Merge pull request #436 from ocf/internal-nginx

Add nginx proxy layer to protect /metrics

Author: dkess

Dockerfile.static.in

@@ -6,7 +6,7 @@ RUN mkdir /opt/ocfweb/static
 ENV OCFWEB_STATIC_ROOT /opt/ocfweb/static
 RUN /opt/ocfweb/venv/bin/python /opt/ocfweb/manage.py collectstatic --noinput
 
-COPY services/nginx /opt/ocfweb/services/nginx
+COPY services/static /opt/ocfweb/services/static
 RUN chown -R nobody:nogroup /opt/ocfweb/services
 
 USER nobody

Dockerfile.web.in

@@ -1,6 +1,6 @@
 FROM {tag}
 
-COPY services/web /opt/ocfweb/services/web
+COPY services/web /opt/ocfweb/services/
 RUN chown -R nobody:nogroup /opt/ocfweb/services
 
 USER nobody

conf/metrics.htpasswd

@@ -0,0 +1,2 @@
+# Empty password
+prometheus:$apr1$4CUVWyim$MGnAdRap1gqM1estPDAPK0

services/nginx/log/run renamed to services/static/log/run

@@ -4,6 +4,6 @@ exec 2>&1
 
 cd /opt/ocfweb
 exec /opt/ocfweb/venv/bin/gunicorn \
-    -b 0.0.0.0:8000 \
+    -b 127.0.0.1:8080 \
     -w 4 \
     ocfweb.wsgi

services/nginx/nginx.conf renamed to services/static/nginx.conf

@@ -0,0 +1,3 @@
+#!/bin/bash
+set -euo pipefail
+exec /opt/share/utils/sbin/stdin2syslog ocfweb-web-nginx

services/nginx/run renamed to services/static/run

@@ -0,0 +1,40 @@
+error_log /dev/stderr;
+daemon off;
+pid /tmp/nginx_pid;
+
+events {}
+
+http {
+    include /etc/nginx/mime.types;
+    access_log /dev/stderr;
+
+    upstream ocfweb {
+        server 127.0.0.1:8080;
+    }
+
+    server {
+        listen 8000;
+
+        client_body_temp_path /tmp/nginx_client_temp;
+        fastcgi_temp_path /tmp/nginx_fastcgi_temp;
+        proxy_temp_path /tmp/nginx_proxy_temp;
+        scgi_temp_path /tmp/nginx_scgi_temp;
+        uwsgi_temp_path /tmp/nginx_uwsgi_temp;
+
+        location /metrics {
+            proxy_pass http://ocfweb;
+            proxy_set_header Host www.ocf.berkeley.edu;
+
+            auth_basic "Metrics";
+            auth_basic_user_file /etc/ocfweb/metrics.htpasswd;
+        }
+
+        location / {
+          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto $scheme;
+          proxy_set_header Host $http_host;
+          proxy_redirect   off;
+          proxy_pass       http://ocfweb;
+        }
+    }
+}

services/web/log/run renamed to services/web/app/log/run

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -euo pipefail
+exec 2>&1
+
+exec nginx -c nginx.conf -p $(pwd)