-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1546 from govuk-one-login/AUT-1984/revert
Revert "Merge pull request #1470 from govuk-one-login/AUT-1984/do-it-again"
- Loading branch information
Showing
13 changed files
with
80 additions
and
1,191 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,12 @@ | ||
| FROM caddy:2.7-alpine | ||
| FROM nginx:alpine | ||
|
|
||
| ENV NGINX_PORT=8080 | ||
|
|
||
| RUN apk add --no-cache --update jq | ||
| RUN apk add --no-cache --update \ | ||
| apache2-utils jq | ||
|
|
||
| COPY entrypoint.sh /entrypoint.sh | ||
| COPY nginx.conf /etc/nginx/templates/default.conf.template | ||
|
|
||
| COPY Caddyfile /etc/caddy/Caddyfile | ||
|
|
||
| CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"] | ||
| CMD ["nginx", "-g", "daemon off;"] | ||
| ENTRYPOINT ["/entrypoint.sh"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,37 +1,31 @@ | ||
| #!/bin/sh | ||
| set -euo | ||
|
|
||
| if [ -z "${BASIC_AUTH_USERNAME}" ]; then | ||
| if [ -z "$BASIC_AUTH_USERNAME" ]; then | ||
| echo >&2 "BASIC_AUTH_USERNAME must be set" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${BASIC_AUTH_PASSWORD}" ]; then | ||
| if [ -z "$BASIC_AUTH_PASSWORD" ]; then | ||
| echo >&2 "BASIC_AUTH_PASSWORD must be set" | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${PROXY_PASS}" ]; then | ||
| if [ -z "$PROXY_PASS" ]; then | ||
| echo >&2 "PROXY_PASS must be set" | ||
| exit 1 | ||
| fi | ||
|
|
||
| IP_BLOCK_MATCHER="private_ranges" | ||
| if [ -n "${IP_ALLOW_LIST:-}" ]; then | ||
| IP_BLOCK_MATCHER="$(echo "${IP_ALLOW_LIST}" | jq -r '. | join(" ")')" | ||
| touch /etc/nginx/allow-list.conf | ||
| if [ -n "$IP_ALLOW_LIST" ]; then | ||
| echo "${IP_ALLOW_LIST}" | jq -r '"allow " + .[] + ";"' >>/etc/nginx/allow-list.conf | ||
| fi | ||
| unset IP_ALLOW_LIST | ||
| export IP_BLOCK_MATCHER | ||
|
|
||
| TRUSTED_PROXIES_IPS="" | ||
| if [ -n "${TRUSTED_PROXIES:-}" ]; then | ||
| TRUSTED_PROXIES_IPS="$(echo "${TRUSTED_PROXIES}" | jq -r '. | join(" ")')" | ||
| touch /etc/nginx/trusted-proxies.conf | ||
| if [ -n "$TRUSTED_PROXIES" ]; then | ||
| echo "${TRUSTED_PROXIES}" | jq -r '"set_real_ip_from " + .[] + ";"' >>/etc/nginx/trusted-proxies.conf | ||
| fi | ||
| unset TRUSTED_PROXIES | ||
| export TRUSTED_PROXIES_IPS | ||
|
|
||
| HASHED_PASSWORD="$(caddy hash-password --plaintext "${BASIC_AUTH_PASSWORD}")" | ||
| unset BASIC_AUTH_PASSWORD | ||
| export HASHED_PASSWORD | ||
| htpasswd -bBc /etc/nginx/.htpasswd "${BASIC_AUTH_USERNAME}" "${BASIC_AUTH_PASSWORD}" | ||
|
|
||
| exec "$@" | ||
| exec /docker-entrypoint.sh "$@" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| server { | ||
| listen ${NGINX_PORT}; | ||
| server_name ${NGINX_HOST}; | ||
|
|
||
| location / { | ||
| proxy_pass ${PROXY_PASS}; | ||
|
|
||
| satisfy any; | ||
|
|
||
| real_ip_header X-Forwarded-For; | ||
| real_ip_recursive on; | ||
| include /etc/nginx/trusted-proxies.conf; | ||
|
|
||
| include /etc/nginx/allow-list.conf; | ||
| deny all; | ||
|
|
||
| auth_basic "Restricted"; | ||
| auth_basic_user_file /etc/nginx/.htpasswd; | ||
|
|
||
| proxy_set_header X-Forwarded-Host $host; | ||
| proxy_set_header Authorization ""; | ||
| proxy_redirect off; | ||
| } | ||
|
|
||
| location /healthcheck { | ||
| add_header Content-Type text/plain; | ||
| return 200 'OK'; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -59,7 +59,3 @@ services: | |
|
|
||
| networks: | ||
| di-net: | ||
| ingress: | ||
| ipam: | ||
| config: | ||
| - subnet: 172.100.0.0/16 | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.