var/log/nginx
chgrp --quiet -R adm "$NGINX_LOG_ROOT"
gpasswd -M "$(egrep ^dokku: /etc/group | awk -F ":" '{ print $4 }')" dokku
[[ -f /etc/logrotate.d/nginx ]] && sed -i -e 's/create 0640 www-data dokku/create 0640 www-data adm/g' /etc/logrotate.d/nginx
@@ -93,24 +111,9 @@ for app in $(dokku_apps); do
fi
done
case "$DOKKU_DISTRO" in
debian)
NGINX_INIT="/usr/sbin/invoke-rc.d"
"$NGINX_INIT" nginx start || "$NGINX_INIT" nginx reload
;;
ubuntu)
NGINX_INIT="/etc/init.d/nginx"
"$NGINX_INIT" start || "$NGINX_INIT" reload
;;
opensuse)
NGINX_INIT="/sbin/service"
"$NGINX_INIT" nginx start || "$NGINX_INIT" nginx reload
;;
arch | centos | rhel)
NGINX_INIT="/usr/bin/systemctl"
"$NGINX_INIT" start nginx || "$NGINX_INIT" reload nginx
;;
esac
# avoid failing runit init calls on install
# the runit binaries are not yet available during dockerfile building
# and therefore both these calls will fail
if [[ ! -x /usr/bin/sv ]]; then
fn-nginx-vhosts-nginx-init-cmd start || fn-nginx-vhosts-nginx-init-cmd reload
fi

65
plugins/nginx-vhosts/internal-functions
View File

@@ -1,6 +1,71 @@
#!/usr/bin/env bash
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
fn-nginx-vhosts-uses-openresty() {
declare desc="returns whether openresty is in use or not"
if [[ -x /usr/bin/openresty ]]; then
return
fi
return 1
}
fn-nginx-vhosts-nginx-location() {
declare desc="check that nginx is at the expected location and return it"
local NGINX_LOCATION
NGINX_LOCATION=$(which nginx 2>/dev/null)
if [[ -z "$NGINX_LOCATION" ]]; then
NGINX_LOCATION="/usr/sbin/nginx"
fi
if fn-nginx-vhosts-uses-openresty; then
NGINX_LOCATION="/usr/bin/openresty"
fi
if [[ ! -x "$NGINX_LOCATION" ]]; then
dokku_log_fail "Could not find nginx binary in \$PATH or at '${NGINX_LOCATION}'."
fi
echo "$NGINX_LOCATION"
}
fn-nginx-vhosts-nginx-init-cmd() {
declare desc="start nginx for given distros"
declare CMD="$1"
local NGINX_INIT_NAME
NGINX_INIT_NAME=nginx
if fn-nginx-vhosts-uses-openresty; then
NGINX_INIT_NAME=openresty
fi
case "$DOKKU_DISTRO" in
debian)
sudo /usr/sbin/invoke-rc.d "$NGINX_INIT_NAME" "$CMD"
;;
ubuntu)
# support docker-based installations
if [[ -x /usr/bin/sv ]]; then
sudo /usr/bin/sv "$CMD" "$NGINX_INIT_NAME"
else
sudo "/etc/init.d/$NGINX_INIT_NAME" "$CMD"
fi
;;
opensuse)
sudo /sbin/service "$NGINX_INIT_NAME" "$CMD"
;;
arch | centos | rhel)
sudo /usr/bin/systemctl "$CMD" "$NGINX_INIT_NAME"
;;
esac
}
nginx_vhosts_validate_single_func() {
declare APP="$1" FLAG="$2"

2
plugins/nginx-vhosts/post-delete
View File

@@ -3,4 +3,4 @@ set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/functions"
restart_nginx "$@"
restart_nginx "$@" >/dev/null

51
plugins/nginx-vhosts/templates/nginx.conf.sigil
View File

@@ -9,8 +9,8 @@ server {
listen [::]:{{ $listen_port }};
listen {{ $listen_port }};
{{ if $.NOSSL_SERVER_NAME }}server_name {{ $.NOSSL_SERVER_NAME }}; {{ end }}
access_log /var/log/nginx/{{ $.APP }}-access.log;
error_log /var/log/nginx/{{ $.APP }}-error.log;
access_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-access.log;
error_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-error.log;
{{ if (and (eq $listen_port "80") ($.SSL_INUSE)) }}
return 301 https://$host:{{ $.PROXY_SSL_PORT }}$request_uri;
{{ else }}
@@ -60,13 +60,13 @@ server {
listen {{ $listen_port }} ssl {{ if eq $.HTTP2_SUPPORTED "true" }}http2{{ else if eq $.SPDY_SUPPORTED "true" }}spdy{{ end }};
{{ if $.SSL_SERVER_NAME }}server_name {{ $.SSL_SERVER_NAME }}; {{ end }}
{{ if $.NOSSL_SERVER_NAME }}server_name {{ $.NOSSL_SERVER_NAME }}; {{ end }}
access_log /var/log/nginx/{{ $.APP }}-access.log;
error_log /var/log/nginx/{{ $.APP }}-error.log;
access_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-access.log;
error_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-error.log;
ssl_certificate {{ $.APP_SSL_PATH }}/server.crt;
ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key;
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_certificate {{ $.APP_SSL_PATH }}/server.crt;
ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
keepalive_timeout 70;
{{ if and (eq $.SPDY_SUPPORTED "true") (ne $.HTTP2_SUPPORTED "true") }}add_header Alternate-Protocol {{ $.PROXY_SSL_PORT }}:npn-spdy/2;{{ end }}
@@ -117,7 +117,42 @@ server {
internal;
}
}
{{ else if eq $scheme "grpc"}}
{{ if eq $.GRPC_SUPPORTED "true"}}{{ if eq $.HTTP2_SUPPORTED "true"}}
server {
listen [::]:{{ $listen_port }} http2;
listen {{ $listen_port }} http2;
{{ if $.NOSSL_SERVER_NAME }}server_name {{ $.NOSSL_SERVER_NAME }}; {{ end }}
access_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-access.log;
error_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-error.log;
location / {
grpc_pass grpc://{{ $.APP }}-{{ $upstream_port }};
}
include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf;
}
{{ end }}{{ end }}
{{ else if eq $scheme "grpcs"}}
{{ if eq $.GRPC_SUPPORTED "true"}}{{ if eq $.HTTP2_SUPPORTED "true"}}
server {
listen [::]:{{ $listen_port }} ssl http2;
listen {{ $listen_port }} ssl http2;
{{ if $.NOSSL_SERVER_NAME }}server_name {{ $.NOSSL_SERVER_NAME }}; {{ end }}
access_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-access.log;
error_log {{ $.NGINX_LOG_ROOT }}/{{ $.APP }}-error.log;
ssl_certificate {{ $.APP_SSL_PATH }}/server.crt;
ssl_certificate_key {{ $.APP_SSL_PATH }}/server.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
location / {
grpc_pass grpc://{{ $.APP }}-{{ $upstream_port }};
}
include {{ $.DOKKU_ROOT }}/{{ $.APP }}/nginx.conf.d/*.conf;
}
{{ end }}{{ end }}
{{ end }}
{{ end }}
{{ if $.DOKKU_APP_LISTENERS }}
{{ range $upstream_port := $.PROXY_UPSTREAM_PORTS | split " " }}