From 73ebb43c37cb0d4846c56d955838be79a54cdefe Mon Sep 17 00:00:00 2001 From: Franck Nijhof Date: Sun, 24 Jan 2021 17:40:37 +0100 Subject: [PATCH] Refactor NGINX configuration (#158) --- motioneye/config.json | 1 - motioneye/rootfs/etc/cont-init.d/nginx.sh | 48 +++++++------------ .../rootfs/etc/nginx/includes/resolver.conf | 1 - motioneye/rootfs/etc/nginx/nginx.conf | 9 ---- motioneye/rootfs/etc/nginx/servers/.gitkeep | 1 + .../etc/nginx/servers/direct-ssl.disabled | 14 ------ .../rootfs/etc/nginx/servers/direct.disabled | 10 ---- .../rootfs/etc/nginx/templates/direct.gtpl | 21 ++++++++ .../ingress.conf => templates/ingress.gtpl} | 2 +- motioneye/rootfs/etc/services.d/nginx/run | 6 --- 10 files changed, 41 insertions(+), 72 deletions(-) delete mode 100644 motioneye/rootfs/etc/nginx/includes/resolver.conf create mode 100644 motioneye/rootfs/etc/nginx/servers/.gitkeep delete mode 100644 motioneye/rootfs/etc/nginx/servers/direct-ssl.disabled delete mode 100644 motioneye/rootfs/etc/nginx/servers/direct.disabled create mode 100644 motioneye/rootfs/etc/nginx/templates/direct.gtpl rename motioneye/rootfs/etc/nginx/{servers/ingress.conf => templates/ingress.gtpl} (80%) diff --git a/motioneye/config.json b/motioneye/config.json index 54988fa..2cd589f 100755 --- a/motioneye/config.json +++ b/motioneye/config.json @@ -17,7 +17,6 @@ "ports_description": { "80/tcp": "Web interface (Not required for Ingress)" }, - "hassio_api": true, "host_network": true, "apparmor": false, "video": true, diff --git a/motioneye/rootfs/etc/cont-init.d/nginx.sh b/motioneye/rootfs/etc/cont-init.d/nginx.sh index 895ca04..9d8a22d 100644 --- a/motioneye/rootfs/etc/cont-init.d/nginx.sh +++ b/motioneye/rootfs/etc/cont-init.d/nginx.sh @@ -3,36 +3,24 @@ # Home Assistant Community Add-on: motionEye # Configures NGINX for use with motionEye # ============================================================================== -declare port -declare certfile -declare dns_host -declare ingress_interface -declare ingress_port -declare keyfile -port=$(bashio::addon.port 80) -if bashio::var.has_value "${port}"; then +# Generate Ingress configuration +bashio::var.json \ + interface "$(bashio::addon.ip_address)" \ + port "^$(bashio::addon.ingress_port)" \ + | tempio \ + -template /etc/nginx/templates/ingress.gtpl \ + -out /etc/nginx/servers/ingress.conf + +# Generate direct access configuration, if enabled. +if bashio::var.has_value "$(bashio::addon.port 80)"; then bashio::config.require.ssl - - if bashio::config.true 'ssl'; then - certfile=$(bashio::config 'certfile') - keyfile=$(bashio::config 'keyfile') - - mv /etc/nginx/servers/direct-ssl.disabled /etc/nginx/servers/direct.conf - sed -i "s#%%certfile%%#${certfile}#g" /etc/nginx/servers/direct.conf - sed -i "s#%%keyfile%%#${keyfile}#g" /etc/nginx/servers/direct.conf - - else - mv /etc/nginx/servers/direct.disabled /etc/nginx/servers/direct.conf - fi - - sed -i "s/%%port%%/${port}/g" /etc/nginx/servers/direct.conf + bashio::var.json \ + certfile "$(bashio::config 'certfile')" \ + keyfile "$(bashio::config 'keyfile')" \ + port "^$(bashio::addon.port 80)" \ + ssl "^$(bashio::config 'ssl')" \ + | tempio \ + -template /etc/nginx/templates/direct.gtpl \ + -out /etc/nginx/servers/direct.conf fi - -ingress_port=$(bashio::addon.ingress_port) -ingress_interface=$(bashio::addon.ip_address) -sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf -sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf - -dns_host=$(bashio::dns.host) -sed -i "s/%%dns_host%%/${dns_host}/g" /etc/nginx/includes/resolver.conf diff --git a/motioneye/rootfs/etc/nginx/includes/resolver.conf b/motioneye/rootfs/etc/nginx/includes/resolver.conf deleted file mode 100644 index d864899..0000000 --- a/motioneye/rootfs/etc/nginx/includes/resolver.conf +++ /dev/null @@ -1 +0,0 @@ -resolver %%dns_host%%; diff --git a/motioneye/rootfs/etc/nginx/nginx.conf b/motioneye/rootfs/etc/nginx/nginx.conf index 7ae5c82..22f1331 100644 --- a/motioneye/rootfs/etc/nginx/nginx.conf +++ b/motioneye/rootfs/etc/nginx/nginx.conf @@ -16,13 +16,6 @@ pcre_jit on; # Write error log to the add-on log. error_log /proc/1/fd/1 error; -# Load allowed environment vars -env SUPERVISOR_TOKEN; -env DISABLE_HA_AUTHENTICATION; - -# Load dynamic modules. -include /etc/nginx/modules/*.conf; - # Max num of simultaneous connections by a worker process. events { worker_connections 512; @@ -50,8 +43,6 @@ http { '' close; } - include /etc/nginx/includes/resolver.conf; include /etc/nginx/includes/upstream.conf; - include /etc/nginx/servers/*.conf; } diff --git a/motioneye/rootfs/etc/nginx/servers/.gitkeep b/motioneye/rootfs/etc/nginx/servers/.gitkeep new file mode 100644 index 0000000..85ad51b --- /dev/null +++ b/motioneye/rootfs/etc/nginx/servers/.gitkeep @@ -0,0 +1 @@ +Without requirements or design, programming is the art of adding bugs to an empty text file. (Louis Srygley) diff --git a/motioneye/rootfs/etc/nginx/servers/direct-ssl.disabled b/motioneye/rootfs/etc/nginx/servers/direct-ssl.disabled deleted file mode 100644 index 44b3c4e..0000000 --- a/motioneye/rootfs/etc/nginx/servers/direct-ssl.disabled +++ /dev/null @@ -1,14 +0,0 @@ -server { - listen %%port%% default_server ssl http2; - - include /etc/nginx/includes/server_params.conf; - include /etc/nginx/includes/ssl_params.conf; - include /etc/nginx/includes/proxy_params.conf; - - ssl_certificate /ssl/%%certfile%%; - ssl_certificate_key /ssl/%%keyfile%%; - - location / { - proxy_pass http://backend; - } -} diff --git a/motioneye/rootfs/etc/nginx/servers/direct.disabled b/motioneye/rootfs/etc/nginx/servers/direct.disabled deleted file mode 100644 index 43a3175..0000000 --- a/motioneye/rootfs/etc/nginx/servers/direct.disabled +++ /dev/null @@ -1,10 +0,0 @@ -server { - listen %%port%% default_server; - - include /etc/nginx/includes/server_params.conf; - include /etc/nginx/includes/proxy_params.conf; - - location / { - proxy_pass http://backend; - } -} diff --git a/motioneye/rootfs/etc/nginx/templates/direct.gtpl b/motioneye/rootfs/etc/nginx/templates/direct.gtpl new file mode 100644 index 0000000..b9f8b11 --- /dev/null +++ b/motioneye/rootfs/etc/nginx/templates/direct.gtpl @@ -0,0 +1,21 @@ +server { + {{ if not .ssl }} + listen {{ .port }} default_server; + {{ else }} + listen {{ .port }} default_server ssl http2; + {{ end }} + + include /etc/nginx/includes/server_params.conf; + include /etc/nginx/includes/proxy_params.conf; + + {{ if .ssl }} + include /etc/nginx/includes/ssl_params.conf; + + ssl_certificate /ssl/{{ .certfile }}; + ssl_certificate_key /ssl/{{ .keyfile }}; + {{ end }} + + location / { + proxy_pass http://backend; + } +} diff --git a/motioneye/rootfs/etc/nginx/servers/ingress.conf b/motioneye/rootfs/etc/nginx/templates/ingress.gtpl similarity index 80% rename from motioneye/rootfs/etc/nginx/servers/ingress.conf rename to motioneye/rootfs/etc/nginx/templates/ingress.gtpl index d655706..e216772 100644 --- a/motioneye/rootfs/etc/nginx/servers/ingress.conf +++ b/motioneye/rootfs/etc/nginx/templates/ingress.gtpl @@ -1,5 +1,5 @@ server { - listen %%interface%%:%%port%% default_server; + listen {{ .interface }}:{{ .port }} default_server; include /etc/nginx/includes/server_params.conf; include /etc/nginx/includes/proxy_params.conf; diff --git a/motioneye/rootfs/etc/services.d/nginx/run b/motioneye/rootfs/etc/services.d/nginx/run index 59551cb..29e43e4 100644 --- a/motioneye/rootfs/etc/services.d/nginx/run +++ b/motioneye/rootfs/etc/services.d/nginx/run @@ -8,10 +8,4 @@ bashio::net.wait_for 28765 bashio::log.info "Starting NGinx..." - -# Disable HA Authentication if front door is open -if bashio::config.true 'leave_front_door_open'; then - export DISABLE_HA_AUTHENTICATION=true -fi - exec nginx