88 lines
2.3 KiB
Bash
Executable File
88 lines
2.3 KiB
Bash
Executable File
#!/bin/sh
|
|
# proxy-vm/docker-entrypoint.sh
|
|
# Generates nginx config fragments from environment variables at container start.
|
|
set -e
|
|
|
|
CONF_DIR="/etc/nginx/conf.d"
|
|
mkdir -p "${CONF_DIR}"
|
|
|
|
# --- 1. Generate IP allowlist (geo block) ---
|
|
ALLOWLIST_FILE="${CONF_DIR}/allowlist.conf"
|
|
|
|
if [ -z "${ALLOWED_CIDR}" ]; then
|
|
cat > "${ALLOWLIST_FILE}" <<'GEO'
|
|
geo $allowed_ip {
|
|
default 1;
|
|
}
|
|
GEO
|
|
echo "[entrypoint] ALLOWED_CIDR is empty — allowing all IPs (dev mode)"
|
|
else
|
|
{
|
|
echo 'geo $allowed_ip {'
|
|
echo ' default 0;'
|
|
echo "${ALLOWED_CIDR}" | tr ',' '\n' | while read -r cidr; do
|
|
cidr=$(echo "${cidr}" | xargs)
|
|
[ -n "${cidr}" ] && echo " ${cidr} 1;"
|
|
done
|
|
echo '}'
|
|
} > "${ALLOWLIST_FILE}"
|
|
echo "[entrypoint] IP allowlist configured: ${ALLOWED_CIDR}"
|
|
fi
|
|
|
|
# --- 2. Generate token auth (map block) ---
|
|
AUTH_FILE="${CONF_DIR}/auth.conf"
|
|
|
|
if [ -z "${PROXY_SECRET}" ]; then
|
|
echo "[entrypoint] PROXY_SECRET is not set — token auth disabled (open mode)"
|
|
cat > "${AUTH_FILE}" <<'MAP'
|
|
map $http_x_proxy_token $auth_ok {
|
|
default 1;
|
|
}
|
|
MAP
|
|
else
|
|
cat > "${AUTH_FILE}" <<MAP
|
|
map \$http_x_proxy_token \$auth_ok {
|
|
default 0;
|
|
"${PROXY_SECRET}" 1;
|
|
}
|
|
MAP
|
|
echo "[entrypoint] Token auth configured"
|
|
fi
|
|
|
|
# --- 3. Copy locations.conf ---
|
|
cp /etc/nginx/locations.conf "${CONF_DIR}/locations.conf"
|
|
echo "[entrypoint] Locations config copied"
|
|
|
|
# --- 4. Generate HTTPS server block (if certs exist) ---
|
|
HTTPS_FILE="${CONF_DIR}/https_server.conf"
|
|
SSL_CERT="/etc/nginx/ssl/tls.crt"
|
|
SSL_KEY="/etc/nginx/ssl/tls.key"
|
|
|
|
if [ -f "${SSL_CERT}" ] && [ -f "${SSL_KEY}" ]; then
|
|
cat > "${HTTPS_FILE}" <<HTTPS
|
|
server {
|
|
listen 8443 ssl;
|
|
server_name _;
|
|
|
|
ssl_certificate ${SSL_CERT};
|
|
ssl_certificate_key ${SSL_KEY};
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers HIGH:!aNULL:!MD5;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 10m;
|
|
|
|
include /etc/nginx/conf.d/locations.conf;
|
|
}
|
|
HTTPS
|
|
echo "[entrypoint] HTTPS enabled on port 8443 (cert: ${SSL_CERT})"
|
|
else
|
|
# Empty file so nginx include does not fail
|
|
: > "${HTTPS_FILE}"
|
|
echo "[entrypoint] No TLS certs found at ${SSL_CERT} — HTTPS disabled"
|
|
fi
|
|
|
|
# --- 5. Start nginx ---
|
|
echo "[entrypoint] Starting nginx..."
|
|
exec nginx -g 'daemon off;'
|