mirror of
https://github.com/aljazceru/addons.git
synced 2025-12-17 13:14:21 +01:00
25f9097e22
* nginx_proxy: Update run.sh info messages In particular, note that generating dhparams will take some time. * nginx_proxy: Bump version to 1.1 * nginx_proxy: Make HSTS configurable and optional Unconditional HSTS breaks unencrypted connections to non-standard HTTP ports on the same hostname. These ports be e.g. mapped outside of hassio/nginx, and this can not be always circumvented by proxying them beind nginx, because not all services behave properly behind a reverse proxy. Additionally, the unconditional HSTS includeSubDomains setting hardcodes assumptions about subdomains that hassio does not necessarily deal with at all. * fix style
46 lines
1.6 KiB
Bash
46 lines
1.6 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
CONFIG_PATH=/data/options.json
|
|
DHPARAMS_PATH=/data/dhparams.pem
|
|
|
|
SNAKEOIL_CERT=/data/ssl-cert-snakeoil.pem
|
|
SNAKEOIL_KEY=/data/ssl-cert-snakeoil.key
|
|
|
|
DOMAIN=$(jq --raw-output ".domain" $CONFIG_PATH)
|
|
KEYFILE=$(jq --raw-output ".keyfile" $CONFIG_PATH)
|
|
CERTFILE=$(jq --raw-output ".certfile" $CONFIG_PATH)
|
|
HSTS=$(jq --raw-output ".hsts // empty" $CONFIG_PATH)
|
|
CUSTOMIZE_ACTIVE=$(jq --raw-output ".customize.active" $CONFIG_PATH)
|
|
|
|
# Generate dhparams
|
|
if [ ! -f "$DHPARAMS_PATH" ]; then
|
|
echo "[INFO] Generating dhparams (this will take some time)..."
|
|
openssl dhparam -dsaparam -out "$DHPARAMS_PATH" 4096 > /dev/null
|
|
fi
|
|
|
|
if [ ! -f "$SNAKEOIL_CERT" ]; then
|
|
echo "[INFO] Creating 'snakeoil' self-signed certificate..."
|
|
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout $SNAKEOIL_KEY -out $SNAKEOIL_CERT -subj '/CN=localhost'
|
|
fi
|
|
|
|
# Prepare config file
|
|
sed -i "s/%%FULLCHAIN%%/$CERTFILE/g" /etc/nginx.conf
|
|
sed -i "s/%%PRIVKEY%%/$KEYFILE/g" /etc/nginx.conf
|
|
sed -i "s/%%DOMAIN%%/$DOMAIN/g" /etc/nginx.conf
|
|
|
|
[ -n "$HSTS" ] && HSTS="add_header Strict-Transport-Security \"$HSTS\";"
|
|
sed -i "s/%%HSTS%%/$HSTS/g" /etc/nginx.conf
|
|
|
|
# Allow customize configs from share
|
|
if [ "$CUSTOMIZE_ACTIVE" == "true" ]; then
|
|
CUSTOMIZE_DEFAULT=$(jq --raw-output ".customize.default" $CONFIG_PATH)
|
|
sed -i "s|#include /share/nginx_proxy_default.*|include /share/$CUSTOMIZE_DEFAULT;|" /etc/nginx.conf
|
|
CUSTOMIZE_SERVERS=$(jq --raw-output ".customize.servers" $CONFIG_PATH)
|
|
sed -i "s|#include /share/nginx_proxy/.*|include /share/$CUSTOMIZE_SERVERS;|" /etc/nginx.conf
|
|
fi
|
|
|
|
# start server
|
|
echo "[INFO] Running nginx..."
|
|
exec nginx -c /etc/nginx.conf < /dev/null
|