From a977ef97cb1d88b617286fc07ea37a19c8b01e42 Mon Sep 17 00:00:00 2001 From: Jan Tuomi Date: Sun, 21 Dec 2025 10:26:52 +0200 Subject: Improve ingress --- templates/etc_jail.conf.d_[jailname].conf.j2 | 3 +- .../ingress/usr_local_etc_nginx_nginx.conf.j2 | 63 +++++++++------------- 2 files changed, 28 insertions(+), 38 deletions(-) (limited to 'templates') diff --git a/templates/etc_jail.conf.d_[jailname].conf.j2 b/templates/etc_jail.conf.d_[jailname].conf.j2 index 4c0bbc4..b4ed513 100644 --- a/templates/etc_jail.conf.d_[jailname].conf.j2 +++ b/templates/etc_jail.conf.d_[jailname].conf.j2 @@ -28,7 +28,6 @@ {% if ing.name == "ingress" -%} exec.poststart += "jexec ${name} route add default 192.168.2.{{ ing.num }} || echo 'Failed to add default route'"; exec.poststart += "jexec ${name} route add 10.6.210.0/24 192.168.0.1 || echo 'Failed to add Wireguard return route'"; - exec.poststart += "mount -t nullfs /usr/local/jails/containers/goaccess/var/www/goaccess /usr/local/jails/containers/ingress/mnt/www_goaccess" {% endif %} {% endfor %} {% else %} @@ -36,6 +35,7 @@ exec.poststart += "jexec ${name} ifconfig epw{{ jail.num }}b up"; exec.poststart += "ifconfig epw{{ jail.num }}a up"; exec.poststart += "jexec ${name} service dhclient restart epw{{ jail.num }}b"; + exec.poststart += "mount -t nullfs /usr/local/jails/containers/goaccess/var/www/goaccess /usr/local/jails/containers/ingress/mnt/www_goaccess"; {% endif %} exec.stop = "/bin/sh /etc/rc.shutdown"; @@ -43,6 +43,7 @@ exec.poststop += "ifconfig epl{{ jail.num }}a destroy"; {% if jail.name == "ingress" -%} exec.poststop += "ifconfig epw{{ jail.num }}a destroy"; + exec.poststop += "umount /usr/local/jails/containers/ingress/mnt/www_goaccess"; {% endif %} exec.consolelog = "/var/log/jail_console_${name}.log"; diff --git a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 index ae08d46..456a607 100644 --- a/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 +++ b/templates/ingress/usr_local_etc_nginx_nginx.conf.j2 @@ -28,8 +28,6 @@ http { } {% for route in ingress_routes -%} - {% if route.jail is defined -%} - {% for jail in jails if jail.name == route.jail -%} server { server_name {{ route.host }}; http2 on; @@ -40,20 +38,31 @@ http { # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 add_header Strict-Transport-Security "max-age=63072000" always; + # Common hardening headers + add_header X-Content-Type-Options nosniff always; + add_header X-Frame-Options DENY always; + add_header Referrer-Policy strict-origin-when-cross-origin always; + add_header Permissions-Policy interest-cohort=(); + + # Hide "Server: nginx/1.28.0" header + server_tokens off; + ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem; ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem; include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; + {% if route.jail is defined -%} + {% for jail in jails if jail.name == route.jail -%} location / { - proxy_pass http://192.168.2.{{ jail.num }}; + proxy_pass http://192.168.2.{{ jail.num }}{% if route.port is defined %}:{{ route.port }}{% endif %}; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; {% if jail.name == 'irc_thelounge' -%} proxy_http_version 1.1; - proxy_set_header Connection "upgrade"; + proxy_set_header Connection "Upgrade"; proxy_set_header Upgrade $http_upgrade; # by default nginx times out connections in one minute @@ -63,44 +72,24 @@ http { proxy_request_buffering off; client_max_body_size 100M; + {% elif jail.name == 'plex' -%} + proxy_http_version 1.1; + proxy_set_header Connection "Upgrade"; + proxy_set_header Upgrade $http_upgrade; + + # Streaming-friendly behavior + proxy_redirect off; + proxy_buffering off; + + # Long streams / slow clients + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; {% endif %} } - } {% endfor %} {% elif route.redirect is defined -%} - server { - server_name {{ route.host }}; - http2 on; - - listen 443 ssl; - listen [::]:443 ssl; - - # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 - add_header Strict-Transport-Security "max-age=63072000" always; - - ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem; - ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem; - include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; - return 307 https://{{ route.redirect }}$request_uri; - } {% elif route.ip is defined -%} - server { - server_name {{ route.host }}; - http2 on; - - listen 443 ssl; - listen [::]:443 ssl; - - # See https://ssl-config.mozilla.org/#server=nginx&version=1.28.0&config=intermediate&openssl=3.4.0&guideline=5.7 - add_header Strict-Transport-Security "max-age=63072000" always; - - ssl_certificate /usr/local/etc/letsencrypt/live/{{ cert_name }}/fullchain.pem; - ssl_certificate_key /usr/local/etc/letsencrypt/live/{{ cert_name }}/privkey.pem; - include /usr/local/etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem; - location / { proxy_pass http://{{ route.ip }}:{{ route.port }}; proxy_set_header Host $host; @@ -121,7 +110,7 @@ http { client_max_body_size 10G; } - } {% endif %} + } {% endfor %} } -- cgit v1.3