From a72eb1f894af0f7dc0d22383f39c2db0a4c4e29f Mon Sep 17 00:00:00 2001 From: tim Date: Mon, 22 Apr 2024 19:14:25 +0300 Subject: [PATCH 1/4] r68069-alb-healthchecks-and-nginx --- roles/debian/nginx/templates/vhosts.j2 | 48 +++++++++++++++----------- 1 file changed, 28 insertions(+), 20 deletions(-) diff --git a/roles/debian/nginx/templates/vhosts.j2 b/roles/debian/nginx/templates/vhosts.j2 index 9cf7b514a..892c02578 100644 --- a/roles/debian/nginx/templates/vhosts.j2 +++ b/roles/debian/nginx/templates/vhosts.j2 @@ -17,14 +17,14 @@ server { {% endif %} {% if server.custom_directives is defined %} {% for directive in server.custom_directives %} - {{ directive }} +{{ directive }} {% endfor %} {% endif %} {% if server.ssl %} - ssl_certificate {{ ssl_facts[_ssl_domains[0]].certificate }}; +ssl_certificate {{ ssl_facts[_ssl_domains[0]].certificate }}; ssl_certificate_key {{ ssl_facts[_ssl_domains[0]].key }}; {% endif %} - error_log {{ domain.error_log }} {{ domain.error_log_level }}; +error_log {{ domain.error_log }} {{ domain.error_log_level }}; access_log {{ domain.access_log }} {{ domain.access_log_format | default('main') }}; root "{{ domain.webroot }}"; include "/etc/nginx/conf.d/{{ domain.project_type }}"; @@ -38,23 +38,31 @@ server { } {% endif %} {% endif %} -{% if - domain.basic_auth.auth_enabled is defined and - domain.basic_auth.auth_enabled and - domain.basic_auth.auth_user is defined and - domain.basic_auth.auth_user | length > 0 -%} - auth_basic "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; - auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.htpasswd"; -{% endif %} -{% if - domain.basic_auth.auth_enabled is defined and - domain.basic_auth.auth_enabled and - domain.basic_auth.auth_file is defined and - domain.basic_auth.auth_file | length > 0 -%} - auth_basic "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; - auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.provided.htpasswd"; + +{% if domain.basic_auth.auth_enabled is defined and domain.basic_auth.auth_enabled %} + {% if _profile == 'asg' and domain.is_default is defined and domain.is_default %} + set $bypassagent "0"; + set $bypass "0"; + set $auth_status "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; + if ($http_user_agent ~* "ELB-HealthChecker") { + set $bypassagent "1"; + } + if ($remote_addr ~ "^{{ _aws_vpc_cidr_base | replace('.', '\\.') }}\." ) { + set $bypass "${bypassagent}1"; + } + if ($bypass = "11") { + set $auth_status "off"; + } + auth_basic $auth_status; + {% else %} + auth_basic "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; + {% endif %} + {% if domain.basic_auth.auth_user is defined and domain.basic_auth.auth_user | length > 0 %} + auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.htpasswd"; + {% endif %} + {% if domain.basic_auth.auth_file is defined and and domain.basic_auth.auth_file | length > 0 %} + auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.provided.htpasswd"; + {% endif %} {% endif %} } {% endfor %} From eaa8418a6b1b57deaeb91326bc913e0af67d1573 Mon Sep 17 00:00:00 2001 From: tim Date: Mon, 22 Apr 2024 19:54:31 +0300 Subject: [PATCH 2/4] r68069-alb-healthchecks-and-nginx --- roles/debian/nginx/templates/vhosts.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/debian/nginx/templates/vhosts.j2 b/roles/debian/nginx/templates/vhosts.j2 index 892c02578..12a9856d7 100644 --- a/roles/debian/nginx/templates/vhosts.j2 +++ b/roles/debian/nginx/templates/vhosts.j2 @@ -60,7 +60,7 @@ error_log {{ domain.error_log }} {{ domain.error_log_level }}; {% if domain.basic_auth.auth_user is defined and domain.basic_auth.auth_user | length > 0 %} auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.htpasswd"; {% endif %} - {% if domain.basic_auth.auth_file is defined and and domain.basic_auth.auth_file | length > 0 %} + {% if domain.basic_auth.auth_file is defined and domain.basic_auth.auth_file | length > 0 %} auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.provided.htpasswd"; {% endif %} {% endif %} From f46d492c8ced53c22db968ec0f61b6b9b00e07cc Mon Sep 17 00:00:00 2001 From: tim Date: Mon, 22 Apr 2024 20:34:07 +0300 Subject: [PATCH 3/4] r68069-alb-healthchecks-and-nginx --- roles/debian/nginx/templates/vhosts.j2 | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/roles/debian/nginx/templates/vhosts.j2 b/roles/debian/nginx/templates/vhosts.j2 index 12a9856d7..55c20927e 100644 --- a/roles/debian/nginx/templates/vhosts.j2 +++ b/roles/debian/nginx/templates/vhosts.j2 @@ -24,7 +24,7 @@ server { ssl_certificate {{ ssl_facts[_ssl_domains[0]].certificate }}; ssl_certificate_key {{ ssl_facts[_ssl_domains[0]].key }}; {% endif %} -error_log {{ domain.error_log }} {{ domain.error_log_level }}; + error_log {{ domain.error_log }} {{ domain.error_log_level }}; access_log {{ domain.access_log }} {{ domain.access_log_format | default('main') }}; root "{{ domain.webroot }}"; include "/etc/nginx/conf.d/{{ domain.project_type }}"; @@ -40,7 +40,7 @@ error_log {{ domain.error_log }} {{ domain.error_log_level }}; {% endif %} {% if domain.basic_auth.auth_enabled is defined and domain.basic_auth.auth_enabled %} - {% if _profile == 'asg' and domain.is_default is defined and domain.is_default %} +{% if _profile == 'asg' and domain.is_default is defined and domain.is_default %} set $bypassagent "0"; set $bypass "0"; set $auth_status "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; @@ -53,16 +53,16 @@ error_log {{ domain.error_log }} {{ domain.error_log_level }}; if ($bypass = "11") { set $auth_status "off"; } - auth_basic $auth_status; - {% else %} - auth_basic "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; - {% endif %} - {% if domain.basic_auth.auth_user is defined and domain.basic_auth.auth_user | length > 0 %} - auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.htpasswd"; - {% endif %} - {% if domain.basic_auth.auth_file is defined and domain.basic_auth.auth_file | length > 0 %} - auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.provided.htpasswd"; - {% endif %} + auth_basic $auth_status; +{% else %} + auth_basic "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; +{% endif %} +{% if domain.basic_auth.auth_user is defined and domain.basic_auth.auth_user | length > 0 %} + auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.htpasswd"; +{% endif %} +{% if domain.basic_auth.auth_file is defined and domain.basic_auth.auth_file | length > 0 %} + auth_basic_user_file "/etc/nginx/passwords/{{ domain.server_name }}.provided.htpasswd"; +{% endif %} {% endif %} } {% endfor %} From 3f0674cac148bb5c45d86bd0401b37daf2c2785c Mon Sep 17 00:00:00 2001 From: tim Date: Mon, 22 Apr 2024 23:42:28 +0300 Subject: [PATCH 4/4] r68069-nice-indentation --- roles/debian/nginx/templates/drupal10.j2 | 4 +-- roles/debian/nginx/templates/drupal_common.j2 | 4 +-- roles/debian/nginx/templates/nginx.conf.j2 | 4 +-- roles/debian/nginx/templates/vhosts.j2 | 33 ++++++++++--------- 4 files changed, 23 insertions(+), 22 deletions(-) diff --git a/roles/debian/nginx/templates/drupal10.j2 b/roles/debian/nginx/templates/drupal10.j2 index 2bef01860..c74dc42d0 100644 --- a/roles/debian/nginx/templates/drupal10.j2 +++ b/roles/debian/nginx/templates/drupal10.j2 @@ -24,10 +24,10 @@ location @phpprocess { # Rewrite any request not whitelisted below, # so they get processed through the app level (and 404). location / { - {% if nginx.ratelimitingcrawlers %} +{% if nginx.ratelimitingcrawlers %} # @todo # limit_req zone=bots burst=5 nodelay; - {% endif %} +{% endif %} try_files @rewrite /index.php?$query_string; } diff --git a/roles/debian/nginx/templates/drupal_common.j2 b/roles/debian/nginx/templates/drupal_common.j2 index e87a61702..8e3bf96f6 100644 --- a/roles/debian/nginx/templates/drupal_common.j2 +++ b/roles/debian/nginx/templates/drupal_common.j2 @@ -16,10 +16,10 @@ location @phpprocess { # Rewrite any request not whitelisted below, # so they get processed through the app level (and 404). location / { - {% if nginx.ratelimitingcrawlers %} +{% if nginx.ratelimitingcrawlers %} # @todo # limit_req zone=bots burst=5 nodelay; - {% endif %} +{% endif %} try_files @rewrite /index.php?$query_string; } diff --git a/roles/debian/nginx/templates/nginx.conf.j2 b/roles/debian/nginx/templates/nginx.conf.j2 index f64cad774..7d608906e 100644 --- a/roles/debian/nginx/templates/nginx.conf.j2 +++ b/roles/debian/nginx/templates/nginx.conf.j2 @@ -54,9 +54,9 @@ http { ## {% if nginx.http.custom_directives is defined %} - {% for directive in nginx.http.custom_directives %} +{% for directive in nginx.http.custom_directives %} {{ directive }} - {% endfor %} +{% endfor %} {% endif %} ## diff --git a/roles/debian/nginx/templates/vhosts.j2 b/roles/debian/nginx/templates/vhosts.j2 index 55c20927e..96546b61a 100644 --- a/roles/debian/nginx/templates/vhosts.j2 +++ b/roles/debian/nginx/templates/vhosts.j2 @@ -16,12 +16,12 @@ server { rewrite ^ https://{{ domain.server_name }}$request_uri? permanent; {% endif %} {% if server.custom_directives is defined %} - {% for directive in server.custom_directives %} -{{ directive }} - {% endfor %} +{% for directive in server.custom_directives %} + {{ directive }} +{% endfor %} {% endif %} {% if server.ssl %} -ssl_certificate {{ ssl_facts[_ssl_domains[0]].certificate }}; + ssl_certificate {{ ssl_facts[_ssl_domains[0]].certificate }}; ssl_certificate_key {{ ssl_facts[_ssl_domains[0]].key }}; {% endif %} error_log {{ domain.error_log }} {{ domain.error_log_level }}; @@ -41,18 +41,19 @@ ssl_certificate {{ ssl_facts[_ssl_domains[0]].certificate }}; {% if domain.basic_auth.auth_enabled is defined and domain.basic_auth.auth_enabled %} {% if _profile == 'asg' and domain.is_default is defined and domain.is_default %} - set $bypassagent "0"; - set $bypass "0"; - set $auth_status "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; - if ($http_user_agent ~* "ELB-HealthChecker") { - set $bypassagent "1"; - } - if ($remote_addr ~ "^{{ _aws_vpc_cidr_base | replace('.', '\\.') }}\." ) { - set $bypass "${bypassagent}1"; - } - if ($bypass = "11") { - set $auth_status "off"; - } + # Additional http_auth bypass for ASG healthchecks. + set $bypassagent "0"; + set $bypass "0"; + set $auth_status "{{ domain.basic_auth.auth_message | default('Restricted content') }}"; + if ($http_user_agent ~* "ELB-HealthChecker") { + set $bypassagent "1"; + } + if ($remote_addr ~ "^{{ _aws_vpc_cidr_base | replace('.', '\\.') }}\." ) { + set $bypass "${bypassagent}1"; + } + if ($bypass = "11") { + set $auth_status "off"; + } auth_basic $auth_status; {% else %} auth_basic "{{ domain.basic_auth.auth_message | default('Restricted content') }}";