61a306664f
This allows other plugins to avoid understanding the underlying details of how domains might be integrated with.
498 lines
19 KiB
Bash
Executable File
498 lines
19 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
|
|
source "$PLUGIN_AVAILABLE_PATH/certs/functions"
|
|
source "$PLUGIN_AVAILABLE_PATH/config/functions"
|
|
source "$PLUGIN_AVAILABLE_PATH/ps/functions"
|
|
source "$PLUGIN_AVAILABLE_PATH/nginx-vhosts/internal-functions"
|
|
|
|
fn-nginx-log-root() {
|
|
declare desc="get the nginx log root"
|
|
local NGINX_LOG_ROOT="/var/log/nginx"
|
|
fn-nginx-vhosts-uses-openresty && NGINX_LOG_ROOT="/var/log/openresty"
|
|
echo "$NGINX_LOG_ROOT"
|
|
}
|
|
|
|
fn-nginx-access-log-path() {
|
|
declare desc="get the configured access log path"
|
|
declare APP="$1"
|
|
local NGINX_LOG_ROOT="$(fn-nginx-log-root)"
|
|
|
|
fn-plugin-property-get-default "nginx" "$APP" "access-log-path" "${NGINX_LOG_ROOT}/${APP}-access.log"
|
|
}
|
|
|
|
fn-nginx-error-log-path() {
|
|
declare desc="get the configured access log path"
|
|
declare APP="$1"
|
|
local NGINX_LOG_ROOT="$(fn-nginx-log-root)"
|
|
|
|
fn-plugin-property-get-default "nginx" "$APP" "error-log-path" "${NGINX_LOG_ROOT}/${APP}-error.log"
|
|
}
|
|
|
|
get_nginx_location() {
|
|
declare desc="check that nginx is at the expected location and return it"
|
|
fn-nginx-vhosts-nginx-location
|
|
}
|
|
|
|
validate_nginx() {
|
|
declare desc="validate entire nginx config"
|
|
declare APP="${1:-}" FLAG="${2:-}"
|
|
local NGINX_LOCATION EXIT_CODE
|
|
NGINX_LOCATION=$(get_nginx_location)
|
|
if [[ -z "$NGINX_LOCATION" ]]; then
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$APP" == "--clean" ]]; then
|
|
APP=""
|
|
FLAG="--clean"
|
|
fi
|
|
|
|
set +e
|
|
sudo "$NGINX_LOCATION" -t >/dev/null 2>&1
|
|
EXIT_CODE=$?
|
|
set -e
|
|
if [[ "$EXIT_CODE" -eq "0" ]]; then
|
|
return
|
|
fi
|
|
|
|
if [[ -n "$APP" ]]; then
|
|
nginx_vhosts_validate_single_func "$APP" "$FLAG"
|
|
else
|
|
for app in $(dokku_apps); do
|
|
nginx_vhosts_validate_single_func "$app" "$FLAG"
|
|
done
|
|
fi
|
|
|
|
set +e
|
|
sudo "$NGINX_LOCATION" -t >/dev/null 2>&1
|
|
EXIT_CODE=$?
|
|
set -e
|
|
if [[ "$EXIT_CODE" -eq "0" ]]; then
|
|
return
|
|
fi
|
|
|
|
sudo "$NGINX_LOCATION" -t
|
|
exit $?
|
|
}
|
|
|
|
restart_nginx() {
|
|
declare desc="restart nginx for given distros"
|
|
fn-nginx-vhosts-nginx-init-cmd "reload"
|
|
}
|
|
|
|
nginx_logs() {
|
|
declare desc="display app nginx logs"
|
|
declare NGINX_LOGS_TYPE="${1#nginx:}" APP="$2"
|
|
verify_app_name "$APP"
|
|
|
|
local NGINX_LOGS_TYPE=${NGINX_LOGS_TYPE%-logs}
|
|
local NGINX_LOGS_PATH="$("fn-nginx-${NGINX_LOGS_TYPE}-log-path" "$APP")"
|
|
|
|
if [[ "$NGINX_LOGS_PATH" == "off" ]] || [[ "$NGINX_LOGS_PATH" == "/dev/null" ]]; then
|
|
dokku_log_fail "$NGINX_LOGS_TYPE logs are disabled for this app"
|
|
fi
|
|
|
|
if [[ $3 == "-t" ]]; then
|
|
local NGINX_LOGS_ARGS="-F"
|
|
else
|
|
local NGINX_LOGS_ARGS="-n 20"
|
|
fi
|
|
|
|
tail "$NGINX_LOGS_ARGS" "$NGINX_LOGS_PATH"
|
|
}
|
|
|
|
configure_nginx_ports() {
|
|
declare desc="configure nginx listening ports"
|
|
local APP=$1
|
|
verify_app_name "$APP"
|
|
local RAW_TCP_PORTS="$(get_app_raw_tcp_ports "$APP")"
|
|
local DOKKU_PROXY_PORT=$(config_get "$APP" DOKKU_PROXY_PORT)
|
|
local DOKKU_PROXY_SSL_PORT=$(config_get "$APP" DOKKU_PROXY_SSL_PORT)
|
|
local DOKKU_PROXY_PORT_MAP=$(config_get "$APP" DOKKU_PROXY_PORT_MAP)
|
|
local IS_APP_VHOST_ENABLED=true
|
|
local UPSTREAM_PORT="5000"
|
|
plugn trigger domains-vhost-enabled "$APP" || IS_APP_VHOST_ENABLED=false
|
|
|
|
if [[ -z "$DOKKU_PROXY_PORT" ]] && [[ -z "$RAW_TCP_PORTS" ]]; then
|
|
if [[ "$IS_APP_VHOST_ENABLED" == "false" ]]; then
|
|
dokku_log_info1 "no proxy port set. setting to random open high port"
|
|
local PROXY_PORT=$(get_available_port)
|
|
else
|
|
local PROXY_PORT=$(config_get --global DOKKU_PROXY_PORT)
|
|
PROXY_PORT=${PROXY_PORT:=80}
|
|
fi
|
|
DOKKU_QUIET_OUTPUT=1 config_set --no-restart "$APP" DOKKU_PROXY_PORT="$PROXY_PORT"
|
|
fi
|
|
if [[ -z "$DOKKU_PROXY_SSL_PORT" ]]; then
|
|
if (is_ssl_enabled "$APP"); then
|
|
local PROXY_SSL_PORT=$(config_get --global DOKKU_PROXY_SSL_PORT)
|
|
PROXY_SSL_PORT=${PROXY_SSL_PORT:=443}
|
|
if [[ -z "$RAW_TCP_PORTS" ]] && [[ "$IS_APP_VHOST_ENABLED" == "false" ]]; then
|
|
dokku_log_info1 "no proxy ssl port set. setting to random open high port"
|
|
PROXY_SSL_PORT=$(get_available_port)
|
|
fi
|
|
DOKKU_QUIET_OUTPUT=1 config_set --no-restart "$APP" DOKKU_PROXY_SSL_PORT="$PROXY_SSL_PORT"
|
|
fi
|
|
fi
|
|
if [[ -z "$DOKKU_PROXY_PORT_MAP" ]]; then
|
|
if [[ -n "$RAW_TCP_PORTS" ]]; then
|
|
local RAW_TCP_PORT
|
|
for RAW_TCP_PORT in $RAW_TCP_PORTS; do
|
|
local PROXY_PORT_MAP+=" http:${RAW_TCP_PORT}:${RAW_TCP_PORT} "
|
|
done
|
|
else
|
|
local PROXY_PORT=${PROXY_PORT:-$DOKKU_PROXY_PORT}
|
|
local PROXY_SSL_PORT=${PROXY_SSL_PORT:-$DOKKU_PROXY_SSL_PORT}
|
|
[[ -f "$DOKKU_ROOT/$APP/PORT.web.1" ]] && local UPSTREAM_PORT="$(<"$DOKKU_ROOT/$APP/PORT.web.1")"
|
|
if [[ -n "$PROXY_PORT" ]] && [[ -n "$PROXY_SSL_PORT" ]]; then
|
|
local PROXY_PORT_MAP+=" http:${PROXY_PORT}:$UPSTREAM_PORT https:${PROXY_SSL_PORT}:$UPSTREAM_PORT "
|
|
elif [[ -n "$PROXY_PORT" ]]; then
|
|
local PROXY_PORT_MAP+=" http:${PROXY_PORT}:$UPSTREAM_PORT "
|
|
fi
|
|
fi
|
|
if [[ -n "$PROXY_PORT_MAP" ]]; then
|
|
local PROXY_PORT_MAP="$(echo "$PROXY_PORT_MAP" | xargs)"
|
|
local PROXY_PORT_MAP+=" $(merge_dedupe_list "$(remove_val_from_list "$PORT_MAP" "$DOKKU_PROXY_PORT_MAP" " ")" " ") "
|
|
DOKKU_QUIET_OUTPUT=1 config_set --no-restart "$APP" DOKKU_PROXY_PORT_MAP="$PROXY_PORT_MAP"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
validate_ssl_domains() {
|
|
declare desc="check configured domains against SSL cert contents and show warning if mismatched"
|
|
local APP=$1
|
|
verify_app_name "$APP"
|
|
local VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"
|
|
local SSL_HOSTNAME=$(get_ssl_hostnames "$APP")
|
|
local SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | xargs | sed 's|\.|\\.|g' | sed 's/\*/\[^\.\]\*/g' | sed 's/ /|/g')
|
|
|
|
if ! (grep -q -E "^${SSL_HOSTNAME_REGEX}$" "$VHOST_PATH" &>/dev/null); then
|
|
dokku_log_info1 "No matching configured domains for $APP found in SSL certificate. Your app will show as insecure in a browser if accessed via SSL"
|
|
dokku_log_info1 "Please add appropriate domains via the dokku domains command"
|
|
[[ -n "$NONSSL_VHOSTS" ]] && dokku_log_info1 "Configured domains for app:"
|
|
local domain
|
|
for domain in $(echo "$NONSSL_VHOSTS" | xargs); do
|
|
dokku_log_info2 "$domain"
|
|
done
|
|
[[ -n "$SSL_HOSTNAME" ]] && dokku_log_info1 "Domains found in SSL certificate:"
|
|
for domain in $(echo "$SSL_HOSTNAME" | xargs); do
|
|
dokku_log_info2 "$domain"
|
|
done
|
|
fi
|
|
}
|
|
|
|
get_custom_nginx_template() {
|
|
declare desc="attempts to copy custom nginx template from app image"
|
|
local APP="$1"
|
|
verify_app_name "$APP"
|
|
local DESTINATION_FILE="$2"
|
|
local IMAGE_TAG="$(get_running_image_tag "$APP")"
|
|
local IMAGE=$(get_deploying_app_image_name "$APP" "$IMAGE_TAG")
|
|
local NGINX_TEMPLATE_NAME="nginx.conf.sigil"
|
|
|
|
copy_from_image "$IMAGE" "$NGINX_TEMPLATE_NAME" "$DESTINATION_FILE" 2>/dev/null || true
|
|
}
|
|
|
|
is_tls13_available() {
|
|
declare desc="detects whether the installed nginx version has TLSv1.3 support"
|
|
local NGINX_VERSION="$1"
|
|
local MAJOR_VERSION MINOR_VERSION PATCH_VERSION
|
|
local HAS_SUPPORT=false
|
|
|
|
MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}')
|
|
MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}')
|
|
PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}')
|
|
if [[ "$MAJOR_VERSION" -ge "2" ]]; then
|
|
HAS_SUPPORT=true
|
|
elif [[ "$MAJOR_VERSION" -eq "1" ]] && [[ "$MINOR_VERSION" -ge "13" ]]; then
|
|
HAS_SUPPORT=true
|
|
fi
|
|
|
|
echo $HAS_SUPPORT
|
|
}
|
|
|
|
is_spdy_enabled() {
|
|
declare desc="detects whether the installed nginx version has spdy support"
|
|
local NGINX_VERSION="$1"
|
|
local MAJOR_VERSION MINOR_VERSION PATCH_VERSION
|
|
local HAS_SUPPORT=true
|
|
|
|
MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}')
|
|
MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}')
|
|
PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}')
|
|
if [[ "$MAJOR_VERSION" -ge "2" ]]; then
|
|
HAS_SUPPORT=false
|
|
elif [[ "$MAJOR_VERSION" -eq "1" ]]; then
|
|
if [[ "$MINOR_VERSION" -ge "10" ]]; then
|
|
HAS_SUPPORT=false
|
|
elif [[ "$MINOR_VERSION" -ge "9" ]] && [[ "$PATCH_VERSION" -ge "5" ]]; then
|
|
HAS_SUPPORT=false
|
|
fi
|
|
fi
|
|
|
|
echo $HAS_SUPPORT
|
|
}
|
|
|
|
is_http2_push_enabled() {
|
|
declare desc="detects whether the installed nginx version has http2 push support"
|
|
local NGINX_VERSION="$1"
|
|
local MAJOR_VERSION MINOR_VERSION PATCH_VERSION
|
|
local HAS_SUPPORT=false
|
|
|
|
MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}')
|
|
MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}')
|
|
PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}')
|
|
if [[ "$MAJOR_VERSION" -ge "2" ]]; then
|
|
HAS_SUPPORT=true
|
|
elif [[ "$MAJOR_VERSION" -eq "1" ]]; then
|
|
if [[ "$MINOR_VERSION" -eq "13" ]] && [[ "$PATCH_VERSION" -ge "9" ]]; then
|
|
HAS_SUPPORT=true
|
|
elif [[ "$MINOR_VERSION" -ge "14" ]]; then
|
|
HAS_SUPPORT=true
|
|
fi
|
|
fi
|
|
|
|
echo $HAS_SUPPORT
|
|
}
|
|
|
|
is_http2_enabled() {
|
|
declare desc="detects whether the installed nginx version has http2 support"
|
|
local NGINX_VERSION="$1"
|
|
local MAJOR_VERSION MINOR_VERSION PATCH_VERSION
|
|
local HAS_SUPPORT=false
|
|
|
|
MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}')
|
|
MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}')
|
|
PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}')
|
|
if [[ "$MAJOR_VERSION" -ge "2" ]]; then
|
|
HAS_SUPPORT=true
|
|
elif [[ "$MAJOR_VERSION" -eq "1" ]]; then
|
|
if [[ "$MINOR_VERSION" -eq "11" ]] && [[ "$PATCH_VERSION" -ge "5" ]]; then
|
|
HAS_SUPPORT=true
|
|
elif [[ "$MINOR_VERSION" -ge "12" ]]; then
|
|
HAS_SUPPORT=true
|
|
fi
|
|
fi
|
|
|
|
echo $HAS_SUPPORT
|
|
}
|
|
|
|
is_grpc_enabled() {
|
|
declare desc="detects whether the installed nginx version has grpc support"
|
|
local NGINX_VERSION="$1"
|
|
local MAJOR_VERSION MINOR_VERSION PATCH_VERSION
|
|
local HAS_SUPPORT=false
|
|
|
|
MAJOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[1]}')
|
|
MINOR_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[2]}')
|
|
PATCH_VERSION=$(echo "$NGINX_VERSION" | awk '{split($0,a,"."); print a[3]}')
|
|
if [[ "$MAJOR_VERSION" -ge "2" ]]; then
|
|
HAS_SUPPORT=true
|
|
elif [[ "$MAJOR_VERSION" -eq "1" ]]; then
|
|
if [[ "$MINOR_VERSION" -eq "13" ]] && [[ "$PATCH_VERSION" -ge "10" ]]; then
|
|
HAS_SUPPORT=true
|
|
elif [[ "$MINOR_VERSION" -ge "14" ]]; then
|
|
HAS_SUPPORT=true
|
|
fi
|
|
fi
|
|
|
|
echo $HAS_SUPPORT
|
|
}
|
|
|
|
nginx_build_config() {
|
|
declare desc="build nginx config to proxy app containers using sigil"
|
|
local APP="$1"
|
|
verify_app_name "$APP"
|
|
local DOKKU_APP_LISTEN_PORT="$2"
|
|
local DOKKU_APP_LISTEN_IP="$3"
|
|
local VHOST_PATH="$DOKKU_ROOT/$APP/VHOST"
|
|
local URLS_PATH="$DOKKU_ROOT/$APP/URLS"
|
|
local NGINX_TEMPLATE_NAME="nginx.conf.sigil"
|
|
local DEFAULT_NGINX_TEMPLATE="$PLUGIN_AVAILABLE_PATH/nginx-vhosts/templates/$NGINX_TEMPLATE_NAME"
|
|
local NGINX_TEMPLATE="$DEFAULT_NGINX_TEMPLATE"
|
|
local SCHEME=http
|
|
local NGINX_TEMPLATE_SOURCE="built-in"
|
|
local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
|
|
local RAW_TCP_PORTS="$(get_app_raw_tcp_ports "$APP")"
|
|
local DOKKU_APP_LISTENERS
|
|
|
|
local IS_APP_VHOST_ENABLED=true
|
|
plugn trigger domains-vhost-enabled "$APP" || IS_APP_VHOST_ENABLED=false
|
|
|
|
if [[ "$(plugn trigger proxy-is-enabled "$APP")" == "true" ]]; then
|
|
if [[ -z "$DOKKU_APP_LISTEN_PORT" ]] && [[ -z "$DOKKU_APP_LISTEN_IP" ]]; then
|
|
DOKKU_APP_LISTENERS="$(plugn trigger network-get-listeners "$APP" "web" | xargs)"
|
|
elif [[ -n "$DOKKU_APP_LISTEN_PORT" ]] && [[ -n "$DOKKU_APP_LISTEN_IP" ]]; then
|
|
local PASSED_LISTEN_IP_PORT=true
|
|
fi
|
|
|
|
# setup nginx listen ports
|
|
configure_nginx_ports "$APP"
|
|
local PROXY_PORT=$(config_get "$APP" DOKKU_PROXY_PORT)
|
|
local PROXY_SSL_PORT=$(config_get "$APP" DOKKU_PROXY_SSL_PORT)
|
|
local PROXY_PORT_MAP=$(config_get "$APP" DOKKU_PROXY_PORT_MAP)
|
|
|
|
local PORT_MAP
|
|
for PORT_MAP in $PROXY_PORT_MAP; do
|
|
local PROXY_UPSTREAM_PORT="$(awk -F ':' '{ print $3 }' <<<"$PORT_MAP")"
|
|
if [[ "$(is_val_in_list "$PROXY_UPSTREAM_PORT" "$PROXY_UPSTREAM_PORTS" " ")" == "false" ]]; then
|
|
local PROXY_UPSTREAM_PORTS+="$PROXY_UPSTREAM_PORT "
|
|
fi
|
|
done
|
|
local PROXY_UPSTREAM_PORTS="$(echo "$PROXY_UPSTREAM_PORTS" | xargs)"
|
|
|
|
local SSL_INUSE=
|
|
local NONSSL_VHOSTS=$(plugn trigger domains-list "$APP")
|
|
local NOSSL_SERVER_NAME=$(echo "$NONSSL_VHOSTS" | xargs)
|
|
if is_ssl_enabled "$APP"; then
|
|
local SSL_INUSE=true
|
|
local SCHEME=https
|
|
validate_ssl_domains "$APP"
|
|
local SSL_HOSTNAME=$(get_ssl_hostnames "$APP")
|
|
local SSL_HOSTNAME_REGEX=$(echo "$SSL_HOSTNAME" | xargs | sed 's|\.|\\.|g' | sed 's/\*/\[^\.\]\*/g' | sed 's/ /|/g')
|
|
|
|
if [[ "$IS_APP_VHOST_ENABLED" == "true" ]]; then
|
|
local SSL_VHOSTS=$(grep -E "^${SSL_HOSTNAME_REGEX}$" "$VHOST_PATH" || true)
|
|
else
|
|
local SSL_VHOSTS=$(<"$DOKKU_ROOT/HOSTNAME")
|
|
fi
|
|
local SSL_SERVER_NAME
|
|
local host
|
|
for host in $SSL_VHOSTS; do
|
|
# SSL_SERVER_NAME should only contain items not in NOSSL_SERVER_NAME
|
|
if [[ ! $NOSSL_SERVER_NAME =~ (^|[[:space:]])$host($|[[:space:]]) ]]; then
|
|
SSL_SERVER_NAME="${host}${SSL_SERVER_NAME:+ $SSL_SERVER_NAME}"
|
|
fi
|
|
done
|
|
fi
|
|
|
|
local NGINX_LOCATION NGINX_VERSION SPDY_SUPPORTED TLS13_SUPPORTED HTTP2_SUPPORTED HTTP2_PUSH_SUPPORTED GRPC_SUPPORTED
|
|
NGINX_LOCATION=$(get_nginx_location)
|
|
if [[ -z "$NGINX_LOCATION" ]]; then
|
|
exit 1
|
|
fi
|
|
NGINX_VERSION="$("$NGINX_LOCATION" -v 2>&1 | cut -d'/' -f 2)"
|
|
SPDY_SUPPORTED="$(is_spdy_enabled "$NGINX_VERSION")"
|
|
TLS13_SUPPORTED="$(is_tls13_available "$NGINX_VERSION")"
|
|
HTTP2_SUPPORTED="$(is_http2_enabled "$NGINX_VERSION")"
|
|
HTTP2_PUSH_SUPPORTED="$(is_http2_push_enabled "$NGINX_VERSION")"
|
|
GRPC_SUPPORTED="$(is_grpc_enabled "$NGINX_VERSION")"
|
|
|
|
PROXY_PORT_MAP=$(echo "$PROXY_PORT_MAP" | xargs) # trailing spaces mess up default template
|
|
|
|
local NGINX_LOG_ROOT="$(fn-nginx-log-root)"
|
|
local NGINX_ACCESS_LOG_PATH="$(fn-nginx-access-log-path "$APP")"
|
|
local NGINX_ERROR_LOG_PATH="$(fn-nginx-error-log-path "$APP")"
|
|
|
|
if [[ -z "$DOKKU_APP_LISTENERS" ]]; then
|
|
dokku_log_warn_quiet "No web listeners specified for $APP"
|
|
elif (is_deployed "$APP"); then
|
|
local IMAGE_TAG=$(get_running_image_tag "$APP")
|
|
local IMAGE=$(get_deploying_app_image_name "$APP" "$IMAGE_TAG" 2>/dev/null)
|
|
if ! verify_image "$IMAGE" 2>/dev/null; then
|
|
dokku_log_fail "Missing image for app"
|
|
fi
|
|
|
|
local NGINX_BUILD_CONFIG_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
|
|
local NGINX_CONF=$(mktemp --tmpdir="${NGINX_BUILD_CONFIG_TMP_WORK_DIR}" "nginx.conf.XXXXXX")
|
|
local CUSTOM_NGINX_TEMPLATE="$NGINX_BUILD_CONFIG_TMP_WORK_DIR/$NGINX_TEMPLATE_NAME"
|
|
# shellcheck disable=SC2086
|
|
trap "rm -rf '$NGINX_CONF' '$NGINX_BUILD_CONFIG_TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
|
|
|
|
get_custom_nginx_template "$APP" "$CUSTOM_NGINX_TEMPLATE" 2>/dev/null
|
|
if [[ -f "$CUSTOM_NGINX_TEMPLATE" ]]; then
|
|
dokku_log_info1 'Overriding default nginx.conf with detected nginx.conf.sigil'
|
|
local NGINX_TEMPLATE="$CUSTOM_NGINX_TEMPLATE"
|
|
local NGINX_TEMPLATE_SOURCE="app-supplied"
|
|
fi
|
|
|
|
local NGINX_BIND_ADDRESS_IP4="$(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv4" "")"
|
|
local NGINX_BIND_ADDRESS_IP6="$(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv6" "::")"
|
|
[[ -z "$NGINX_BIND_ADDRESS_IP6" ]] && NGINX_BIND_ADDRESS_IP6="::"
|
|
|
|
local NGINX_ACCESS_LOGS_ENABLED="$(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv4" "")"
|
|
local NGINX_ERROR_LOGS_ENABLED="$(fn-plugin-property-get-default "nginx" "$APP" "bind-address-ipv6" "::")"
|
|
|
|
eval "$(config_export app "$APP")"
|
|
local SIGIL_PARAMS=(-f "$NGINX_TEMPLATE" APP="$APP" DOKKU_ROOT="$DOKKU_ROOT"
|
|
NOSSL_SERVER_NAME="$NOSSL_SERVER_NAME"
|
|
# Deprecated: Remove this after a few versions
|
|
DOKKU_APP_LISTENERS="$DOKKU_APP_LISTENERS"
|
|
DOKKU_LIB_ROOT="$DOKKU_LIB_ROOT"
|
|
PASSED_LISTEN_IP_PORT="$PASSED_LISTEN_IP_PORT"
|
|
SPDY_SUPPORTED="$SPDY_SUPPORTED"
|
|
TLS13_SUPPORTED="$TLS13_SUPPORTED"
|
|
HTTP2_SUPPORTED="$HTTP2_SUPPORTED"
|
|
NGINX_LOG_ROOT="$NGINX_LOG_ROOT"
|
|
NGINX_ACCESS_LOG_PATH="$NGINX_ACCESS_LOG_PATH"
|
|
NGINX_ERROR_LOG_PATH="$NGINX_ERROR_LOG_PATH"
|
|
NGINX_BIND_ADDRESS_IP4="$NGINX_BIND_ADDRESS_IP4"
|
|
NGINX_BIND_ADDRESS_IP6="$NGINX_BIND_ADDRESS_IP6"
|
|
HTTP2_PUSH_SUPPORTED="$HTTP2_PUSH_SUPPORTED"
|
|
GRPC_SUPPORTED="$GRPC_SUPPORTED"
|
|
DOKKU_APP_LISTEN_PORT="$DOKKU_APP_LISTEN_PORT" DOKKU_APP_LISTEN_IP="$DOKKU_APP_LISTEN_IP"
|
|
APP_SSL_PATH="$APP_SSL_PATH" SSL_INUSE="$SSL_INUSE" SSL_SERVER_NAME="$SSL_SERVER_NAME"
|
|
# Deprecated: Remove this after a few versions
|
|
NGINX_PORT="$PROXY_PORT" NGINX_SSL_PORT="$PROXY_SSL_PORT"
|
|
PROXY_PORT="$PROXY_PORT" PROXY_SSL_PORT="$PROXY_SSL_PORT" RAW_TCP_PORTS="$RAW_TCP_PORTS"
|
|
PROXY_PORT_MAP="$PROXY_PORT_MAP" PROXY_UPSTREAM_PORTS="$PROXY_UPSTREAM_PORTS")
|
|
|
|
local DOKKU_SCALE_FILE="$DOKKU_ROOT/$APP/DOKKU_SCALE"
|
|
while read -r line || [[ -n "$line" ]]; do
|
|
[[ "$line" =~ ^#.* ]] && continue
|
|
line="$(strip_inline_comments "$line")"
|
|
PROC_TYPE=${line%%=*}
|
|
LISTENERS="$(plugn trigger network-get-listeners "$APP" "$PROC_TYPE" | xargs)"
|
|
UPP_PROC_TYPE="${PROC_TYPE^^}"
|
|
UPP_PROC_TYPE="${UPP_PROC_TYPE//-/_}"
|
|
SIGIL_PARAMS+=( "DOKKU_APP_${UPP_PROC_TYPE}_LISTENERS=$LISTENERS" )
|
|
done <"$DOKKU_SCALE_FILE"
|
|
|
|
if grep DOKKU_APP_LISTENERS "$NGINX_TEMPLATE"; then
|
|
dokku_log_warn "Deprecated: Usage of DOKKU_APP_LISTENERS within nginx.conf.sigil templates is deprecated in favor of DOKKU_APP_WEB_LISTENERS"
|
|
fi
|
|
|
|
if grep NGINX_SSL_PORT "$NGINX_TEMPLATE"; then
|
|
dokku_log_warn "Deprecated: Usage of NGINX_SSL_PORT within nginx.conf.sigil templates is deprecated in favor of PROXY_SSL_PORT"
|
|
fi
|
|
|
|
if grep NGINX_PORT "$NGINX_TEMPLATE"; then
|
|
dokku_log_warn "Deprecated: Usage of NGINX_PORT within nginx.conf.sigil templates is deprecated in favor of PROXY_PORT"
|
|
fi
|
|
|
|
# execute sigil template processing
|
|
xargs -i echo "-----> Configuring {}...(using $NGINX_TEMPLATE_SOURCE template)" <<<"$(echo "${SSL_VHOSTS}" "${NONSSL_VHOSTS}" | tr ' ' '\n' | sort -u)"
|
|
sigil "${SIGIL_PARAMS[@]}" | cat -s >"$NGINX_CONF"
|
|
|
|
dokku_log_info1 "Creating $SCHEME nginx.conf"
|
|
mv "$NGINX_CONF" "$DOKKU_ROOT/$APP/nginx.conf"
|
|
|
|
fn-nginx-vhosts-manage-hsts "$APP" "$SSL_INUSE"
|
|
|
|
plugn trigger nginx-pre-reload "$APP" "$DOKKU_APP_LISTEN_PORT" "$DOKKU_APP_LISTEN_IP"
|
|
|
|
dokku_log_verbose "Reloading nginx"
|
|
validate_nginx && restart_nginx >/dev/null
|
|
fi
|
|
|
|
if ([[ -n "$NONSSL_VHOSTS" ]] || [[ -n "$SSL_VHOSTS" ]]) && [[ "$IS_APP_VHOST_ENABLED" == "true" ]]; then
|
|
echo "# THIS FILE IS GENERATED BY DOKKU - DO NOT EDIT, YOUR CHANGES WILL BE OVERWRITTEN" >"$URLS_PATH"
|
|
xargs -i echo "$SCHEME://{}" <<<"$(echo "${SSL_VHOSTS}" "${NONSSL_VHOSTS}" | tr ' ' '\n' | sort -u)" >>"$URLS_PATH"
|
|
fi
|
|
else
|
|
# note because this clause is long. if the proxy is disabled:
|
|
dokku_log_info1 "nginx support is disabled for app ($APP)."
|
|
if [[ -f "$DOKKU_ROOT/$APP/nginx.conf" ]]; then
|
|
dokku_log_info1 "deleting nginx.conf"
|
|
rm "$DOKKU_ROOT/$APP/nginx.conf"
|
|
|
|
if (is_deployed "$APP"); then
|
|
dokku_log_info1 "reloading nginx after nginx.conf deletion"
|
|
validate_nginx && restart_nginx >/dev/null
|
|
fi
|
|
fi
|
|
fi
|
|
}
|