329 lines
13 KiB
JavaScript
329 lines
13 KiB
JavaScript
/*
|
|
Copyright 2020 DigitalOcean
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
import { getSslCertificate, getSslCertificateKey } from '../../util/get_ssl_certificate';
|
|
import { getAccessLogDomainPath, getErrorLogDomainPath } from '../../util/get_log_paths';
|
|
import { extensions, gzipTypes } from '../../util/types_extensions';
|
|
import commonHsts from '../../util/common_hsts';
|
|
import securityConf from './security.conf';
|
|
import pythonConf from './python_uwsgi.conf';
|
|
import proxyConf from './proxy.conf';
|
|
import phpConf from './php_fastcgi.conf';
|
|
import generalConf from './general.conf';
|
|
import wordPressConf from './wordpress.conf';
|
|
import drupalConf from './drupal.conf';
|
|
import magentoConf from './magento.conf';
|
|
import letsEncryptConf from './letsencrypt.conf';
|
|
|
|
const sslConfig = (domain, global) => {
|
|
const config = [];
|
|
if (domain.https.https.computed) {
|
|
config.push(['# SSL', '']);
|
|
config.push(['ssl_certificate', getSslCertificate(domain, global)]);
|
|
config.push(['ssl_certificate_key', getSslCertificateKey(domain, global)]);
|
|
|
|
// Let's encrypt
|
|
if (domain.https.certType.computed === 'letsEncrypt')
|
|
config.push(['ssl_trusted_certificate',
|
|
`/etc/letsencrypt/live/${domain.server.domain.computed}/chain.pem`]);
|
|
}
|
|
return config;
|
|
};
|
|
|
|
const httpsListen = domain => {
|
|
const config = [];
|
|
|
|
// HTTPS
|
|
config.push(['listen', `${domain.server.listenIpv4.computed === '*' ? '' : `${domain.server.listenIpv4.computed}:`}443 ssl${domain.https.http2.computed ? ' http2' : ''}`]);
|
|
|
|
// v6
|
|
if (domain.server.listenIpv6.computed)
|
|
config.push(['listen',
|
|
`[${domain.server.listenIpv6.computed}]:443 ssl${domain.https.http2.computed ? ' http2' : ''}`]);
|
|
|
|
return config;
|
|
};
|
|
|
|
const httpListen = domain => {
|
|
const config = [];
|
|
|
|
// Not HTTPS
|
|
config.push(['listen', `${domain.server.listenIpv4.computed === '*' ? '' : `${domain.server.listenIpv4.computed}:`}80`]);
|
|
|
|
// v6
|
|
if (domain.server.listenIpv6.computed)
|
|
config.push(['listen', `[${domain.server.listenIpv6.computed}]:80`]);
|
|
|
|
return config;
|
|
};
|
|
|
|
const listenConfig = domain => {
|
|
if (domain.https.https.computed) return httpsListen(domain);
|
|
return httpListen(domain);
|
|
};
|
|
|
|
export default (domain, domains, global) => {
|
|
// Use kv so we can use the same key multiple times
|
|
const config = [];
|
|
|
|
// Build the server config on its own before adding it to the parent config
|
|
const serverConfig = [];
|
|
|
|
// Not HTTPS or not force HTTPS
|
|
if (!domain.https.https.computed || !domain.https.forceHttps.computed) serverConfig.push(...httpListen(domain));
|
|
|
|
// HTTPS
|
|
if (domain.https.https.computed) serverConfig.push(...httpsListen(domain));
|
|
|
|
serverConfig.push(['server_name',
|
|
`${domain.server.wwwSubdomain.computed ? 'www.' : ''}${domain.server.domain.computed}`]);
|
|
|
|
// PHP or Django
|
|
if (domain.php.php.computed || (domain.python.python.computed && domain.python.djangoRules.computed)) {
|
|
serverConfig.push(['set', `$base ${domain.server.path.computed}`]);
|
|
|
|
// root
|
|
if (domain.routing.root.computed)
|
|
serverConfig.push(['root', `$base${domain.server.documentRoot.computed}`]);
|
|
}
|
|
|
|
// Not PHP and not Django and root
|
|
if (!domain.php.php.computed
|
|
&& (!domain.python.python.computed || !domain.python.djangoRules.computed)
|
|
&& domain.routing.root.computed)
|
|
serverConfig.push(['root', `${domain.server.path.computed}${domain.server.documentRoot.computed}`]);
|
|
|
|
// HTTPS
|
|
serverConfig.push(...sslConfig(domain, global));
|
|
|
|
// HSTS
|
|
if (!commonHsts(domains) && domain.https.hsts.computed) {
|
|
serverConfig.push(['# HSTS', '']);
|
|
serverConfig.push(['add_header Strict-Transport-Security',
|
|
`'"max-age=31536000${domain.https.hstsSubdomains.computed ? '; includeSubDomains' : ''}${domain.https.hstsPreload.computed ? '; preload' : ''}" always'`]);
|
|
}
|
|
|
|
// Security
|
|
if (global.tools.modularizedStructure.computed) {
|
|
// Modularized
|
|
serverConfig.push(['# security', '']);
|
|
serverConfig.push(['include', 'nginxconfig.io/security.conf']);
|
|
} else {
|
|
// Unified
|
|
serverConfig.push(...securityConf(domains, global));
|
|
}
|
|
|
|
// Access log or error log for domain
|
|
if (domain.logging.accessLog.computed || domain.logging.errorLog.computed) {
|
|
serverConfig.push(['# logging', '']);
|
|
|
|
if (domain.logging.accessLog.computed)
|
|
serverConfig.push(['access_log', getAccessLogDomainPath(domain, global)]);
|
|
|
|
if (domain.logging.errorLog.computed)
|
|
serverConfig.push(['error_log', getErrorLogDomainPath(domain, global)]);
|
|
}
|
|
|
|
// index.php
|
|
if (domain.routing.index.computed === 'index.php') {
|
|
serverConfig.push(['# index.php', '']);
|
|
serverConfig.push(['index', 'index.php']);
|
|
}
|
|
|
|
// Fallback index.html or index.php
|
|
if ((domain.routing.fallbackHtml.computed || domain.routing.fallbackPhp.computed)
|
|
&& (!domain.reverseProxy.reverseProxy.computed || domain.reverseProxy.path.computed !== '/')) {
|
|
serverConfig.push([`# index.${domain.routing.fallbackHtml.computed ? 'html' : (domain.routing.fallbackPhp.computed ? 'php' : '')} fallback`, '']);
|
|
serverConfig.push(['location /', {
|
|
try_files: `$uri $uri/ /index.${domain.routing.fallbackHtml.computed ? 'html' : (domain.routing.fallbackPhp.computed ? 'php?$query_string' : '')}`,
|
|
}]);
|
|
}
|
|
|
|
// Fallback index.html and index.php
|
|
if (domain.routing.fallbackHtml.computed && domain.routing.fallbackPhp.computed) {
|
|
serverConfig.push(['# index.php fallback', '']);
|
|
serverConfig.push([`location ~ ^${domain.routing.fallbackPhpPath.computed}`, {
|
|
try_files: '$uri $uri/ /index.php?$query_string',
|
|
}]);
|
|
}
|
|
|
|
// Python
|
|
if (domain.python.python.computed) {
|
|
if (global.tools.modularizedStructure.computed) {
|
|
// Modularized
|
|
serverConfig.push(['location /', { include: 'nginxconfig.io/python_uwsgi.conf' }]);
|
|
} else {
|
|
// Unified
|
|
serverConfig.push(['location /', pythonConf(global)]);
|
|
}
|
|
|
|
// Django
|
|
if (domain.python.djangoRules.computed) {
|
|
serverConfig.push(['# Django media', '']);
|
|
serverConfig.push(['location /media/', { alias: '$base/media/' }]);
|
|
|
|
serverConfig.push(['# Django static', '']);
|
|
serverConfig.push(['location /static/', { alias: '$base/static/' }]);
|
|
}
|
|
}
|
|
|
|
// Reverse proxy
|
|
if (domain.reverseProxy.reverseProxy.computed) {
|
|
const locConf = [];
|
|
locConf.push(['proxy_pass', domain.reverseProxy.proxyPass.computed]);
|
|
|
|
if (global.tools.modularizedStructure.computed) {
|
|
// Modularized
|
|
locConf.push(['include', 'nginxconfig.io/proxy.conf']);
|
|
} else {
|
|
// Unified
|
|
locConf.push(...Object.entries(proxyConf()));
|
|
}
|
|
|
|
serverConfig.push(['# reverse proxy', '']);
|
|
serverConfig.push([`location ${domain.reverseProxy.path.computed}`, locConf]);
|
|
}
|
|
|
|
// PHP
|
|
if (domain.php.php.computed) {
|
|
serverConfig.push(['# handle .php', '']);
|
|
|
|
const loc = `location ~ ${domain.routing.legacyPhpRouting.computed ? '[^/]\\.php(/|$)' : '\\.php$'}`;
|
|
if (global.tools.modularizedStructure.computed) {
|
|
// Modularized
|
|
serverConfig.push([loc, { include: 'nginxconfig.io/php_fastcgi.conf' }]);
|
|
} else {
|
|
// Unified
|
|
serverConfig.push([loc, phpConf(domains, global)]);
|
|
}
|
|
}
|
|
|
|
// Additional config
|
|
if (global.tools.modularizedStructure.computed) {
|
|
// Modularized
|
|
serverConfig.push(['# additional config', '']);
|
|
serverConfig.push(['include', 'nginxconfig.io/general.conf']);
|
|
|
|
if (domain.php.wordPressRules.computed) serverConfig.push(['include', 'nginxconfig.io/wordpress.conf']);
|
|
if (domain.php.drupalRules.computed) serverConfig.push(['include', 'nginxconfig.io/drupal.conf']);
|
|
if (domain.php.magentoRules.computed) serverConfig.push(['include', 'nginxconfig.io/magento.conf']);
|
|
} else {
|
|
// Unified
|
|
serverConfig.push(...Object.entries(generalConf(domains, global)));
|
|
|
|
if (domain.php.wordPressRules.computed) serverConfig.push(...Object.entries(wordPressConf(global)));
|
|
if (domain.php.drupalRules.computed) serverConfig.push(...Object.entries(drupalConf(global)));
|
|
if (domain.php.magentoRules.computed) serverConfig.push(...Object.entries(magentoConf()));
|
|
}
|
|
|
|
// Add the server config to the parent config now its built
|
|
config.push(['server', serverConfig]);
|
|
|
|
// CDN!
|
|
if (domain.server.cdnSubdomain.computed) {
|
|
// Build the server config on its own before adding it to the parent config
|
|
const cdnConfig = [];
|
|
|
|
cdnConfig.push(...listenConfig(domain));
|
|
cdnConfig.push(['server_name', `cdn.${domain.server.domain.computed}`]);
|
|
cdnConfig.push(['root', `${domain.server.path.computed}${domain.server.documentRoot.computed}`]);
|
|
|
|
// HTTPS
|
|
cdnConfig.push(...sslConfig(domain, global));
|
|
|
|
cdnConfig.push(['# disable access_log', '']);
|
|
cdnConfig.push(['access_log', 'off']);
|
|
|
|
// Gzip
|
|
if (global.performance.gzipCompression.computed) {
|
|
cdnConfig.push(['# gzip', '']);
|
|
cdnConfig.push(['gzip', 'on']);
|
|
cdnConfig.push(['gzip_vary', 'on']);
|
|
cdnConfig.push(['gzip_proxied', 'any']);
|
|
cdnConfig.push(['gzip_comp_level', 6]);
|
|
cdnConfig.push(['gzip_types', gzipTypes]);
|
|
}
|
|
|
|
cdnConfig.push(['# allow safe files', '']);
|
|
cdnConfig.push([
|
|
`location ~* \\.(?:${extensions.assets}|${extensions.fonts}|${extensions.svg}|${extensions.images}|${extensions.audio}|${extensions.video}|${extensions.docs})$`,
|
|
[
|
|
['add_header', 'Access-Control-Allow-Origin "*"'],
|
|
['add_header', 'Cache-Control "public"'],
|
|
['expires', '30d'],
|
|
],
|
|
]);
|
|
|
|
cdnConfig.push(['# deny everything else', '']);
|
|
cdnConfig.push(['location /', { deny: 'all' }]);
|
|
|
|
// Add the CDN config to the parent config now its built
|
|
config.push(['# CDN', '']);
|
|
config.push(['server', cdnConfig]);
|
|
}
|
|
|
|
// Subdomains redirect
|
|
if (domain.server.redirectSubdomains.computed) {
|
|
// Build the server config on its own before adding it to the parent config
|
|
const redirectConfig = [];
|
|
|
|
redirectConfig.push(...listenConfig(domain));
|
|
redirectConfig.push(['server_name', `${domain.server.wwwSubdomain.computed ? '' : '*'}.${domain.server.domain.computed}`]);
|
|
|
|
// HTTPS
|
|
redirectConfig.push(...sslConfig(domain, global));
|
|
|
|
redirectConfig.push(['return', `301 http${domain.https.https.computed ? 's' : ''}://${domain.server.wwwSubdomain.computed ? 'www.' : ''}${domain.server.domain.computed}$request_uri`]);
|
|
|
|
// Add the redirect config to the parent config now its built
|
|
config.push([`# ${domain.server.wwwSubdomain.computed ? 'non-www, ' : ''}subdomains redirect`, '']);
|
|
config.push(['server', redirectConfig]);
|
|
}
|
|
|
|
// HTTP redirect
|
|
if (domain.https.forceHttps.computed) {
|
|
// Build the server config on its own before adding it to the parent config
|
|
const redirectConfig = [];
|
|
|
|
redirectConfig.push(...httpListen(domain));
|
|
|
|
if (domain.https.certType.computed === 'letsEncrypt') {
|
|
// Let's encrypt
|
|
|
|
if (global.tools.modularizedStructure.computed) {
|
|
// Modularized
|
|
redirectConfig.push(['include', 'nginxconfig.io/letsencrypt.conf']);
|
|
} else {
|
|
// Unified
|
|
redirectConfig.push(...Object.entries(letsEncryptConf(global)));
|
|
}
|
|
|
|
redirectConfig.push(['location /', {
|
|
return: `301 https://${domain.server.wwwSubdomain.computed ? 'www.' : ''}${domain.server.domain.computed}$request_uri`,
|
|
}]);
|
|
} else {
|
|
// Custom cert
|
|
redirectConfig.push(['return', `301 https://${domain.server.wwwSubdomain.computed ? 'www.' : ''}${domain.server.domain.computed}$request_uri`]);
|
|
}
|
|
|
|
// Add the redirect config to the parent config now its built
|
|
config.push(['# HTTP redirect', '']);
|
|
config.push(['server', redirectConfig]);
|
|
}
|
|
|
|
return config;
|
|
};
|