clawbot
2532da55e9
check / check (push) Waiting to run
From a peer in TRUSTED_PROXIES, clientIP took the left-most X-Forwarded-For entry, which the client writes itself behind a proxy that appends to the header, so a client could choose the address the rate limit counts. It now walks the entries from the right past trusted proxies and takes the first that is not one. An entry with a port is read as its address; with only trusted entries, or one that is not an address at all, it uses the peer. Every X-Forwarded-For header line is read, and X-Real-IP only when there is no X-Forwarded-For entry. Model: opus-5-5
81 lines
2.9 KiB
Nginx Configuration File
81 lines
2.9 KiB
Nginx Configuration File
# A template: the nginx image renders it into conf.d at container start,
|
|
# filling in PORT and nothing else. bin/entrypoint.sh sets PORT and that
|
|
# limit.
|
|
server {
|
|
listen ${PORT};
|
|
server_name _;
|
|
|
|
# Keep the nginx version out of the Server header and error pages.
|
|
server_tokens off;
|
|
|
|
# The security headers, on every response. An add_header in a
|
|
# location drops every add_header from here, so a location with one
|
|
# of its own includes this file again.
|
|
include /etc/nginx/security-headers.conf;
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# The client address comes from X-Forwarded-For only on a request
|
|
# from the reverse proxies in TRUSTED_PROXIES: bin/entrypoint.sh
|
|
# writes one set_real_ip_from line for each into this file. Unset,
|
|
# TRUSTED_PROXIES is the three private ranges of RFC 1918; set and
|
|
# empty, the file is empty and the client address is the one each
|
|
# request comes from.
|
|
include /etc/nginx/trusted-proxies.conf;
|
|
real_ip_header X-Forwarded-For;
|
|
real_ip_recursive on;
|
|
|
|
# Access log to stdout (Docker best practice)
|
|
access_log /dev/stdout combined;
|
|
error_log /dev/stderr warn;
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# Cache static assets aggressively
|
|
location /assets/ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
include /etc/nginx/security-headers.conf;
|
|
}
|
|
|
|
# netwatch-server, the Go backend, runs in the same container and
|
|
# listens on loopback only: bin/entrypoint.sh starts it on
|
|
# 127.0.0.1:8081. These headers go with every request passed to it.
|
|
# X-Forwarded-For carries only the client address, as resolved by
|
|
# the real IP settings above, and not the chain the request came
|
|
# with. bin/entrypoint.sh starts the backend with
|
|
# TRUSTED_PROXIES=127.0.0.1/32, the address nginx connects from, so
|
|
# the backend takes that one entry as the client address.
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# netwatch-server sets the same security headers on its own
|
|
# responses. Its copies are dropped so that each header goes out
|
|
# once, as configs/security-headers.conf sets it.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header X-Frame-Options;
|
|
proxy_hide_header X-Content-Type-Options;
|
|
proxy_hide_header Referrer-Policy;
|
|
proxy_hide_header Permissions-Policy;
|
|
|
|
location /api/ {
|
|
proxy_pass http://127.0.0.1:8081;
|
|
}
|
|
|
|
location = /.well-known/healthcheck {
|
|
proxy_pass http://127.0.0.1:8081;
|
|
}
|
|
|
|
# The backend's Prometheus metrics, behind its own basic auth. Unless
|
|
# METRICS_USERNAME and METRICS_PASSWORD are set, it answers 404.
|
|
location = /metrics {
|
|
proxy_pass http://127.0.0.1:8081;
|
|
}
|
|
}
|