Skip to content
This repository was archived by the owner on Nov 6, 2025. It is now read-only.

Commit 616f342

Browse files
author
Antonio Cheong
committed
init. version
1 parent 77c0de4 commit 616f342

File tree

16 files changed

+625
-1
lines changed

16 files changed

+625
-1
lines changed

‎Dockerfile‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM nginx:latest
2+
3+
COPY rootfs/ /
4+
5+
RUN mkdir -p /tmp/nginx/body /var/lib/nginx/cache /data/logs \
6+
&& mkdir -p /etc/letsencrypt/live/placeholder /data/nginx/placeholder /data/custom_ssl/placeholder \
7+
&& find /etc/nginx -type d -exec chmod 755 {} \; \
8+
&& find /etc/nginx -type f -exec chmod 644 {} \; \
9+
&& chmod 755 /docker-entrypoint.d/99-dynamic_resolvers.sh /bin/nginx_auto_reload.sh

‎README.md‎

Lines changed: 63 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,64 @@
1-
# nginx4npm
1+
# nginx
2+
23
nginx prepare for working with Nginx Proxy Manager (NPM) together.
4+
5+
6+
## Stack config
7+
8+
```yml
9+
version: "3.7"
10+
11+
volumes:
12+
13+
data:
14+
15+
letsencrypt:
16+
17+
networks:
18+
19+
host:
20+
external:
21+
name: "host"
22+
23+
services:
24+
25+
manager:
26+
image: jc21/nginx-proxy-manager:latest
27+
ports:
28+
- '81:81'
29+
environment:
30+
TZ: Asia/Hong_Kong
31+
volumes:
32+
- data:/data
33+
- letsencrypt:/etc/letsencrypt
34+
deploy:
35+
mode: replicated
36+
replicas: 1
37+
restart_policy:
38+
condition: on-failure
39+
logging:
40+
options:
41+
max-size: "10m"
42+
max-file: "3"
43+
44+
worker:
45+
image: windoac/nginx-npm:latest
46+
networks:
47+
- host
48+
environment:
49+
TZ: Asia/Hong_Kong
50+
volumes:
51+
- data:/data
52+
- letsencrypt:/etc/letsencrypt
53+
deploy:
54+
#mode: global
55+
mode: replicated
56+
replicas: 1
57+
restart_policy:
58+
condition: on-failure
59+
logging:
60+
options:
61+
max-size: "10m"
62+
max-file: "3"
63+
64+
```

‎rootfs/bin/nginx_auto_reload.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/bash
2+
3+
# setting
4+
checkinterval_min=1
5+
6+
echo "$0 - Start monitoring"
7+
8+
timesleep=$(($checkinterval_min*60))
9+
10+
while true
11+
do
12+
sleep $timesleep
13+
if [[ `find /data/nginx /data/nginx/* /data/custom_ssl /data/custom_ssl/* /etc/letsencrypt/live /etc/letsencrypt/live/* -type f ! -name "*.swp" -mmin -1 | wc -l` != 0 ]]
14+
then
15+
echo "$0 - Detected Nginx Configuration Change."
16+
# timetosleep=$(( $RANDOM % 6 + 5 ))
17+
# echo "$0 - sleep 5 - 10 sec randomly. this time sleep $timetosleep sec..."
18+
# sleep $timetosleep
19+
nginx -t
20+
if [ $? -eq 0 ]
21+
then
22+
echo "$0 - Executing: nginx -s reload"
23+
nginx -s reload
24+
else
25+
echo "$0 - found error in config check. skiped the auto reload."
26+
fi
27+
fi
28+
done
29+
30+
echo "$0 - monitor stoped"

‎rootfs/docker-entrypoint.d/99-dynamic_resolvers.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
set -e
3+
4+
# log_info 'Dynamic resolvers ...'
5+
6+
DISABLE_IPV6=$(echo "${DISABLE_IPV6:-}" | tr '[:upper:]' '[:lower:]')
7+
8+
# Dynamically generate resolvers file, if resolver is IPv6, enclose in `[]`
9+
# thanks @tfmm
10+
if [ "$DISABLE_IPV6" == "true" ] || [ "$DISABLE_IPV6" == "on" ] || [ "$DISABLE_IPV6" == "1" ] || [ "$DISABLE_IPV6" == "yes" ];
11+
then
12+
echo resolver "$(awk 'BEGIN{ORS=" "} $1=="nameserver" { sub(/%.*$/,"",$2); print ($2 ~ ":")? "["$2"]": $2}' /etc/resolv.conf) ipv6=off valid=10s;" > /etc/nginx/conf.d/include/resolvers.conf
13+
else
14+
echo resolver "$(awk 'BEGIN{ORS=" "} $1=="nameserver" { sub(/%.*$/,"",$2); print ($2 ~ ":")? "["$2"]": $2}' /etc/resolv.conf) valid=10s;" > /etc/nginx/conf.d/include/resolvers.conf
15+
fi

‎rootfs/docker-entrypoint.sh‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/bin/sh
2+
# vim:sw=4:ts=4:et
3+
4+
set -e
5+
6+
entrypoint_log() {
7+
if [ -z "${NGINX_ENTRYPOINT_QUIET_LOGS:-}" ]; then
8+
echo "$@"
9+
fi
10+
}
11+
12+
_exitpoint() {
13+
kill -TERM $child
14+
#pkill nginx
15+
}
16+
17+
18+
if [ "$1" = "nginx" -o "$1" = "nginx-debug" ]; then
19+
if /usr/bin/find "/docker-entrypoint.d/" -mindepth 1 -maxdepth 1 -type f -print -quit 2>/dev/null | read v; then
20+
entrypoint_log "$0: /docker-entrypoint.d/ is not empty, will attempt to perform configuration"
21+
22+
entrypoint_log "$0: Looking for shell scripts in /docker-entrypoint.d/"
23+
find "/docker-entrypoint.d/" -follow -type f -print | sort -V | while read -r f; do
24+
case "$f" in
25+
*.envsh)
26+
if [ -x "$f" ]; then
27+
entrypoint_log "$0: Sourcing $f";
28+
. "$f"
29+
else
30+
# warn on shell scripts without exec bit
31+
entrypoint_log "$0: Ignoring $f, not executable";
32+
fi
33+
;;
34+
*.sh)
35+
if [ -x "$f" ]; then
36+
entrypoint_log "$0: Launching $f";
37+
"$f"
38+
else
39+
# warn on shell scripts without exec bit
40+
entrypoint_log "$0: Ignoring $f, not executable";
41+
fi
42+
;;
43+
*) entrypoint_log "$0: Ignoring $f";;
44+
esac
45+
done
46+
47+
entrypoint_log "$0: Configuration complete; ready for start up"
48+
else
49+
entrypoint_log "$0: No files found in /docker-entrypoint.d/, skipping configuration"
50+
fi
51+
fi
52+
53+
trap _exitpoint TERM EXIT INT
54+
55+
nginx_auto_reload.sh &
56+
child=$!
57+
58+
exec "$@"

‎rootfs/etc/nginx/conf.d/default.conf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# "You are not configured" page, which is the default if another default doesn't exist
2+
server {
3+
listen 80;
4+
listen [::]:80;
5+
6+
set $forward_scheme "http";
7+
set $server "127.0.0.1";
8+
set $port "80";
9+
10+
server_name localhost-nginx-proxy-manager;
11+
access_log /data/logs/fallback_access.log standard;
12+
error_log /data/logs/fallback_error.log warn;
13+
include conf.d/include/assets.conf;
14+
include conf.d/include/block-exploits.conf;
15+
include conf.d/include/letsencrypt-acme-challenge.conf;
16+
17+
location / {
18+
index index.html;
19+
root /var/www/html;
20+
}
21+
}
22+
23+
# First 443 Host, which is the default if another default doesn't exist
24+
server {
25+
listen 443 ssl;
26+
listen [::]:443 ssl;
27+
28+
set $forward_scheme "https";
29+
set $server "127.0.0.1";
30+
set $port "443";
31+
32+
server_name localhost;
33+
access_log /data/logs/fallback_access.log standard;
34+
error_log /dev/null crit;
35+
ssl_reject_handshake on;
36+
37+
return 444;
38+
}

‎rootfs/etc/nginx/conf.d/include/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
resolvers.conf

‎rootfs/etc/nginx/conf.d/include/assets.conf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
location ~* ^.*\.(css|js|jpe?g|gif|png|webp|woff|eot|ttf|svg|ico|css\.map|js\.map)$ {
2+
if_modified_since off;
3+
4+
# use the public cache
5+
proxy_cache public-cache;
6+
proxy_cache_key $host$request_uri;
7+
8+
# ignore these headers for media
9+
proxy_ignore_headers Set-Cookie Cache-Control Expires X-Accel-Expires;
10+
11+
# cache 200s and also 404s (not ideal but there are a few 404 images for some reason)
12+
proxy_cache_valid any 30m;
13+
proxy_cache_valid 404 1m;
14+
15+
# strip this header to avoid If-Modified-Since requests
16+
proxy_hide_header Last-Modified;
17+
proxy_hide_header Cache-Control;
18+
proxy_hide_header Vary;
19+
20+
proxy_cache_bypass 0;
21+
proxy_no_cache 0;
22+
23+
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504 http_404;
24+
proxy_connect_timeout 5s;
25+
proxy_read_timeout 45s;
26+
27+
expires @30m;
28+
access_log off;
29+
30+
include conf.d/include/proxy.conf;
31+
}

‎rootfs/etc/nginx/conf.d/include/block-exploits.conf‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
## Block SQL injections
2+
set $block_sql_injections 0;
3+
4+
if ($query_string ~ "union.*select.*\(") {
5+
set $block_sql_injections 1;
6+
}
7+
8+
if ($query_string ~ "union.*all.*select.*") {
9+
set $block_sql_injections 1;
10+
}
11+
12+
if ($query_string ~ "concat.*\(") {
13+
set $block_sql_injections 1;
14+
}
15+
16+
if ($block_sql_injections = 1) {
17+
return 403;
18+
}
19+
20+
## Block file injections
21+
set $block_file_injections 0;
22+
23+
if ($query_string ~ "[a-zA-Z0-9_]=http://") {
24+
set $block_file_injections 1;
25+
}
26+
27+
if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
28+
set $block_file_injections 1;
29+
}
30+
31+
if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
32+
set $block_file_injections 1;
33+
}
34+
35+
if ($block_file_injections = 1) {
36+
return 403;
37+
}
38+
39+
## Block common exploits
40+
set $block_common_exploits 0;
41+
42+
if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
43+
set $block_common_exploits 1;
44+
}
45+
46+
if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
47+
set $block_common_exploits 1;
48+
}
49+
50+
if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
51+
set $block_common_exploits 1;
52+
}
53+
54+
if ($query_string ~ "proc/self/environ") {
55+
set $block_common_exploits 1;
56+
}
57+
58+
if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
59+
set $block_common_exploits 1;
60+
}
61+
62+
if ($query_string ~ "base64_(en|de)code\(.*\)") {
63+
set $block_common_exploits 1;
64+
}
65+
66+
if ($block_common_exploits = 1) {
67+
return 403;
68+
}
69+
70+
## Block spam
71+
set $block_spam 0;
72+
73+
if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
74+
set $block_spam 1;
75+
}
76+
77+
if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
78+
set $block_spam 1;
79+
}
80+
81+
if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
82+
set $block_spam 1;
83+
}
84+
85+
if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
86+
set $block_spam 1;
87+
}
88+
89+
if ($block_spam = 1) {
90+
return 403;
91+
}
92+
93+
## Block user agents
94+
set $block_user_agents 0;
95+
96+
# Disable Akeeba Remote Control 2.5 and earlier
97+
if ($http_user_agent ~ "Indy Library") {
98+
set $block_user_agents 1;
99+
}
100+
101+
# Common bandwidth hoggers and hacking tools.
102+
if ($http_user_agent ~ "libwww-perl") {
103+
set $block_user_agents 1;
104+
}
105+
106+
if ($http_user_agent ~ "GetRight") {
107+
set $block_user_agents 1;
108+
}
109+
110+
if ($http_user_agent ~ "GetWeb!") {
111+
set $block_user_agents 1;
112+
}
113+
114+
if ($http_user_agent ~ "Go!Zilla") {
115+
set $block_user_agents 1;
116+
}
117+
118+
if ($http_user_agent ~ "Download Demon") {
119+
set $block_user_agents 1;
120+
}
121+
122+
if ($http_user_agent ~ "Go-Ahead-Got-It") {
123+
set $block_user_agents 1;
124+
}
125+
126+
if ($http_user_agent ~ "TurnitinBot") {
127+
set $block_user_agents 1;
128+
}
129+
130+
if ($http_user_agent ~ "GrabNet") {
131+
set $block_user_agents 1;
132+
}
133+
134+
if ($block_user_agents = 1) {
135+
return 403;
136+
}

‎rootfs/etc/nginx/conf.d/include/force-ssl.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
if ($scheme = "http") {
2+
return 301 https://$host$request_uri;
3+
}

0 commit comments

Comments
 (0)