Merge remote-tracking branch 'origin/master' into ephemeral

Dockerfile.web

@@ -73,6 +73,6 @@ RUN TEST=true venv/bin/python -m unittest discover
 
 VOLUME ["/conf/stack", "/var/log", "/datastorage", "/tmp", "/conf/etcd"]
 
-EXPOSE 443 80
+EXPOSE 443 8443 80
 
 CMD ["/sbin/my_init"]

conf/nginx.conf

@@ -22,4 +22,20 @@ http {
         ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
         ssl_prefer_server_ciphers on;
     }
+
+    server {
+        include proxy-protocol.conf;
+
+        include proxy-server-base.conf;
+
+        listen 8443 default proxy_protocol;
+
+        ssl on;
+        ssl_certificate ./stack/ssl.cert;
+        ssl_certificate_key ./stack/ssl.key;
+        ssl_session_timeout 5m;
+        ssl_protocols SSLv3 TLSv1;
+        ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
+        ssl_prefer_server_ciphers on;
+    }
 }

conf/proxy-protocol.conf

@@ -0,0 +1,8 @@
+# vim: ft=nginx
+
+set_real_ip_from 0.0.0.0/0;
+real_ip_header proxy_protocol;
+log_format elb_pp '$proxy_protocol_addr - $remote_user [$time_local] '
+                  '"$request" $status $body_bytes_sent '
+                  '"$http_referer" "$http_user_agent"';
+access_log /var/log/nginx/nginx.access.log elb_pp;

conf/proxy-server-base.conf

@@ -0,0 +1,91 @@
+# vim: ft=nginx
+
+client_body_temp_path /var/log/nginx/client_body 1 2;
+server_name _;
+
+keepalive_timeout 5;
+
+if ($args ~ "_escaped_fragment_") {
+    rewrite ^ /snapshot$uri;
+}
+
+proxy_set_header X-Forwarded-For $proxy_protocol_addr;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header Host $http_host;
+proxy_redirect off;
+
+proxy_set_header Transfer-Encoding $http_transfer_encoding;
+
+location / {
+    proxy_pass   http://web_app_server;
+
+    limit_req zone=webapp burst=25 nodelay;
+}
+
+location /realtime {
+    proxy_pass   http://web_app_server;
+    proxy_buffering off;
+    proxy_request_buffering off;
+}
+
+location /v1/repositories/ {
+    proxy_buffering off;
+
+    proxy_request_buffering off;
+
+    proxy_pass http://registry_app_server;
+    proxy_read_timeout 2000;
+    proxy_temp_path /var/log/nginx/proxy_temp 1 2;
+
+    client_max_body_size 20G;
+
+    limit_req zone=repositories burst=5 nodelay;
+}
+
+location /v1/ {
+    proxy_buffering off;
+
+    proxy_request_buffering off;
+
+    proxy_pass   http://registry_app_server;
+    proxy_read_timeout 2000;
+    proxy_temp_path /var/log/nginx/proxy_temp 1 2;
+
+    client_max_body_size 20G;
+}
+
+location /c1/ {
+    proxy_buffering off;
+
+    proxy_request_buffering off;
+
+    proxy_pass   http://verbs_app_server;
+    proxy_read_timeout 2000;
+    proxy_temp_path /var/log/nginx/proxy_temp 1 2;
+
+    limit_req zone=api burst=5 nodelay;
+}
+
+location /static/ {
+    # checks for static file, if not found proxy to app
+    alias /static/;
+}
+
+location /v1/_ping {
+    add_header Content-Type text/plain;
+    add_header X-Docker-Registry-Version 0.6.0;
+    add_header X-Docker-Registry-Standalone 0;
+    return 200 'true';
+}
+
+location ~ ^/b1/controller(/?)(.*) {
+    proxy_pass http://build_manager_controller_server/$2;
+    proxy_read_timeout 2000;
+}
+
+location ~ ^/b1/socket(/?)(.*) {
+    proxy_pass http://build_manager_websocket_server/$2;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+}

conf/rate-limiting.conf

@@ -1,6 +1,7 @@
 # vim: ft=nginx
 
-limit_req_zone $binary_remote_addr zone=webapp:10m rate=10r/s;
-limit_req_zone $binary_remote_addr zone=api:10m rate=1r/s;
+limit_req_zone $proxy_protocol_addr zone=webapp:10m rate=25r/s;
+limit_req_zone $proxy_protocol_addr zone=repositories:10m rate=1r/s;
+limit_req_zone $proxy_protocol_addr zone=api:10m rate=1r/s;
 limit_req_status 429;
 limit_req_log_level warn;

conf/server-base.conf

@@ -21,8 +21,6 @@ proxy_set_header Transfer-Encoding $http_transfer_encoding;
 
 location / {
     proxy_pass   http://web_app_server;
-
-    #limit_req zone=webapp burst=10 nodelay;
 }
 
 location /realtime {
@@ -41,8 +39,6 @@ location /v1/ {
     proxy_temp_path /var/log/nginx/proxy_temp 1 2;
 
     client_max_body_size 20G;
-
-    #limit_req zone=api burst=5 nodelay;
 }
 
 location /c1/ {
@@ -53,8 +49,6 @@ location /c1/ {
     proxy_pass   http://verbs_app_server;
     proxy_read_timeout 2000;
     proxy_temp_path /var/log/nginx/proxy_temp 1 2;
-
-    #limit_req zone=api burst=5 nodelay;
 }
 
 location /static/ {