thib8956/nginx-proxy
1
0
Fork 0
mirror of https://github.com/thib8956/nginx-proxy synced 2025-02-24 09:48:14 +00:00
Code Issues Releases Wiki Activity

chore: Move global variables to a $globals dict

Browse Source 
Planned future changes will introduce more embedded templates, and the ability
to pass the globals to the templates will be useful.
This commit is contained in:
Richard Hansen 2023-01-14 22:59:33 -05:00
parent 1b253cd908
commit 2427b383b5
1 changed files with 60 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
nginx.tmpl
View File

@ -1,12 +1,24 @@
{{- $CurrentContainer := where $ "ID" .Docker.CurrentContainerID | first }} {{- /*
* Global values. Values are stored in this map rather than in individual
{{- $nginx_proxy_version := coalesce $.Env.NGINX_PROXY_VERSION "" }} * global variables so that the values can be easily passed to embedded
{{- $external_http_port := coalesce $.Env.HTTP_PORT "80" }} * templates. (Go templates cannot access variables outside of their own
{{- $external_https_port := coalesce $.Env.HTTPS_PORT "443" }} * scope.)
{{- $debug_all := $.Env.DEBUG }} */}}
{{- $sha1_upstream_name := parseBool (coalesce $.Env.SHA1_UPSTREAM_NAME "false") }} {{- $globals := dict }}
{{- $default_root_response := coalesce $.Env.DEFAULT_ROOT "404" }} {{- $_ := set $globals "containers" $ }}
{{- $trust_downstream_proxy := parseBool (coalesce $.Env.TRUST_DOWNSTREAM_PROXY "true") }} {{- $_ := set $globals "Env" $.Env }}
{{- $_ := set $globals "Docker" $.Docker }}
{{- $_ := set $globals "CurrentContainer" (where $globals.containers "ID" $globals.Docker.CurrentContainerID | first) }}
{{- $_ := set $globals "nginx_proxy_version" (coalesce $globals.Env.NGINX_PROXY_VERSION "") }}
{{- $_ := set $globals "external_http_port" (coalesce $globals.Env.HTTP_PORT "80") }}
{{- $_ := set $globals "external_https_port" (coalesce $globals.Env.HTTPS_PORT "443") }}
{{- $_ := set $globals "debug_all" $globals.Env.DEBUG }}
{{- $_ := set $globals "sha1_upstream_name" (parseBool (coalesce $globals.Env.SHA1_UPSTREAM_NAME "false")) }}
{{- $_ := set $globals "default_root_response" (coalesce $globals.Env.DEFAULT_ROOT "404") }}
{{- $_ := set $globals "trust_downstream_proxy" (parseBool (coalesce $globals.Env.TRUST_DOWNSTREAM_PROXY "true")) }}
{{- $_ := set $globals "access_log" (or (and (not $globals.Env.DISABLE_ACCESS_LOGS) "access_log /var/log/nginx/access.log vhost;") "") }}
{{- $_ := set $globals "enable_ipv6" (parseBool (coalesce $globals.Env.ENABLE_IPV6 "false")) }}
{{- $_ := set $globals "ssl_policy" (or ($globals.Env.SSL_POLICY) "Mozilla-Intermediate") }}
{{- define "ssl_policy" }} {{- define "ssl_policy" }}
{{- if eq .ssl_policy "Mozilla-Modern" }} {{- if eq .ssl_policy "Mozilla-Modern" }}
@ -157,26 +169,26 @@ upstream {{ .Upstream }} {
} }
{{- end }} {{- end }}
{{- if ne $nginx_proxy_version "" }} {{- if ne $globals.nginx_proxy_version "" }}
# nginx-proxy version : {{ $nginx_proxy_version }} # nginx-proxy version : {{ $globals.nginx_proxy_version }}
{{- end }} {{- end }}
# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the # If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server # scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto { map $http_x_forwarded_proto $proxy_x_forwarded_proto {
default {{ if $trust_downstream_proxy }}$http_x_forwarded_proto{{ else }}$scheme{{ end }}; default {{ if $globals.trust_downstream_proxy }}$http_x_forwarded_proto{{ else }}$scheme{{ end }};
'' $scheme; '' $scheme;
} }
map $http_x_forwarded_host $proxy_x_forwarded_host { map $http_x_forwarded_host $proxy_x_forwarded_host {
default {{ if $trust_downstream_proxy }}$http_x_forwarded_host{{ else }}$http_host{{ end }}; default {{ if $globals.trust_downstream_proxy }}$http_x_forwarded_host{{ else }}$http_host{{ end }};
'' $http_host; '' $http_host;
} }
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the # If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to # server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port { map $http_x_forwarded_port $proxy_x_forwarded_port {
default {{ if $trust_downstream_proxy }}$http_x_forwarded_port{{ else }}$server_port{{ end }}; default {{ if $globals.trust_downstream_proxy }}$http_x_forwarded_port{{ else }}$server_port{{ end }};
'' $server_port; '' $server_port;
} }
@ -210,16 +222,11 @@ log_format vhost '$host $remote_addr - $remote_user [$time_local] '
access_log off; access_log off;
{{- /* {{- template "ssl_policy" (dict "ssl_policy" $globals.ssl_policy) }}
* Get the SSL_POLICY defined by this container, falling back to
* "Mozilla-Intermediate".
*/}}
{{- $ssl_policy := or ($.Env.SSL_POLICY) "Mozilla-Intermediate" }}
{{- template "ssl_policy" (dict "ssl_policy" $ssl_policy) }}
error_log /dev/stderr; error_log /dev/stderr;
{{- if $.Env.RESOLVERS }} {{- if $globals.Env.RESOLVERS }}
resolver {{ $.Env.RESOLVERS }}; resolver {{ $globals.Env.RESOLVERS }};
{{- end }} {{- end }}
{{- if (exists "/etc/nginx/proxy.conf") }} {{- if (exists "/etc/nginx/proxy.conf") }}
@ -243,23 +250,20 @@ proxy_set_header X-Original-URI $request_uri;
proxy_set_header Proxy ""; proxy_set_header Proxy "";
{{- end }} {{- end }}
{{- $access_log := (or (and (not $.Env.DISABLE_ACCESS_LOGS) "access_log /var/log/nginx/access.log vhost;") "") }}
{{- $enable_ipv6 := parseBool (coalesce $.Env.ENABLE_IPV6 "false") }}
server { server {
server_name _; # This is just an invalid value which will never trigger on a real hostname. server_name _; # This is just an invalid value which will never trigger on a real hostname.
server_tokens off; server_tokens off;
listen {{ $external_http_port }}; listen {{ $globals.external_http_port }};
{{- if $enable_ipv6 }} {{- if $globals.enable_ipv6 }}
listen [::]:{{ $external_http_port }}; listen [::]:{{ $globals.external_http_port }};
{{- end }} {{- end }}
{{ $access_log }} {{ $globals.access_log }}
return 503; return 503;
{{- if (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }} {{- if (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
listen {{ $external_https_port }} ssl http2; listen {{ $globals.external_https_port }} ssl http2;
{{- if $enable_ipv6 }} {{- if $globals.enable_ipv6 }}
listen [::]:{{ $external_https_port }} ssl http2; listen [::]:{{ $globals.external_https_port }} ssl http2;
{{- end }} {{- end }}
ssl_session_cache shared:SSL:50m; ssl_session_cache shared:SSL:50m;
@ -269,11 +273,11 @@ server {
{{- end }} {{- end }}
} }
{{- range $host, $containers := groupByMulti $ "Env.VIRTUAL_HOST" "," }} {{- range $host, $containers := groupByMulti $globals.containers "Env.VIRTUAL_HOST" "," }}
{{- $host := trim $host }} {{- $host := trim $host }}
{{- $is_regexp := hasPrefix "~" $host }} {{- $is_regexp := hasPrefix "~" $host }}
{{- $upstream_name := when (or $is_regexp $sha1_upstream_name) (sha1 $host) $host }} {{- $upstream_name := when (or $is_regexp $globals.sha1_upstream_name) (sha1 $host) $host }}
{{- $paths := groupBy $containers "Env.VIRTUAL_PATH" }} {{- $paths := groupBy $containers "Env.VIRTUAL_PATH" }}
{{- $nPaths := len $paths }} {{- $nPaths := len $paths }}
@ -288,10 +292,10 @@ server {
{{- $upstream = printf "%s-%s" $upstream $sum }} {{- $upstream = printf "%s-%s" $upstream $sum }}
{{- end }} {{- end }}
# {{ $host }}{{ $path }} # {{ $host }}{{ $path }}
{{ template "upstream" (dict "Upstream" $upstream "Containers" $containers "Networks" $CurrentContainer.Networks "Debug" $debug_all) }} {{ template "upstream" (dict "Upstream" $upstream "Containers" $containers "Networks" $globals.CurrentContainer.Networks "Debug" $globals.debug_all) }}
{{- end }} {{- end }}
{{- $default_host := or ($.Env.DEFAULT_HOST) "" }} {{- $default_host := or ($globals.Env.DEFAULT_HOST) "" }}
{{- $default_server := index (dict $host "" $default_host "default_server") $host }} {{- $default_server := index (dict $host "" $default_host "default_server") $host }}
{{- /* {{- /*
@ -305,7 +309,7 @@ server {
* Get the HTTPS_METHOD defined by containers w/ the same vhost, falling * Get the HTTPS_METHOD defined by containers w/ the same vhost, falling
* back to "redirect". * back to "redirect".
*/}} */}}
{{- $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) (or $.Env.HTTPS_METHOD "redirect") }} {{- $https_method := or (first (groupByKeys $containers "Env.HTTPS_METHOD")) (or $globals.Env.HTTPS_METHOD "redirect") }}
{{- /* {{- /*
* Get the SSL_POLICY defined by containers w/ the same vhost, falling * Get the SSL_POLICY defined by containers w/ the same vhost, falling
@ -317,7 +321,7 @@ server {
* Get the HSTS defined by containers w/ the same vhost, falling back to * Get the HSTS defined by containers w/ the same vhost, falling back to
* "max-age=31536000". * "max-age=31536000".
*/}} */}}
{{- $hsts := or (first (groupByKeys $containers "Env.HSTS")) (or $.Env.HSTS "max-age=31536000") }} {{- $hsts := or (first (groupByKeys $containers "Env.HSTS")) (or $globals.Env.HSTS "max-age=31536000") }}
{{- /* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}} {{- /* Get the VIRTUAL_ROOT By containers w/ use fastcgi root */}}
{{- $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }} {{- $vhost_root := or (first (groupByKeys $containers "Env.VIRTUAL_ROOT")) "/var/www/public" }}
@ -350,11 +354,11 @@ server {
{{- if $server_tokens }} {{- if $server_tokens }}
server_tokens {{ $server_tokens }}; server_tokens {{ $server_tokens }};
{{- end }} {{- end }}
listen {{ $external_http_port }} {{ $default_server }}; listen {{ $globals.external_http_port }} {{ $default_server }};
{{- if $enable_ipv6 }} {{- if $globals.enable_ipv6 }}
listen [::]:{{ $external_http_port }} {{ $default_server }}; listen [::]:{{ $globals.external_http_port }} {{ $default_server }};
{{- end }} {{- end }}
{{ $access_log }} {{ $globals.access_log }}
# Do not HTTPS redirect Let's Encrypt ACME challenge # Do not HTTPS redirect Let's Encrypt ACME challenge
location ^~ /.well-known/acme-challenge/ { location ^~ /.well-known/acme-challenge/ {
@ -367,10 +371,10 @@ server {
} }
location / { location / {
{{- if eq $external_https_port "443" }} {{- if eq $globals.external_https_port "443" }}
return 301 https://$host$request_uri; return 301 https://$host$request_uri;
{{- else }} {{- else }}
return 301 https://$host:{{ $external_https_port }}$request_uri; return 301 https://$host:{{ $globals.external_https_port }}$request_uri;
{{- end }} {{- end }}
} }
} }
@ -381,17 +385,17 @@ server {
{{- if $server_tokens }} {{- if $server_tokens }}
server_tokens {{ $server_tokens }}; server_tokens {{ $server_tokens }};
{{- end }} {{- end }}
{{ $access_log }} {{ $globals.access_log }}
{{- if or (not $is_https) (eq $https_method "noredirect") }} {{- if or (not $is_https) (eq $https_method "noredirect") }}
listen {{ $external_http_port }} {{ $default_server }}; listen {{ $globals.external_http_port }} {{ $default_server }};
{{- if $enable_ipv6 }} {{- if $globals.enable_ipv6 }}
listen [::]:{{ $external_http_port }} {{ $default_server }}; listen [::]:{{ $globals.external_http_port }} {{ $default_server }};
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if $is_https }} {{- if $is_https }}
listen {{ $external_https_port }} ssl http2 {{ $default_server }}; listen {{ $globals.external_https_port }} ssl http2 {{ $default_server }};
{{- if $enable_ipv6 }} {{- if $globals.enable_ipv6 }}
listen [::]:{{ $external_https_port }} ssl http2 {{ $default_server }}; listen [::]:{{ $globals.external_https_port }} ssl http2 {{ $default_server }};
{{- end }} {{- end }}
{{- template "ssl_policy" (dict "ssl_policy" $ssl_policy) }} {{- template "ssl_policy" (dict "ssl_policy" $ssl_policy) }}
@ -451,7 +455,7 @@ server {
{{- end }} {{- end }}
{{- if (not (contains $paths "/")) }} {{- if (not (contains $paths "/")) }}
location / { location / {
return {{ $default_root_response }}; return {{ $globals.default_root_response }};
} }
{{- end }} {{- end }}
} }
@ -462,11 +466,11 @@ server {
{{- if $server_tokens }} {{- if $server_tokens }}
server_tokens {{ $server_tokens }}; server_tokens {{ $server_tokens }};
{{- end }} {{- end }}
listen {{ $external_https_port }} ssl http2 {{ $default_server }}; listen {{ $globals.external_https_port }} ssl http2 {{ $default_server }};
{{- if $enable_ipv6 }} {{- if $globals.enable_ipv6 }}
listen [::]:{{ $external_https_port }} ssl http2 {{ $default_server }}; listen [::]:{{ $globals.external_https_port }} ssl http2 {{ $default_server }};
{{- end }} {{- end }}
{{ $access_log }} {{ $globals.access_log }}
return 500; return 500;
ssl_certificate /etc/nginx/certs/default.crt; ssl_certificate /etc/nginx/certs/default.crt;