79 lines
3.7 KiB
Plaintext
79 lines
3.7 KiB
Plaintext
# ansipa reverse-proxy + portal — rendered by nginx's envsubst entrypoint.
|
|
# Placeholders (${VAR}) are filled from the container environment at start.
|
|
#
|
|
# Design: each backend is proxied at the path it ALREADY serves natively
|
|
# (FreeIPA /ipa, CheckMK /cmk, Keycloak under a configured /auth relative path),
|
|
# so no fragile path rewriting is needed and a single hostname/entry works —
|
|
# which is what lets the whole stack sit behind one upstream reverse proxy.
|
|
|
|
# Honor an upstream proxy's X-Forwarded-Proto if present (double-proxy case),
|
|
# otherwise fall back to this server's own scheme.
|
|
map $http_x_forwarded_proto $ansipa_fwd_proto {
|
|
default $scheme;
|
|
"~.+" $http_x_forwarded_proto;
|
|
}
|
|
# Preserve the original client IP chain when we sit behind another proxy.
|
|
map $http_x_forwarded_for $ansipa_fwd_for {
|
|
default $remote_addr;
|
|
"~.+" "$http_x_forwarded_for, $remote_addr";
|
|
}
|
|
|
|
server {
|
|
listen 80 default_server;
|
|
server_name _;
|
|
|
|
# Big cookies/headers: CheckMK and Keycloak set sizeable auth cookies.
|
|
large_client_header_buffers 4 32k;
|
|
proxy_busy_buffers_size 32k;
|
|
proxy_buffers 8 32k;
|
|
proxy_buffer_size 32k;
|
|
|
|
# ── Portal start page ────────────────────────────────────────────────────
|
|
location = / {
|
|
root /usr/share/nginx/portal;
|
|
try_files /index.html =404;
|
|
}
|
|
location = /index.html { root /usr/share/nginx/portal; }
|
|
location = /portal.css { root /usr/share/nginx/portal; }
|
|
|
|
# ── FreeIPA web UI (native path /ipa) ──────────────────────────────────────
|
|
# IPA's Apache is strict about Host and Referer (anti-CSRF): both must name
|
|
# the IPA server itself, not the proxy. Pin Host to the IPA hostname and
|
|
# rewrite Referer so the referer-check passes through the proxy.
|
|
location /ipa/ {
|
|
proxy_pass https://${ANSIPA_IPA_UPSTREAM}/ipa/;
|
|
proxy_ssl_server_name on;
|
|
proxy_ssl_verify off; # IPA ships a self-signed CA
|
|
proxy_set_header Host ${IPA_HOSTNAME};
|
|
proxy_set_header Referer https://${IPA_HOSTNAME}/ipa/ui/;
|
|
proxy_set_header X-Forwarded-Proto $ansipa_fwd_proto;
|
|
proxy_set_header X-Forwarded-For $ansipa_fwd_for;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
# IPA issues 301s to its own hostname; rewrite them back onto this proxy.
|
|
proxy_redirect https://${IPA_HOSTNAME}/ /ipa/../;
|
|
proxy_redirect http://${IPA_HOSTNAME}/ /ipa/../;
|
|
}
|
|
|
|
# ── CheckMK (native path /cmk) ─────────────────────────────────────────────
|
|
location /cmk/ {
|
|
proxy_pass http://${ANSIPA_CMK_UPSTREAM}/cmk/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto $ansipa_fwd_proto;
|
|
proxy_set_header X-Forwarded-For $ansipa_fwd_for;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
}
|
|
|
|
# ── Keycloak (relative path /auth, set via KC_HTTP_RELATIVE_PATH) ──────────
|
|
location /auth/ {
|
|
proxy_pass http://${ANSIPA_KC_UPSTREAM}/auth/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto $ansipa_fwd_proto;
|
|
proxy_set_header X-Forwarded-For $ansipa_fwd_for;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
# Deliberately NOT forwarding X-Forwarded-Port: this gateway listens on
|
|
# :80 internally, but the public port is whatever the upstream TLS proxy
|
|
# uses (typically 443). Sending :80 makes Keycloak emit redirects like
|
|
# https://host:80/... — let it infer the standard port from the proto.
|
|
}
|
|
}
|