move nginx

conf/nginx/dhparams.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAk7fEh4MFr446aU61ZGxCl8VHvcJhDGcdd+3zaNxdWF7Wvr5QE8zX
+QswoM5K2szlK7klcJOXer2IToHHQQn00nuWO3m6quZGV6EPbRmRKfRGa8pzSwH+R
+Ph0OUpEQPh7zvegeVwEbrblD7i53ookbHlYGtxsPb28Y06OP5/xpks9C815Zy4gy
+tx2yHi4FkFo52yErBF9jD/glsZYVHCo42LFrVGa5/7V0g++fG8yXCrBnqmz2d8FF
+uU6/KJcmDCUn1m3mDfcf5HgeXSIsukW/XMZ3l9w1fdluJRwdEE9W2ePgqMiG3eC0
+2T1sPfXCdXPQ7/5Gzf1eMtRZ/McipxVbgwIBAg==
+-----END DH PARAMETERS-----

conf/nginx/hosted-http-base.conf

@@ -0,0 +1,7 @@
+# vim: ft=nginx
+
+server {
+    listen 80 default_server;
+    server_name _;
+    rewrite ^ https://$host$request_uri? permanent;
+}

conf/nginx/http-base.conf

@@ -0,0 +1,57 @@
+# vim: ft=nginx
+
+set_real_ip_from 0.0.0.0/0;
+real_ip_recursive on;
+log_format lb_pp '$remote_addr ($proxy_protocol_addr) '
+                  '- $remote_user [$time_local] '
+                  '"$request" $status $body_bytes_sent '
+                  '"$http_referer" "$http_user_agent" '
+                  '($request_time $request_length $upstream_response_time)';
+
+types_hash_max_size 2048;
+include /etc/nginx/mime.types;
+
+default_type application/octet-stream;
+access_log /dev/stdout;
+sendfile on;
+
+gzip on;
+gzip_http_version 1.0;
+gzip_proxied any;
+gzip_min_length 500;
+gzip_disable "MSIE [1-6]\.";
+gzip_types text/plain text/xml text/css
+           text/javascript application/x-javascript
+           application/octet-stream;
+
+map $proxy_protocol_addr $proper_forwarded_for {
+  ""      $proxy_add_x_forwarded_for;
+  default $proxy_protocol_addr;
+}
+
+map $http_x_forwarded_proto $proper_scheme {
+  default $scheme;
+  https   https;
+}
+
+upstream web_app_server {
+    server unix:/tmp/gunicorn_web.sock fail_timeout=0;
+}
+upstream jwtproxy_secscan {
+    server unix:/tmp/jwtproxy_secscan.sock fail_timeout=0;
+}
+upstream verbs_app_server {
+    server unix:/tmp/gunicorn_verbs.sock fail_timeout=0;
+}
+upstream registry_app_server {
+    server unix:/tmp/gunicorn_registry.sock fail_timeout=0;
+}
+
+upstream build_manager_controller_server {
+    server localhost:8686;
+}
+
+upstream build_manager_websocket_server {
+    server localhost:8787;
+}
+

conf/nginx/nginx-nossl.conf

@@ -0,0 +1,14 @@
+# vim: ft=nginx
+
+include root-base.conf;
+
+http {
+    include http-base.conf;
+    include rate-limiting.conf;
+
+    server {
+        include server-base.conf;
+
+        listen 80 default;
+    }
+}

conf/nginx/nginx.conf

@@ -0,0 +1,48 @@
+# vim: ft=nginx
+
+include root-base.conf;
+
+http {
+    include http-base.conf;
+    include hosted-http-base.conf;
+    include rate-limiting.conf;
+
+    ssl_certificate ./stack/ssl.cert;
+    ssl_certificate_key ./stack/ssl.key;
+    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 5m;
+    ssl_prefer_server_ciphers on;
+    ssl_dhparam dhparams.pem;
+
+    # TODO: learn wtf OCSP stapling is and do it the right way
+    #ssl_stapling on;
+    #ssl_stapling_verify off;
+    #ssl_trusted_certificate ./stack/ssl.key;
+
+    server {
+        include server-base.conf;
+
+        listen 443 ssl http2 default;
+
+        ssl on;
+
+        # This header must be set only for HTTPS
+        add_header Strict-Transport-Security "max-age=63072000; preload";
+    }
+
+    server {
+        include server-base.conf;
+
+        listen 8443 ssl http2 default proxy_protocol;
+        ssl on;
+
+        # This header must be set only for HTTPS
+        add_header Strict-Transport-Security "max-age=63072000; preload";
+
+        real_ip_header proxy_protocol;
+
+        access_log /dev/stdout lb_pp;
+    }
+}

conf/nginx/rate-limiting.conf

@@ -0,0 +1,15 @@
+# vim: ft=nginx
+
+# Check the Authorization header and, if it is empty, use their proxy protocol
+# IP, else use the header as their unique identifier for rate limiting.
+# Enterprise users will never be using proxy protocol, thus the value will be
+# empty string. This means they will not get rate limited.
+map $http_authorization $registry_bucket {
+  ""      $proxy_protocol_addr;
+  default $http_authorization;
+}
+
+limit_req_zone $proxy_protocol_addr zone=verbs:10m rate=2r/s;
+limit_req_zone $registry_bucket zone=repositories:10m rate=2r/s;
+limit_req_status 429;
+limit_req_log_level warn;

conf/nginx/root-base.conf

@@ -0,0 +1,17 @@
+# vim: ft=nginx
+
+pid /tmp/nginx.pid;
+error_log /dev/stdout;
+
+worker_processes 2;
+worker_priority -10;
+worker_rlimit_nofile 10240;
+
+user root nogroup;
+
+daemon off;
+
+events {
+    worker_connections 10240;
+    accept_mutex off;
+}

conf/nginx/server-base.conf

@@ -0,0 +1,130 @@
+# vim: ft=nginx
+
+server_name _;
+
+keepalive_timeout 5;
+
+if ($host = "www.quay.io") {
+    return 301 $proper_scheme://quay.io$request_uri;
+}
+
+# Disable the ability to be embedded into iframes
+add_header X-Frame-Options DENY;
+
+
+# Proxy Headers
+proxy_set_header X-Forwarded-For $proper_forwarded_for;
+proxy_set_header X-Forwarded-Proto $proper_scheme;
+proxy_set_header Host $host;
+proxy_redirect off;
+
+proxy_set_header Transfer-Encoding $http_transfer_encoding;
+
+location / {
+    proxy_pass   http://web_app_server;
+}
+
+location /realtime {
+    proxy_pass   http://web_app_server;
+    proxy_buffering off;
+    proxy_request_buffering off;
+}
+
+# At the begining and end of a push/pull, (/v1/repositories|/v2/auth/) is hit by the Docker
+# client. By rate-limiting just this endpoint, we can avoid accidentally
+# blocking pulls/pushes for images with many layers.
+location ~ ^/(v1/repositories|v2/auth)/ {
+    proxy_buffering off;
+
+    proxy_request_buffering off;
+
+    proxy_pass http://registry_app_server;
+    proxy_read_timeout 2000;
+    proxy_temp_path /tmp 1 2;
+
+    limit_req zone=repositories burst=10;
+}
+
+location /secscan/ {
+    proxy_pass http://jwtproxy_secscan;
+}
+
+location ~ ^/v2 {
+    # If we're being accessed via v1.quay.io, pretend we don't support v2.
+    if ($host = "v1.quay.io") {
+        return 404;
+    }
+
+    # Setting ANY header clears all inherited proxy_set_header directives
+    proxy_set_header X-Forwarded-For $proper_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $proper_scheme;
+    proxy_set_header Host $host;
+
+    proxy_buffering off;
+
+    proxy_request_buffering off;
+
+    proxy_read_timeout 2000;
+
+    proxy_http_version 1.1;
+
+    proxy_pass   http://registry_app_server;
+    proxy_temp_path /tmp 1 2;
+
+    client_max_body_size 20G;
+}
+
+location ~ ^/v1 {
+    # Setting ANY header clears all inherited proxy_set_header directives
+    proxy_set_header X-Forwarded-For $proper_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $proper_scheme;
+    proxy_set_header Host $host;
+
+    proxy_buffering off;
+
+    proxy_request_buffering off;
+
+    proxy_http_version 1.1;
+
+    proxy_pass   http://registry_app_server;
+    proxy_temp_path /tmp 1 2;
+
+    client_max_body_size 20G;
+}
+
+location /v1/_ping {
+    add_header Content-Type text/plain;
+    add_header X-Docker-Registry-Version 0.6.0;
+    add_header X-Docker-Registry-Standalone 0;
+    return 200 'true';
+}
+
+location /c1/ {
+    proxy_buffering off;
+
+    proxy_request_buffering off;
+
+    proxy_pass   http://verbs_app_server;
+    proxy_temp_path /tmp 1 2;
+
+    limit_req zone=verbs burst=10;
+}
+
+location /static/ {
+    # checks for static file, if not found proxy to app
+    alias      /static/;
+    error_page 404 /404;
+}
+
+error_page 502 /static/502.html;
+
+location ~ ^/b1/controller(/?)(.*) {
+    proxy_pass http://build_manager_controller_server/$2;
+}
+
+location ~ ^/b1/socket(/?)(.*) {
+    proxy_pass http://build_manager_websocket_server/$2;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+}