SRV_NGINX
Co je to NGINX?
Nginx je softwarový webový server s load managment a reverzní proxy s otevřeným zdrojovým kódem. Pracuje s protokoly HTTP, SMTP, POP3, IMAP a SSL. Zaměřuje se především na vysoký výkon a nízké nároky na paměť.
Převzato z: Wikipedie
Odkazy ke studiu:
https://github.com/vouch/vouch-proxy
https://gist.github.com/mjbnz/b402edf819a69e517b0c59710f291da9
https://developer.okta.com/blog/2018/08/28/nginx-auth-request
Návod na instalaci
1) Založíme nový LXC container
dle tohoto návodu: https://intranet.rs-kovarik.cz/srvtemplate Místo SRV_TEMPLATE zadat jméno SRV_NGINX
2) Připojíme se k serveru přes terminál
ssh připojení k Turiisu a pak přes lxc-attach
Příkazy:
lxc-attach SRV_VOUCH
3) Instalace NGINX
Příkazy:
apt install nginx
4) Ověření povolení start NGINX
Příkazy:
service nginx status
service sshd start
service sshd status
systemctl enable nginx
5) koukneme do konfigurace nginx.conf
Příkazy:
nano /etc/nginx/nginx.conf
Někde v konfiguraci by mělo být toto (by default):
include /etc/nginx/sites-enabled/*;
5) koukneme do konfigurace povolených stránek nginx
Koukneme a smažeme všechny default konfigurace.
Příkazy:
cd /etc/nginx/sites-enabled/
ls -al
rm /etc/nginx/sites-enabled/*
cd /etc/nginx/sites-available/
ls -al
rm /etc/nginx/sites-available/*
6) Vytvoříme konfigurace po redirect na SSO VOUCH a následný reverse proxy na cilove aplikace
Příkazy:
cd /etc/nginx/sites-available/
Následující jsou příklady konfigurací toto je opět závislé dle konkrétní implementace:
nano proxy
Příklad konfigurace:
server {
listen 443 ssl http2;
server_name proxy.rs-kovarik.cz;
root /var/www/html/;
ssl_certificate fullchain.pem;
ssl_certificate_key privkey.pem;
# send all requests to the `/validate` endpoint for authorization
auth_request /validate;
location = /validate {
# forward the /validate request to Vouch Proxy
proxy_pass http://192.168.1.34:9090/validate;
# be sure to pass the original host header
proxy_set_header Host $http_host;
# Vouch Proxy only acts on the request headers
proxy_pass_request_body off;
proxy_set_header Content-Length "";
# optionally add X-Vouch-User as returned by Vouch Proxy along with the request
auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;
# these return values are used by the @error401 call
auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;
auth_request_set $auth_resp_err $upstream_http_x_vouch_err;
auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;
}
# if validate returns `401 not authorized` then forward the request to the error401block
error_page 401 = @error401;
location @error401 {
# redirect to Vouch Proxy for login
return 302 https://vouch.rs-kovarik.cz/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
# you usually *want* to redirect to Vouch running behind the same Nginx config proteced by https
# but to get started you can just forward the end user to the port that vouch is running on
}
# proxy pass authorized requests to your service
location /rpi/ {
proxy_pass http://192.168.1.153:8888/;
proxy_set_header HOST $host;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
proxy_redirect http://192.168.1.153:8888/ https://proxy.rs-kovarik.cz/rpi/;
}
location /portainer/ {
proxy_pass http://192.168.1.153:9000/;
proxy_set_header HOST $host;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
location /portainer/api/websocket/ {
proxy_pass http://192.168.1.153:9000/api/websocket/;
proxy_set_header HOST $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
location /synback/ {
proxy_pass http://192.168.1.15/;
proxy_set_header HOST $host;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
location /radius/ {
proxy_pass http://192.168.1.33/daloradius/;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
location /transmission/ {
proxy_pass http://192.168.1.153:9091;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
location /domoticz/ {
proxy_pass http://192.168.1.37/;
# proxy_set_header HOST $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
location /dmz/json {
proxy_pass http://192.168.1.153:83/json;
proxy_set_header HOST $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass https://192.168.1.153:10000/;
#proxy_set_header HOST $host;
#proxy_set_header X-Real-IP $remote_addr;
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
#proxy_redirect / /webmin/;
}
#location /tmp/ {
# rewrite /trudesk/(.*) /$1 break;
#proxy_pass http://192.168.1.153:32769/;
#proxy_redirect http://192.168.1.153:32769/ https://proxy1.rs-kovarik.cz/trudesk/;
#proxy_set_header HOST $host;
#proxy_redirect off;
#proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
#}
}
nano cam1
Příklad konfigurace:
server {
listen 443 ssl http2;
server_name cam1.proxy.rs-kovarik.cz;
root /var/www/html/;
ssl_certificate fullchain.pem;
ssl_certificate_key privkey.pem;
auth_request /validate;
location = /validate {
proxy_pass http://192.168.1.34:9090/validate;
proxy_set_header Host $http_host;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;
auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;
auth_request_set $auth_resp_err $upstream_http_x_vouch_err;
auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;
}
error_page 401 = @error401;
location @error401 {
return 302 https://vouch.rs-kovarik.cz/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
}
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://192.168.1.153:8082/;
proxy_set_header HOST $host;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
}
nano cam2
Příklad konfigurace:
server {
listen 443 ssl http2;
server_name cam2.proxy.rs-kovarik.cz;
root /var/www/html/;
ssl_certificate fullchain.pem;
ssl_certificate_key privkey.pem;
auth_request /validate;
location = /validate {
proxy_pass http://192.168.1.34:9090/validate;
proxy_set_header Host $http_host;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;
auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;
auth_request_set $auth_resp_err $upstream_http_x_vouch_err;
auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;
}
error_page 401 = @error401;
location @error401 {
return 302 https://vouch.rs-kovarik.cz/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
}
location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://192.168.1.153:8083/;
proxy_set_header HOST $host;
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
}
}
7) Zkopírujeme libovolný ssl certifikát
(můžeme použít např ten z le na serveru SRV_PROXY) certifikát uložime do složky /etc/nginx/ je uplne jedno jaky tam bude jedna se pouze o spojeni mezi proxyterverem SRV_PROXY a SRV_NGINX, které jede po vnitřní síti.
Příkazy:
cd /etc/nginx/
nano fullchain.pem
sem vlozime nas fullchain.pem z SRV_PROXY
nano privkey.pem
sem vlozime nas privkey.pem z SRV_PROXY
8) Povolení konfigurací
konfigurace, ktere jsme si v bodu 6) vytvorili je nutne povolit, pro kazdou tedy vytvorim symlink
Příkazy:
ln -s /etc/nginx/sites-available/proxy /etc/nginx/sites-enabled/ln -s /etc/nginx/sites-available/cam1 /etc/nginx/sites-enabled/ln -s /etc/nginx/sites-available/cam2 /etc/nginx/sites-enabled/
9) Reset serveru
Příkazy:
service nginx status
service nginx restart
service nginx status