-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1561 from govuk-one-login/AUT-1984/rebuild-nginx
AUT-1984: Rebuild nginx with headers-more module
- Loading branch information
Showing
11 changed files
with
1,255 additions
and
70 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| name: Test Sidecar Container | ||
| on: | ||
| pull_request: | ||
| types: | ||
| - opened | ||
| - reopened | ||
| - ready_for_review | ||
| - synchronize | ||
|
|
||
| jobs: | ||
| run-tests: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Use Node.js 18.x | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 18.12.1 | ||
| - name: Get yarn cache directory path | ||
| id: yarn-cache-dir-path | ||
| run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT | ||
| - uses: actions/cache@v3 | ||
| id: yarn-cache | ||
| with: | ||
| path: ${{ steps.yarn-cache-dir-path.outputs.dir }} | ||
| key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-yarn- | ||
| - name: Install dependencies | ||
| run: yarn install | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| - name: build sidecar container | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: basic-auth-sidecar | ||
| push: false | ||
| tags: "basic-auth-sidecar-test:latest" | ||
| load: true | ||
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max | ||
| - name: build sidecar httpie container | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: basic-auth-sidecar | ||
| file: basic-auth-sidecar/Dockerfile.httpie | ||
| push: false | ||
| tags: "basic-auth-sidecar-test-httpie:latest" | ||
| load: true | ||
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max | ||
| - name: Run sidecar tests | ||
| run: yarn test:sidecar |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,83 @@ | ||
| FROM nginx:alpine | ||
| FROM nginx:mainline-alpine as builder | ||
|
|
||
| ARG ENABLED_MODULES=headers-more | ||
|
|
||
| RUN set -ex \ | ||
| && if [ "$ENABLED_MODULES" = "" ]; then \ | ||
| echo "No additional modules enabled, exiting"; \ | ||
| exit 1; \ | ||
| fi | ||
|
|
||
| # COPY ./ /modules/ # removed this line as we're not using custom modules, and this line can cause cache invalidation | ||
|
|
||
| RUN set -ex \ | ||
| && apk update \ | ||
| && apk add linux-headers openssl-dev pcre2-dev zlib-dev openssl abuild \ | ||
| musl-dev libxslt libxml2-utils make mercurial gcc unzip git \ | ||
| xz g++ coreutils \ | ||
| # allow abuild as a root user \ | ||
| && printf "#!/bin/sh\\nSETFATTR=true /usr/bin/abuild -F \"\$@\"\\n" > /usr/local/bin/abuild \ | ||
| && chmod +x /usr/local/bin/abuild \ | ||
| && hg clone -r ${NGINX_VERSION}-${PKG_RELEASE} https://hg.nginx.org/pkg-oss/ \ | ||
| && cd pkg-oss \ | ||
| && mkdir /tmp/packages \ | ||
| && for module in $ENABLED_MODULES; do \ | ||
| echo "Building $module for nginx-$NGINX_VERSION"; \ | ||
| if [ -d /modules/$module ]; then \ | ||
| echo "Building $module from user-supplied sources"; \ | ||
| # check if module sources file is there and not empty | ||
| if [ ! -s /modules/$module/source ]; then \ | ||
| echo "No source file for $module in modules/$module/source, exiting"; \ | ||
| exit 1; \ | ||
| fi; \ | ||
| # some modules require build dependencies | ||
| if [ -f /modules/$module/build-deps ]; then \ | ||
| echo "Installing $module build dependencies"; \ | ||
| apk update && apk add $(cat /modules/$module/build-deps | xargs); \ | ||
| fi; \ | ||
| # if a module has a build dependency that is not in a distro, provide a | ||
| # shell script to fetch/build/install those | ||
| # note that shared libraries produced as a result of this script will | ||
| # not be copied from the builder image to the main one so build static | ||
| if [ -x /modules/$module/prebuild ]; then \ | ||
| echo "Running prebuild script for $module"; \ | ||
| /modules/$module/prebuild; \ | ||
| fi; \ | ||
| /pkg-oss/build_module.sh -v $NGINX_VERSION -f -y -o /tmp/packages -n $module $(cat /modules/$module/source); \ | ||
| BUILT_MODULES="$BUILT_MODULES $(echo $module | tr '[A-Z]' '[a-z]' | tr -d '[/_\-\.\t ]')"; \ | ||
| elif make -C /pkg-oss/alpine list | grep -E "^$module\s+\d+" > /dev/null; then \ | ||
| echo "Building $module from pkg-oss sources"; \ | ||
| cd /pkg-oss/alpine; \ | ||
| make abuild-module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \ | ||
| apk add $(. ./abuild-module-$module/APKBUILD; echo $makedepends;); \ | ||
| make module-$module BASE_VERSION=$NGINX_VERSION NGINX_VERSION=$NGINX_VERSION; \ | ||
| find ~/packages -type f -name "*.apk" -exec mv -v {} /tmp/packages/ \;; \ | ||
| BUILT_MODULES="$BUILT_MODULES $module"; \ | ||
| else \ | ||
| echo "Don't know how to build $module module, exiting"; \ | ||
| exit 1; \ | ||
| fi; \ | ||
| done \ | ||
| && echo "BUILT_MODULES=\"$BUILT_MODULES\"" > /tmp/packages/modules.env | ||
|
|
||
| FROM nginx:mainline-alpine | ||
| COPY --from=builder /tmp/packages /tmp/packages | ||
| RUN set -ex \ | ||
| && . /tmp/packages/modules.env \ | ||
| && for module in $BUILT_MODULES; do \ | ||
| apk add --no-cache --allow-untrusted /tmp/packages/nginx-module-${module}-${NGINX_VERSION}*.apk; \ | ||
| done \ | ||
| && rm -rf /tmp/packages | ||
|
|
||
| ENV NGINX_PORT=8080 | ||
|
|
||
| RUN apk add --no-cache --update \ | ||
| apache2-utils jq | ||
| apache2-utils \ | ||
| jq | ||
|
|
||
| COPY entrypoint.sh /entrypoint.sh | ||
| COPY nginx.conf /etc/nginx/templates/default.conf.template | ||
| COPY default.conf /etc/nginx/templates/default.conf.template | ||
| COPY nginx.conf /etc/nginx/nginx.conf | ||
|
|
||
| CMD ["nginx", "-g", "daemon off;"] | ||
| ENTRYPOINT ["/entrypoint.sh"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| FROM alpine:3.19 | ||
|
|
||
| RUN apk add --no-cache --update \ | ||
| httpie | ||
|
|
||
| CMD ["sleep", "infinity"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| server { | ||
| listen ${NGINX_PORT}; | ||
| server_name ${NGINX_HOST}; | ||
|
|
||
| location / { | ||
| proxy_pass ${PROXY_PASS}; | ||
|
|
||
| satisfy any; | ||
|
|
||
| real_ip_header X-Forwarded-For; | ||
| real_ip_recursive on; | ||
| include /etc/nginx/trusted-proxies.conf; | ||
|
|
||
| include /etc/nginx/allow-list.conf; | ||
| deny all; | ||
|
|
||
| auth_basic "Restricted"; | ||
| auth_basic_user_file /etc/nginx/.htpasswd; | ||
|
|
||
| proxy_set_header X-Forwarded-Host $host; | ||
| proxy_set_header Authorization ""; | ||
| proxy_redirect off; | ||
| } | ||
|
|
||
| location /healthcheck { | ||
| more_set_headers 'Content-Type: text/plain'; | ||
| return 200 'OK'; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,29 +1,35 @@ | ||
| server { | ||
| listen ${NGINX_PORT}; | ||
| server_name ${NGINX_HOST}; | ||
| user nginx; | ||
| worker_processes auto; | ||
|
|
||
| location / { | ||
| proxy_pass ${PROXY_PASS}; | ||
| load_module /etc/nginx/modules/ngx_http_headers_more_filter_module.so; | ||
|
|
||
| satisfy any; | ||
| error_log /var/log/nginx/error.log notice; | ||
| pid /var/run/nginx.pid; | ||
|
|
||
| real_ip_header X-Forwarded-For; | ||
| real_ip_recursive on; | ||
| include /etc/nginx/trusted-proxies.conf; | ||
|
|
||
| include /etc/nginx/allow-list.conf; | ||
| deny all; | ||
| events { | ||
| worker_connections 1024; | ||
| } | ||
|
|
||
| http { | ||
| include /etc/nginx/mime.types; | ||
| default_type application/octet-stream; | ||
|
|
||
| server_tokens off; | ||
| more_clear_headers 'Server'; | ||
|
|
||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| '$status $body_bytes_sent "$http_referer" ' | ||
| '"$http_user_agent" "$http_x_forwarded_for"'; | ||
|
|
||
| access_log /var/log/nginx/access.log main; | ||
|
|
||
| sendfile on; | ||
| #tcp_nopush on; | ||
|
|
||
| auth_basic "Restricted"; | ||
| auth_basic_user_file /etc/nginx/.htpasswd; | ||
| keepalive_timeout 65; | ||
|
|
||
| proxy_set_header X-Forwarded-Host $host; | ||
| proxy_set_header Authorization ""; | ||
| proxy_redirect off; | ||
| } | ||
| #gzip on; | ||
|
|
||
| location /healthcheck { | ||
| add_header Content-Type text/plain; | ||
| return 200 'OK'; | ||
| } | ||
| include /etc/nginx/conf.d/*.conf; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.