From 1b3f7b85922ad130034e0fb58fdbc4e6f0db6003 Mon Sep 17 00:00:00 2001 From: Zolfa Date: Mon, 27 Apr 2020 00:24:13 +0200 Subject: [PATCH] roles/reverse_proxy: proxy_protocol and random fix --- roles/reverse_proxy/defaults/main.yaml | 7 +- roles/reverse_proxy/tasks/main.yaml | 80 +++++++++++-------- .../templates/{http.j2 => http.conf.j2} | 4 +- roles/reverse_proxy/templates/map.j2 | 2 - roles/reverse_proxy/templates/upstream.j2 | 3 - 5 files changed, 56 insertions(+), 40 deletions(-) rename roles/reverse_proxy/templates/{http.j2 => http.conf.j2} (77%) delete mode 100644 roles/reverse_proxy/templates/map.j2 delete mode 100644 roles/reverse_proxy/templates/upstream.j2 diff --git a/roles/reverse_proxy/defaults/main.yaml b/roles/reverse_proxy/defaults/main.yaml index 54830f6..d54c645 100644 --- a/roles/reverse_proxy/defaults/main.yaml +++ b/roles/reverse_proxy/defaults/main.yaml @@ -1 +1,6 @@ -hostname: "{{ ansible_hostname }}" +--- +server_fqdns: + - '{{ ansible_hostname }}.{{ domain }}' + - 'www.{{ ansible_hostname }}.{{ domain }}' +proxy_protocol: true +... diff --git a/roles/reverse_proxy/tasks/main.yaml b/roles/reverse_proxy/tasks/main.yaml index 04bbe77..83ddea6 100644 --- a/roles/reverse_proxy/tasks/main.yaml +++ b/roles/reverse_proxy/tasks/main.yaml @@ -1,12 +1,15 @@ --- -- name: 'add https configs to nginx' +- name: 'configure nginx tcp 443 forwarder' blockinfile: dest: '/etc/nginx/nginx.conf' block: | stream { + # Get upstream $name rom TLS SNI Header map $ssl_preread_server_name $name { include /etc/nginx/map.conf.d/*.conf; } + + # Include upstream definitions include /etc/nginx/upstream.conf.d/*.conf; log_format stream_routing '$remote_addr [$time_local] ' @@ -14,19 +17,29 @@ 'proxying to "$name" ' '$protocol $status $bytes_sent $bytes_received ' '$session_time'; + server { listen {{ public_ip }}:443; - ssl_preread on; - proxy_pass $name; - # Pass original Client IP with PROXY PROTOCOL - proxy_protocol on; - access_log /var/log/nginx/stream_443.log stream_routing; + + # Inspect TLS Headers + ssl_preread on; + # Proxy connection to upstream $name + proxy_pass $name; + + # Log connection + access_log /var/log/nginx/stream_443.log stream_routing; + + # If on send PROXY Protocol headers to EVERY upstream + # servers. WARNING: It will break connection to upstreams + # not configured to accept PROXY Protocol! + proxy_protocol {{ 'on' if proxy_protocol else 'off' }}; } } + delegate_to: 'reverse_proxy' - notify: reload nginx + notify: 'reload nginx' -- name: 'add http configs to nginx' +- name: 'configure nginx http 80 forwarder' lineinfile: dest: '/etc/nginx/nginx.conf' insertafter: '^http {' @@ -34,44 +47,45 @@ delegate_to: 'reverse_proxy' notify: 'reload nginx' -- name: 'create the http.conf.d directory for nginx' +- name: 'create configuration directories for sites' file: state: 'directory' - dest: '/etc/nginx/http.conf.d' + dest: '/etc/nginx/{{ item }}' delegate_to: 'reverse_proxy' notify: 'reload nginx' + loop: + - 'http.conf.d' + - 'map.conf.d' + - 'upstream.conf.d' -- name: 'upload http to reverse proxy' +- name: 'configure http proxy for https redirect and acme challenge' template: - src: 'http.j2' - dest: '/etc/nginx/http.conf.d/http_{{ hostname }}.conf' + src: 'http.conf.j2' + dest: '/etc/nginx/http.conf.d/{{ ansible_hostname }}.conf' delegate_to: 'reverse_proxy' notify: 'reload nginx' -- name: 'create the map.conf directory for nginx' - file: - state: 'directory' - dest: '/etc/nginx/map.conf.d' +- name: 'configure upstream server spec' + copy: + content: | + upstream {{ ansible_hostname }}_https { + server {{ hostvars|ip_from_inventory(ansible_hostname) }}:{{ + "10443" if proxy_protocol else "443" + }}; + } + dest: '/etc/nginx/upstream.conf.d/{{ ansible_hostname }}.conf' delegate_to: 'reverse_proxy' notify: 'reload nginx' -- name: 'create the upstream.conf directory for nginx' - file: - state: 'directory' - dest: '/etc/nginx/upstream.conf.d' +- name: 'configure sni-upstream mapping' + copy: + content: | + {% for server_fqdn in server_fqdns %} + {{ server_fqdn }} {{ ansible_hostname }}_https; + {% endfor %} + dest: '/etc/nginx/map.conf.d/{{ ansible_hostname }}.conf' delegate_to: 'reverse_proxy' notify: 'reload nginx' -- name: 'upload mappings to reverse proxy' - template: - src: 'map.j2' - dest: '/etc/nginx/map.conf.d/map_{{ hostname }}.conf' - delegate_to: 'reverse_proxy' - notify: 'reload nginx' -- name: 'upload upstream to reverse proxy' - template: - src: 'upstream.j2' - dest: '/etc/nginx/upstream.conf.d/upstream_{{ hostname }}.conf' - delegate_to: 'reverse_proxy' - notify: 'reload nginx' + diff --git a/roles/reverse_proxy/templates/http.j2 b/roles/reverse_proxy/templates/http.conf.j2 similarity index 77% rename from roles/reverse_proxy/templates/http.j2 rename to roles/reverse_proxy/templates/http.conf.j2 index 4988904..78e87bf 100644 --- a/roles/reverse_proxy/templates/http.j2 +++ b/roles/reverse_proxy/templates/http.conf.j2 @@ -1,8 +1,9 @@ server { listen {{ public_ip }}:80; - server_name {{ hostname }}.{{ domain }} www.{{ hostname }}.{{ domain }}; + server_name {{ server_fqdns | join(" ") }}; + # Redirect ACME Challenges to the upstream server port 80 location /.well-known/acme-challenge/ { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -11,6 +12,7 @@ server { proxy_pass http://{{ hostvars | ip_from_inventory(ansible_hostname) }}; } + # Redirect to HTTPS all non-ACME requests location / { if ($request_method = POST) { return 307 https://$server_name$request_uri; diff --git a/roles/reverse_proxy/templates/map.j2 b/roles/reverse_proxy/templates/map.j2 deleted file mode 100644 index fcbabde..0000000 --- a/roles/reverse_proxy/templates/map.j2 +++ /dev/null @@ -1,2 +0,0 @@ -{{ hostname }}.{{ domain }} {{ hostname }}_https; -www.{{ hostname }}.{{ domain }} {{ hostname }}_https; diff --git a/roles/reverse_proxy/templates/upstream.j2 b/roles/reverse_proxy/templates/upstream.j2 deleted file mode 100644 index d48ea6f..0000000 --- a/roles/reverse_proxy/templates/upstream.j2 +++ /dev/null @@ -1,3 +0,0 @@ -upstream {{ hostname }}_https { - server {{ hostvars | ip_from_inventory(ansible_hostname) }}:443; -}