ba1f1bc30d
Adding additional proxy headers to match what Heroku provides. Also, X-Request-Start is compatible with NewRelic's latest agent[1]. [1]: http://blog.newrelic.com/2013/02/21/using-new-relic-on-heroku-read-how-our-new-ruby-agent-measures-queue-time/
81 lines
2.3 KiB
Bash
Executable File
81 lines
2.3 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
APP="$1"; PORT="$2"
|
|
WILDCARD_SSL="$HOME/ssl"
|
|
SSL="$HOME/$APP/ssl"
|
|
|
|
if [[ -f "$HOME/VHOST" ]]; then
|
|
VHOST=$(< "$HOME/VHOST")
|
|
SUBDOMAIN=${APP/%\.${VHOST}/}
|
|
if [[ "$APP" == *.* ]] && [[ "$SUBDOMAIN" == "$APP" ]]; then
|
|
hostname="${APP/\//-}"
|
|
else
|
|
hostname="${APP/\//-}.$VHOST"
|
|
fi
|
|
|
|
if [[ -f "$SSL/server.crt" ]] && [[ -f "$SSL/server.key" ]]; then
|
|
SSL_INUSE="$SSL"
|
|
elif [[ -f "$WILDCARD_SSL/server.crt" ]] && [[ -f "$WILDCARD_SSL/server.key" ]] && [[ $hostname = `openssl x509 -in $WILDCARD_SSL/server.crt -noout -subject | tr '/' '\n' | grep CN= | cut -c4-` ]]; then
|
|
SSL_INUSE="$WILDCARD_SSL"
|
|
fi
|
|
|
|
# ssl based nginx.conf
|
|
if [[ -n "$SSL_INUSE" ]]; then
|
|
cat<<EOF > $HOME/$APP/nginx.conf
|
|
upstream $APP { server 127.0.0.1:$PORT; }
|
|
server {
|
|
listen 80;
|
|
server_name $hostname;
|
|
return 301 https://\$host\$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443;
|
|
server_name $hostname;
|
|
|
|
ssl on;
|
|
ssl_certificate $SSL_INUSE/server.crt;
|
|
ssl_certificate_key $SSL_INUSE/server.key;
|
|
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
|
|
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
location / {
|
|
proxy_pass http://$APP;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host \$http_host;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
proxy_set_header X-Forwarded-For \$remote_addr;
|
|
proxy_set_header X-Forwarded-Port \$server_port;
|
|
proxy_set_header X-Request-Start \$msec;
|
|
}
|
|
}
|
|
EOF
|
|
else
|
|
# default nginx.conf
|
|
cat<<EOF > $HOME/$APP/nginx.conf
|
|
upstream $APP { server 127.0.0.1:$PORT; }
|
|
server {
|
|
listen 80;
|
|
server_name $hostname;
|
|
location / {
|
|
proxy_pass http://$APP;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host \$http_host;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
proxy_set_header X-Forwarded-For \$remote_addr;
|
|
proxy_set_header X-Forwarded-Port \$server_port;
|
|
proxy_set_header X-Request-Start \$msec;
|
|
}
|
|
}
|
|
EOF
|
|
fi
|
|
pluginhook nginx-pre-reload $APP
|
|
nc -U $HOME/reload-nginx
|
|
echo "$hostname" > "$HOME/$APP/VHOST"
|
|
fi
|