Adding Nginx Configuration

AlexTheGeek · Feb 3, 2024 · 8e3ca9a · 8e3ca9a
1 parent 98eb108
commit 8e3ca9a
Show file tree

Hide file tree

Showing 5 changed files with 288 additions and 0 deletions.
diff --git a/Nginx/Example/api.insa-cvl.com.conf b/Nginx/Example/api.insa-cvl.com.conf
@@ -0,0 +1,37 @@
+upstream reverse_api{
+        server 127.0.0.1:5001;
+}
+
+server {
+    server_name api.insa-cvl.com;
+    listen 443 ssl;
+    ssl_certificate /path/to/your/certificate/file/fullchain.pem;
+    ssl_certificate_key /path/to/your/private/key/file/privkey.pem;
+
+    ssl_session_cache shared:le_nginx_SSL:15m;
+    ssl_session_timeout 1440m;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload;" always;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Robots-Tag none; 
+    add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
+    proxy_cookie_path / "/; HTTPOnly; Secure";
+    more_clear_headers 'X-Powered-By';
+    client_max_body_size 10m;
+    client_body_timeout 120s;
+
+    location / {
+        proxy_pass http://reverse_api;
+        include proxy_params;
+        proxy_hide_header X-Powered-By;
+        proxy_hide_header Cache-Control;
+        proxy_hide_header pragma;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+}
diff --git a/Nginx/Example/vdi.insa-cvl.com.conf b/Nginx/Example/vdi.insa-cvl.com.conf
@@ -0,0 +1,37 @@
+upstream reverse_vdi{
+        server 127.0.0.1:5000;
+}
+
+server {
+    server_name vdi.insa-cvl.com;
+    listen 443 ssl;
+    ssl_certificate /path/to/your/certificate/file/fullchain.pem;
+    ssl_certificate_key /path/to/your/private/key/file/privkey.pem;
+
+    ssl_session_cache shared:le_nginx_SSL:15m;
+    ssl_session_timeout 1440m;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload;" always;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Robots-Tag none; 
+    add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
+    proxy_cookie_path / "/; HTTPOnly; Secure";
+    more_clear_headers 'X-Powered-By';
+    client_max_body_size 10m;
+    client_body_timeout 120s;
+
+    location / {
+        proxy_pass http://reverse_vdi;
+        include proxy_params;
+        proxy_hide_header X-Powered-By;
+        proxy_hide_header Cache-Control;
+        proxy_hide_header pragma;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+}
diff --git a/Nginx/Example/vnc.insa-cvl.com.conf b/Nginx/Example/vnc.insa-cvl.com.conf
@@ -0,0 +1,107 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+}
+
+upstream reverse_openstack_vnc{
+        server 172.10.3.60:6080;
+}
+
+upstream reverse_api_vnc{
+        server 127.0.0.1:5001;
+}
+
+
+server {
+    server_name vnc.insa-cvl.com;
+    listen 443 ssl;
+    ssl_certificate /path/to/your/certificate/file/fullchain.pem;
+    ssl_certificate_key /path/to/your/private/key/file/privkey.pem;
+
+    ssl_session_cache shared:le_nginx_SSL:15m;
+    ssl_session_timeout 1440m;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
+    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload;" always;
+    add_header X-Content-Type-Options nosniff;
+    add_header X-XSS-Protection "1; mode=block";
+    add_header X-Robots-Tag none; 
+    add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
+    proxy_cookie_path / "/; HTTPOnly; Secure";
+    more_clear_headers 'X-Powered-By';
+    client_max_body_size 10m;
+    client_body_timeout 120s;
+
+
+    add_header Cache-Control no-cache;
+
+    location = /favicon.io {
+            proxy_pass https://reverse_openstack_vnc/favicon.io;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+    location = /package.json {
+            proxy_pass https://reverse_openstack_vnc/package.json;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+
+    location /app/ {
+            proxy_pass https://reverse_openstack_vnc/app/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+    location /core/ {
+            proxy_pass https://reverse_openstack_vnc/core/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+    location /vendor/ {
+            proxy_pass https://reverse_openstack_vnc/vendor/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+
+    location / {
+        auth_request /auth;
+        auth_request_set $auth_status $upstream_status;
+        echo $auth_status;
+
+
+        proxy_pass https://reverse_openstack_vnc/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+
+    }
+
+    location = /auth {
+        internal;
+        proxy_pass http://reverse_api_vnc/check-auth-vnc;
+        proxy_ssl_verify       off;
+        proxy_pass_request_body off;
+        proxy_set_header        Content-Length "";
+        proxy_set_header        X-Original-URI $request_uri;
+
+    }
+
+
+}
diff --git a/Nginx/Prod_2024/sites-prod-cloudflare.conf b/Nginx/Prod_2024/sites-prod-cloudflare.conf
@@ -0,0 +1,103 @@
+server {
+    listen 80;
+
+    location / {
+        proxy_pass http://127.0.0.1:5001;
+    }
+
+}
+
+server {
+    listen 8081;
+
+    location / {
+        proxy_pass http://127.0.0.1:5000;
+    }
+
+}
+
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+
+server {
+    listen 8080;
+        error_log /var/log/nginx/error.log debug;
+
+ add_header Cache-Control no-cache;
+
+    location = /favicon.io {
+            proxy_pass https://172.10.3.60:6080/favicon.io;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+    location = /package.json {
+            proxy_pass https://172.10.3.60:6080/package.json;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+
+    location /app/ {
+            proxy_pass https://172.10.3.60:6080/app/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+    location /core/ {
+            proxy_pass https://172.10.3.60:6080/core/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+    location /vendor/ {
+            proxy_pass https://172.10.3.60:6080/vendor/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+    }
+
+
+    location / {
+        auth_request /auth;
+        auth_request_set $auth_status $upstream_status;
+        echo $auth_status;
+
+
+        proxy_pass https://172.10.3.60:6080/;
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+
+    }
+
+    # Internal location for authentication
+    location = /auth {
+        # Make a subrequest to your API to check authentication
+        internal;
+        proxy_pass http://127.0.0.1/check-auth-vnc;
+#        proxy_pass https://api.insa-cvl.com/check-auth;
+        proxy_ssl_verify       off;
+
+            proxy_pass_request_body off;
+            proxy_set_header        Content-Length "";
+            proxy_set_header        X-Original-URI $request_uri;
+
+    }
+
+
+}
diff --git a/README.md b/README.md
@@ -282,3 +282,7 @@ services:
         restart: always
     ```	
 4. Check the logs : `docker logs vdi-app` or `docker-compose logs -f`
+
+
+## Nginx Configuration
+You can use Nginx to serve the API, the scheduler and the frontend. You can find all the configuration files in the [Nginx folder](https://github.com/AlexTheGeek/api-vdi/tree/main/Nginx/Example).