xai-corp.net/provisioning
1
0
Fork 0
Code Issues 9 Releases Activity

refactor docker swarm to use just home without workers for now

Browse Source 
add caching at nginx level for portainer and gitea
This commit is contained in:
richard
2018-04-07 08:11:23 -04:00
parent 3ed65eefe9
commit 83ec6809d6
45 changed files with 438 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
dockerfiles/services/sslproxy/hosts/abcapi.xai-corp.net.conf
View File

@@ -1,19 +0,0 @@
server {
listen 443 ssl ipv6only=off;
server_name abcapi.xai-corp.net;
ssl_certificate /etc/letsencrypt/live/xai-corp.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xai-corp.net/privkey.pem;
#Strict-Transport-Security: max-age=15768000
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;
location / {
proxy_pass http://dkhost.xai-corp.net:8084;
proxy_set_header Host $host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection $http_connection;
}
}

57
dockerfiles/services/sslproxy/hosts/dkregistry.xai-corp.net.conf
View File

@@ -1,57 +0,0 @@
# dkregistry.xai-corp.net
## Set a variable to help us decide if we need to add the
## 'Docker-Distribution-Api-Version' header.
## The registry always sets this header.
## In the case of nginx performing auth, the header will be unset
## since nginx is auth-ing before proxying.
map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
'' 'registry/2.0';
}
server {
listen 443 ssl;
server_name dkregistry.xai-corp.net;
ssl_certificate /etc/letsencrypt/live/xai-corp.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xai-corp.net/privkey.pem;
# Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
#Strict-Transport-Security: max-age=15768000
add_header Strict-Transport-Security "max-age=600; includeSubDomains" always;
# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
# required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486)
chunked_transfer_encoding on;
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
# To add basic authentication to v2 use auth_basic setting.
auth_basic "Registry realm";
auth_basic_user_file /opt/shared/dkregistry/auth/htpasswd;
## If $docker_distribution_api_version is empty, the header will not be added.
## See the map directive above where this variable is defined.
add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection $http_connection;
proxy_pass http://dkhost.xai-corp.net:5000;
proxy_read_timeout 900;
}
}

17
dockerfiles/services/sslproxy/hosts/dkui.xai-corp.net.conf
View File

@@ -1,6 +1,16 @@
proxy_cache_path /data/nginx/cache/dkui levels=1:2 keys_zone=dkui:10m max_size=10g
inactive=60m use_temp_path=off;
upstream portainer_upstream {
server tasks.dkui_app:9000;
server dkhost.xai-corp.net:9000 backup;
}
# dkui.xai-corp.net
server {
listen 443 ssl ipv6only=off;
# listen 443 ssl ipv6only=off;
listen 443 ssl;
server_name dkui.xai-corp.net;
ssl_certificate /etc/letsencrypt/live/xai-corp.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xai-corp.net/privkey.pem;
@@ -15,7 +25,10 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://dkhost.xai-corp.net:9000;
proxy_pass http://portainer_upstream;
proxy_connect_timeout 3s;
# proxy_next_upstream_timeout 1.5s;
}
}

15
dockerfiles/services/sslproxy/hosts/fs.xai-corp.net.conf
View File

@@ -1,15 +0,0 @@
# fs.xai-corp.net
server {
listen 443 ssl ipv6only=off;
server_name fs.xai-corp.net;
ssl_certificate /etc/letsencrypt/live/xai-corp.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xai-corp.net/privkey.pem;
#Strict-Transport-Security: max-age=15768000
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;
location / {
proxy_pass http://dkhost.xai-corp.net:8081;
}
}

12
dockerfiles/services/sslproxy/hosts/git.xai-corp.net.conf
View File

@@ -1,3 +1,12 @@
proxy_cache_path /data/nginx/cache/gitea levels=1:2 keys_zone=gitea:10m max_size=10g
inactive=60m use_temp_path=off;
upstream gitea_upstream {
server tasks.gitea_app:10080;
server dkhost.xai-corp.net:10080 backup;
}
# git.xai-corp.net
server {
listen 443 ssl ipv6only=off;
@@ -9,7 +18,6 @@ server {
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;
location / {
proxy_pass http://dkhost.xai-corp.net:10080;
proxy_pass http://gitea_upstream;
}
}

21
dockerfiles/services/sslproxy/hosts/jenkins.xai-corp.net.conf
View File

@@ -1,21 +0,0 @@
# jenkins.xai-corp.net
server {
listen 443 ssl;
server_name jenkins.xai-corp.net;
ssl_certificate /etc/letsencrypt/live/xai-corp.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xai-corp.net/privkey.pem;
#Strict-Transport-Security: max-age=15768000
add_header Strict-Transport-Security "max-age=600; includeSubDomains" always;
location / {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://dkhost.xai-corp.net:8080;
}
}

13
dockerfiles/services/sslproxy/hosts/letsencrypt.conf
View File

@@ -1,13 +0,0 @@
# proxy for unsecured traffic for letsencrypt verification
server {
listen 80 default_server;
server_name _
client_max_body_size 200m;
location / {
proxy_set_header Connection $http_connection;
proxy_pass http://dkhost.xai-corp.net:83;
}
}

14
dockerfiles/services/sslproxy/hosts/xaibox.xai-corp.net.conf
View File

@@ -1,6 +1,16 @@
proxy_cache_path /data/nginx/cache/xaibox levels=1:2 keys_zone=xaibox:10m max_size=10g
inactive=60m use_temp_path=off;
upstream xaibox_upstream {
server tasks.xaibox_web:8083;
server xaibox.xai-corp.net:8083 backup;
server dkhost.xai-corp.net:8083 backup;
}
# xaibox.xai-corp.net
server {
listen 443 ssl ipv6only=off;
listen 443 ssl;
server_name xaibox.xai-corp.net;
ssl_certificate /etc/letsencrypt/live/xai-corp.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/xai-corp.net/privkey.pem;
@@ -12,7 +22,7 @@ server {
location / {
proxy_set_header Connection $http_connection;
proxy_pass http://dkhost.xai-corp.net:8083;
proxy_pass http://xaibox_upstream;
}
}