Update nginx (#662)

2025-12-17 21:24:20 +01:00 · 2019-08-16 21:30:24 +02:00
parent 68f528b258
commit e838d29a26
5 changed files with 22 additions and 6 deletions
--- a/nginx_proxy/data/nginx.conf
+++ b/nginx_proxy/data/nginx.conf
@@ -0,0 +1,67 @@
+daemon off;
+error_log stderr;
+pid /var/run/nginx.pid;
+
+events {
+	worker_connections 1024;
+}
+
+http {
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+    
+    server_names_hash_bucket_size 64;
+
+    server {
+        server_name _;
+        listen [::]:80 default_server ipv6only=off;
+        listen [::]:443 ssl http2 default_server ipv6only=off;
+        ssl_certificate /data/ssl-cert-snakeoil.pem;
+        ssl_certificate_key /data/ssl-cert-snakeoil.key;
+        return 444;
+    }
+
+    server {
+        server_name %%DOMAIN%%;
+
+        # These shouldn't need to be changed
+        listen [::]:80;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        server_name %%DOMAIN%%;
+
+        ssl_certificate /ssl/%%FULLCHAIN%%;
+        ssl_certificate_key /ssl/%%PRIVKEY%%;
+
+        # dhparams file
+        ssl_dhparam /data/dhparams.pem;
+
+        listen [::]:443 http2;
+        %%HSTS%%
+        ssl on;
+        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+        ssl_prefer_server_ciphers on;
+        ssl_session_cache shared:SSL:10m;
+
+        proxy_buffering off;
+
+        #include /share/nginx_proxy_default*.conf;
+
+        location / {
+            proxy_pass http://homeassistant.local.hass.io:8123;
+            proxy_set_header Host $host;
+            proxy_redirect http:// https://;
+            proxy_http_version 1.1;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+        }
+    }
+
+    #include /share/nginx_proxy/*.conf;
+}
--- a/nginx_proxy/data/run.sh
+++ b/nginx_proxy/data/run.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+set -e
+
+CONFIG_PATH=/data/options.json
+DHPARAMS_PATH=/data/dhparams.pem
+
+SNAKEOIL_CERT=/data/ssl-cert-snakeoil.pem
+SNAKEOIL_KEY=/data/ssl-cert-snakeoil.key
+
+DOMAIN=$(jq --raw-output ".domain" $CONFIG_PATH)
+KEYFILE=$(jq --raw-output ".keyfile" $CONFIG_PATH)
+CERTFILE=$(jq --raw-output ".certfile" $CONFIG_PATH)
+HSTS=$(jq --raw-output ".hsts // empty" $CONFIG_PATH)
+CUSTOMIZE_ACTIVE=$(jq --raw-output ".customize.active" $CONFIG_PATH)
+
+# Generate dhparams
+if [ ! -f "$DHPARAMS_PATH" ]; then
+    echo "[INFO] Generating dhparams (this will take some time)..."
+    openssl dhparam -dsaparam -out "$DHPARAMS_PATH" 4096 > /dev/null
+fi
+
+if [ ! -f "$SNAKEOIL_CERT" ]; then
+    echo "[INFO] Creating 'snakeoil' self-signed certificate..."
+    openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout $SNAKEOIL_KEY -out $SNAKEOIL_CERT -subj '/CN=localhost'
+fi
+
+# Prepare config file
+sed -i "s/%%FULLCHAIN%%/$CERTFILE/g" /etc/nginx.conf
+sed -i "s/%%PRIVKEY%%/$KEYFILE/g" /etc/nginx.conf
+sed -i "s/%%DOMAIN%%/$DOMAIN/g" /etc/nginx.conf
+
+[ -n "$HSTS" ] && HSTS="add_header Strict-Transport-Security \"$HSTS\";"
+sed -i "s/%%HSTS%%/$HSTS/g" /etc/nginx.conf
+
+# Allow customize configs from share
+if [ "$CUSTOMIZE_ACTIVE" == "true" ]; then
+    CUSTOMIZE_DEFAULT=$(jq --raw-output ".customize.default" $CONFIG_PATH)
+    sed -i "s|#include /share/nginx_proxy_default.*|include /share/$CUSTOMIZE_DEFAULT;|" /etc/nginx.conf
+    CUSTOMIZE_SERVERS=$(jq --raw-output ".customize.servers" $CONFIG_PATH)
+    sed -i "s|#include /share/nginx_proxy/.*|include /share/$CUSTOMIZE_SERVERS;|" /etc/nginx.conf
+fi
+
+# start server
+echo "[INFO] Running nginx..."
+exec nginx -c /etc/nginx.conf < /dev/null