feat: improve naming and read secrets from files

Dockerfile.multiarch

@@ -34,15 +34,15 @@ RUN addgroup -g 1001 -S nginx && \
 
 ADD overlay/ /
 
-RUN mkdir -p /var/www /etc/proxy-config /etc/nginx/conf.d /var/tmp/nginx /var/cache/nginx && \
+RUN mkdir -p /var/www /etc/nginx-s3 /etc/nginx/conf.d /var/tmp/nginx /var/cache/nginx && \
     touch /run/nginx.pid && \
-    touch /etc/nginx/conf.d/vhost.conf && \
+    touch /etc/nginx/conf.d/vhosts.conf && \
     chown nginx /run/nginx.pid && \
     chown -R nginx /var/log/nginx /var/tmp/nginx /var/cache/nginx && \
     chown -R nginx:nginx /var/www && \
     chown -R root:nginx /etc/nginx /etc/nginx/conf.d && \
     chmod -R 640 /etc/nginx /etc/nginx/conf.d && \
-    chmod 750 /var/www /var/cache/nginx /etc/proxy-config /etc/nginx /etc/nginx/conf.d
+    chmod 750 /var/www /var/cache/nginx /etc/nginx-s3 /etc/nginx /etc/nginx/conf.d
 
 EXPOSE 8080
 

overlay/etc/nginx/nginx.conf

@@ -25,5 +25,5 @@ http {
         ~/$ ${request_uri}index.html;
     }
 
-    include /etc/nginx/conf.d/vhost.conf;
+    include /etc/nginx/conf.d/vhosts.conf;
 }

overlay/etc/templates/vhost.conf.tmpl

@@ -1,59 +0,0 @@
-{{- $vhost := ds "vhost" }}
-{{- $defauls := data.YAML "{hostnames: [localhost], proxy_ssl_protocols: TLSv1.2 TLSv1.3, proxy_hide_header: [X-Amz-*]}" -}}
-
-{{- range $vhost }}
-{{- $this := coll.Merge . $defauls }}
-{{- $upstream_host := index ($this.upstream | strings.Split ":") 0 }}
-{{- $access_key_id := index $this "access_key_id" }}
-{{- $secret_access_key := index $this "secret_access_key" -}}
-
-upstream backend_s3_{{ $this.bucket }} {
-    server {{ $this.upstream }};
-}
-
-server {
-    listen 8080;
-    server_name {{ conv.Join $this.hostnames " " }};
-
-    location / {
-        {{ if and $access_key_id $secret_access_key -}}
-        set_by_lua $now "return ngx.http_time(ngx.time())";
-        set $string_to_sign "GET\n\n\n${now}\n/{{ $this.bucket }}/${repo}$request_path";
-        set_hmac_sha1 $aws_signature "{{ $this.secret_access_key }}" "$string_to_sign";
-        set_encode_base64 $aws_signature "$aws_signature";
-
-        proxy_set_header Date "$now";
-        proxy_set_header Authorization "AWS {{ $this.access_key_id }}:$aws_signature";
-
-        {{ end -}}
-
-        proxy_pass https://backend_s3_{{ $this.bucket }}/{{ $this.bucket }}/${repo}$uri;
-        proxy_ssl_name {{ $upstream_host }};
-        proxy_ssl_server_name on;
-        proxy_ssl_verify on;
-        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
-        proxy_ssl_protocols {{ $this.proxy_ssl_protocols }};
-
-        proxy_http_version 1.1;
-        proxy_buffering off;
-        proxy_connect_timeout 300;
-        proxy_intercept_errors on;
-        port_in_redirect off;
-
-        proxy_set_header Host "{{ $upstream_host }}";
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        {{ range $this.proxy_hide_header }}
-        more_clear_headers {{ . }};
-        {{- end }}
-
-        proxy_ignore_headers Set-Cookie;
-
-        rewrite ^([^.]*[^/])$ $1/ permanent;
-        rewrite ^(.*)/$ $1/index.html break;
-        rewrite ^(.*/[^./]+)$ $1/index.html break;
-    }
-}
-{{- end -}}

overlay/etc/templates/vhosts.conf.tmpl

@@ -0,0 +1,90 @@
+{{- $config := ds "config" }}
+{{- $defauls := data.YAML "{hostnames: [localhost], upstream_use_tls: false, proxy_ssl_protocols: TLSv1.2 TLSv1.3, proxy_hide_header: [X-Amz-*]}" -}}
+
+{{- range $config }}
+{{- $this := coll.Merge . $defauls }}
+{{- $upstream_host := index ($this.upstream | strings.Split ":") 0 }}
+{{- $upstream_use_tls := $this.upstream_use_tls | conv.ToBool }}
+{{- $access_key_id_file := index $this "access_key_id_file" }}
+{{- $secret_access_key_file := index $this "secret_access_key_file" -}}
+
+upstream backend_s3_{{ $this.bucket }} {
+    server {{ $this.upstream }};
+}
+
+server {
+    listen 8080;
+    server_name {{ conv.Join $this.hostnames " " }};
+
+    location / {
+        {{ if and $access_key_id_file $secret_access_key_file -}}
+        set_by_lua $now "return ngx.http_time(ngx.time())";
+        set_by_lua_block $access_key_id {
+            local f, err = io.open('{{ $access_key_id_file }}', 'r')
+            local content
+            if f == nil then
+                ngx.log(ngx.STDERR, err)
+            else
+                content = string.gsub(f:read("*all"), "%s", "")
+                f:close()
+            end
+            return content
+        }
+        set_by_lua_block $secret_access_key {
+            local f, err = io.open('{{ $secret_access_key_file }}', 'r')
+            local content
+            if f == nil then
+                ngx.log(ngx.STDERR, err)
+            else
+                content = string.gsub(f:read("*all"), "%s", "")
+                f:close()
+            end
+            return content
+        }
+        set $string_to_sign "GET\n\n\n${now}\n/{{ $this.bucket }}/${repo}$request_path";
+        set_hmac_sha1 $aws_signature "$secret_access_key" "$string_to_sign";
+        set_encode_base64 $aws_signature "$aws_signature";
+
+        proxy_set_header Date "$now";
+        proxy_set_header Authorization "AWS $access_key_id:$aws_signature";
+
+        {{ end -}}
+
+        proxy_pass https://backend_s3_{{ $this.bucket }}/{{ $this.bucket }}/${repo}$uri;
+        {{- if $this.upstream_use_tls }}
+        proxy_ssl_name {{ $upstream_host }};
+        proxy_ssl_server_name on;
+        proxy_ssl_verify on;
+        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+        proxy_ssl_protocols {{ $this.proxy_ssl_protocols }};
+        {{- end }}
+
+        proxy_http_version 1.1;
+        proxy_buffering off;
+        proxy_connect_timeout 300;
+        proxy_intercept_errors on;
+        port_in_redirect off;
+
+        {{ if $this.upstream_use_tls -}}
+        proxy_set_header Host "{{ $upstream_host }}";
+        {{- else }}
+        proxy_set_header Host $host;
+        {{- end }}
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        {{- with $this.proxy_hide_header }}
+        {{ range $this.proxy_hide_header }}
+        more_clear_headers {{ . }};
+        {{- end }}
+        {{- end }}
+
+        proxy_ignore_headers Set-Cookie;
+
+        rewrite ^([^.]*[^/])$ $1/ permanent;
+        rewrite ^(.*)/$ $1/index.html break;
+        rewrite ^(.*/[^./]+)$ $1/index.html break;
+    }
+}
+{{- end -}}

overlay/usr/local/bin/entrypoint

@@ -1,5 +1,8 @@
 #!/usr/bin/env sh
 
+# shellcheck disable=SC3040
+set -eo pipefail
+
 # shellcheck disable=SC1091
 . /usr/local/lib/log.sh
 
@@ -33,11 +36,11 @@ start_server() {
 
 run_config() {
     log_info "Start nginx config service"
-    /usr/local/bin/gomplate -d vhost=/etc/proxy-config/vhost.yml -o /etc/nginx/conf.d/vhost.conf -f /etc/templates/vhost.conf.tmpl --chmod "0640"
+    /usr/local/bin/gomplate -d config=/etc/nginx-s3/config.yaml -o /etc/nginx/conf.d/vhosts.conf -f /etc/templates/vhosts.conf.tmpl --chmod "0640"
 
-    while inotifywait -q --timefmt "%F %T" --format "%T [INFO] [$(basename "$0")] %e %f" -e modify,move,create,delete /etc/proxy-config/vhost.yml; do
+    while inotifywait -q --timefmt "%F %T" --format "%T [INFO] [$(basename "$0")] %e %f" -e modify,move,create,delete /etc/nginx-s3/config.yaml; do
         log_info "Regenerate nginx config"
-        /usr/local/bin/gomplate -d vhost=/etc/proxy-config/vhost.yml -o /etc/nginx/conf.d/vhost.conf -f /etc/templates/vhost.conf.tmpl --chmod "0640"
+        /usr/local/bin/gomplate -d config=/etc/nginx-s3/config.yaml -o /etc/nginx/conf.d/vhosts.conf -f /etc/templates/vhosts.conf.tmpl --chmod "0640"
     done
 }