0909052816
- expose an nginx:validate command that can be used to show validation information - properly reference the invalid nginx config, rather than tell the user that another app's nginx config is invalid when deploying their own app - allow a user to cleanup bad nginx config files out of band when they are blocking a deploy _without_ requiring knowing where that nginx config is Note that this may have issues with generated nginx.conf files that depend on other apps or other parts of the nginx config. For now, this is acceptable, though it is something that needs to be field tested. Closes #3162
116 lines
4.3 KiB
Bash
Executable File
116 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
|
|
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
|
|
source "$PLUGIN_AVAILABLE_PATH/config/functions"
|
|
|
|
case "$DOKKU_DISTRO" in
|
|
debian)
|
|
echo "%dokku ALL=(ALL) NOPASSWD:/usr/sbin/invoke-rc.d nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" > /etc/sudoers.d/dokku-nginx
|
|
;;
|
|
|
|
ubuntu)
|
|
echo "%dokku ALL=(ALL) NOPASSWD:/etc/init.d/nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" > /etc/sudoers.d/dokku-nginx
|
|
;;
|
|
|
|
opensuse)
|
|
echo "%dokku ALL=(ALL) NOPASSWD:/sbin/service nginx reload, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" > /etc/sudoers.d/dokku-nginx
|
|
;;
|
|
|
|
arch)
|
|
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload nginx, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" > /etc/sudoers.d/dokku-nginx
|
|
;;
|
|
|
|
centos|rhel)
|
|
echo "%dokku ALL=(ALL) NOPASSWD:/usr/bin/systemctl reload nginx, /usr/sbin/nginx -t, /usr/sbin/nginx -t -c *" > /etc/sudoers.d/dokku-nginx
|
|
echo "Defaults:dokku !requiretty" >> /etc/sudoers.d/dokku-nginx
|
|
;;
|
|
esac
|
|
|
|
chmod 0440 /etc/sudoers.d/dokku-nginx
|
|
|
|
# if dhparam.pem has not been created, create it the first time
|
|
if [[ ! -f /etc/nginx/dhparam.pem ]]; then
|
|
openssl dhparam -out /etc/nginx/dhparam.pem 2048
|
|
fi
|
|
|
|
mkdir -p /etc/nginx/conf.d
|
|
chown root:root /etc/nginx/dhparam.pem
|
|
chown root:root /etc/nginx/conf.d
|
|
cat<<EOF > /etc/nginx/conf.d/dokku.conf
|
|
include $DOKKU_ROOT/*/nginx.conf;
|
|
|
|
server_tokens off;
|
|
|
|
# Settings from https://mozilla.github.io/server-side-tls/ssl-config-generator/
|
|
ssl_session_cache shared:SSL:20m;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_tickets on;
|
|
|
|
ssl_dhparam /etc/nginx/dhparam.pem;
|
|
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
|
|
|
|
EOF
|
|
|
|
# allow users to override their server_names_hash_bucket_size
|
|
if [[ ! -f /etc/nginx/conf.d/server_names_hash_bucket_size.conf ]]; then
|
|
echo 'server_names_hash_bucket_size 512;' >| /etc/nginx/conf.d/server_names_hash_bucket_size.conf
|
|
fi
|
|
|
|
# revert dokku group changes
|
|
gpasswd -a dokku adm
|
|
chgrp -R adm /var/log/nginx
|
|
gpasswd -M "$(egrep ^dokku: /etc/group | awk -F ":" '{ print $4 }')" dokku
|
|
[[ -f /etc/logrotate.d/nginx ]] && sed -i -e 's/create 0640 www-data dokku/create 0640 www-data adm/g' /etc/logrotate.d/nginx
|
|
|
|
# Create nginx error templates
|
|
mkdir -p "${DOKKU_LIB_ROOT}/data/nginx-vhosts/dokku-errors"
|
|
cp "${PLUGIN_CORE_AVAILABLE_PATH}/nginx-vhosts/templates/400-error.html" "${DOKKU_LIB_ROOT}/data/nginx-vhosts/dokku-errors/400-error.html"
|
|
cp "${PLUGIN_CORE_AVAILABLE_PATH}/nginx-vhosts/templates/404-error.html" "${DOKKU_LIB_ROOT}/data/nginx-vhosts/dokku-errors/404-error.html"
|
|
cp "${PLUGIN_CORE_AVAILABLE_PATH}/nginx-vhosts/templates/500-error.html" "${DOKKU_LIB_ROOT}/data/nginx-vhosts/dokku-errors/500-error.html"
|
|
|
|
|
|
# patch broken nginx 1.8.0 logrotate
|
|
[[ -f /etc/logrotate.d/nginx ]] && sed -i -e 's/invoke-rc.d/service/g' /etc/logrotate.d/nginx
|
|
|
|
# @TODO: Remove this after a few versions
|
|
dokku_log_info1 "Migrating DOKKU_NGINX env variables. The following variables will be migrated"
|
|
dokku_log_info2 "DOKKU_NGINX_PORT -> DOKKU_PROXY_PORT"
|
|
dokku_log_info2 "DOKKU_NGINX_SSL_PORT -> DOKKU_PROXY_SSL_PORT"
|
|
for app in $(dokku_apps); do
|
|
nginx_port="$(config_get "$app" DOKKU_NGINX_PORT || true)"
|
|
nginx_ssl_port="$(config_get "$app" DOKKU_NGINX_SSL_PORT || true)"
|
|
if [[ -n "$nginx_port" ]]; then
|
|
dokku_log_info1 "Migrating DOKKU_NGINX_PORT to DOKKU_PROXY_PORT for $app"
|
|
config_set --no-restart "$app" DOKKU_PROXY_PORT="$nginx_port"
|
|
config_unset --no-restart "$app" DOKKU_NGINX_PORT
|
|
fi
|
|
if [[ -n "$nginx_ssl_port" ]]; then
|
|
dokku_log_info1 "Migrating DOKKU_NGINX_SSL_PORT to DOKKU_PROXY_SSL_PORT for $app"
|
|
config_set --no-restart "$app" DOKKU_PROXY_SSL_PORT="$nginx_ssl_port"
|
|
config_unset --no-restart "$app" DOKKU_NGINX_SSL_PORT
|
|
fi
|
|
done
|
|
dokku_log_info2 "Migration complete"
|
|
|
|
case "$DOKKU_DISTRO" in
|
|
debian)
|
|
NGINX_INIT="/usr/sbin/invoke-rc.d"
|
|
"$NGINX_INIT" nginx start || "$NGINX_INIT" nginx reload
|
|
;;
|
|
|
|
ubuntu)
|
|
NGINX_INIT="/etc/init.d/nginx"
|
|
"$NGINX_INIT" start || "$NGINX_INIT" reload
|
|
;;
|
|
|
|
opensuse)
|
|
NGINX_INIT="/sbin/service"
|
|
"$NGINX_INIT" nginx start || "$NGINX_INIT" nginx reload
|
|
;;
|
|
|
|
arch|centos|rhel)
|
|
NGINX_INIT="/usr/bin/systemctl"
|
|
"$NGINX_INIT" start nginx || "$NGINX_INIT" reload nginx
|
|
;;
|
|
esac
|