From c2486e9dc2ad3ee484b475093bd3bcede57d799b Mon Sep 17 00:00:00 2001 From: Franck Nijhof Date: Tue, 2 Feb 2021 19:53:01 +0100 Subject: [PATCH] Refactor NGINX configuration and API access (#22) --- thelounge/config.json | 6 +-- thelounge/rootfs/etc/cont-init.d/nginx.sh | 37 +++++-------------- .../rootfs/etc/nginx/includes/resolver.conf | 1 - thelounge/rootfs/etc/nginx/nginx.conf | 14 +------ .../rootfs/etc/nginx/servers/direct.disabled | 10 ----- .../rootfs/etc/nginx/servers/ingress.conf | 2 +- .../direct.gtpl} | 14 +++++-- 7 files changed, 22 insertions(+), 62 deletions(-) delete mode 100644 thelounge/rootfs/etc/nginx/includes/resolver.conf delete mode 100644 thelounge/rootfs/etc/nginx/servers/direct.disabled rename thelounge/rootfs/etc/nginx/{servers/direct-ssl.disabled => templates/direct.gtpl} (56%) diff --git a/thelounge/config.json b/thelounge/config.json index 6c159e9..cf5ff6d 100644 --- a/thelounge/config.json +++ b/thelounge/config.json @@ -5,11 +5,7 @@ "description": "A self-hosted web IRC client", "url": "https://github.com/hassio-addons/addon-thelounge", "arch": ["aarch64", "amd64", "armhf", "armv7", "i386"], - "hassio_api": true, - "homeassistant": "0.91.4", - "homeassistant_api": true, "ingress": true, - "ingress_port": 1337, "panel_icon": "mdi:chat", "ports": { "80/tcp": null @@ -17,7 +13,7 @@ "ports_description": { "80/tcp": "The Lounge Web UI (Not required for Ingress)" }, - "map": ["config:rw", "ssl"], + "map": ["ssl"], "options": { "ssl": true, "certfile": "fullchain.pem", diff --git a/thelounge/rootfs/etc/cont-init.d/nginx.sh b/thelounge/rootfs/etc/cont-init.d/nginx.sh index c96b90b..9159565 100644 --- a/thelounge/rootfs/etc/cont-init.d/nginx.sh +++ b/thelounge/rootfs/etc/cont-init.d/nginx.sh @@ -3,34 +3,15 @@ # Home Assistant Community Add-on: The Lounge # Configures NGINX for use with thelounge # ============================================================================== -declare port -declare certfile -declare dns_host -declare ingress_interface -declare ingress_port -declare keyfile -port=$(bashio::addon.port 80) -if bashio::var.has_value "${port}"; then +# Generate direct access configuration, if enabled. +if bashio::var.has_value "$(bashio::addon.port 80)"; then bashio::config.require.ssl - - if bashio::config.true 'ssl'; then - certfile=$(bashio::config 'certfile') - keyfile=$(bashio::config 'keyfile') - - mv /etc/nginx/servers/direct-ssl.disabled /etc/nginx/servers/direct.conf - sed -i "s#%%certfile%%#${certfile}#g" /etc/nginx/servers/direct.conf - sed -i "s#%%keyfile%%#${keyfile}#g" /etc/nginx/servers/direct.conf - - else - mv /etc/nginx/servers/direct.disabled /etc/nginx/servers/direct.conf - fi + bashio::var.json \ + certfile "$(bashio::config 'certfile')" \ + keyfile "$(bashio::config 'keyfile')" \ + ssl "^$(bashio::config 'ssl')" \ + | tempio \ + -template /etc/nginx/templates/direct.gtpl \ + -out /etc/nginx/servers/direct.conf fi - -ingress_port=$(bashio::addon.ingress_port) -ingress_interface=$(bashio::addon.ip_address) -sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf -sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf - -dns_host=$(bashio::dns.host) -sed -i "s/%%dns_host%%/${dns_host}/g" /etc/nginx/includes/resolver.conf diff --git a/thelounge/rootfs/etc/nginx/includes/resolver.conf b/thelounge/rootfs/etc/nginx/includes/resolver.conf deleted file mode 100644 index d864899..0000000 --- a/thelounge/rootfs/etc/nginx/includes/resolver.conf +++ /dev/null @@ -1 +0,0 @@ -resolver %%dns_host%%; diff --git a/thelounge/rootfs/etc/nginx/nginx.conf b/thelounge/rootfs/etc/nginx/nginx.conf index 338d70d..11e15c7 100644 --- a/thelounge/rootfs/etc/nginx/nginx.conf +++ b/thelounge/rootfs/etc/nginx/nginx.conf @@ -16,12 +16,6 @@ pcre_jit on; # Write error log to the add-on log. error_log /proc/1/fd/1 error; -# Load allowed environment vars -env SUPERVISOR_TOKEN; - -# Load dynamic modules. -include /etc/nginx/modules/*.conf; - # Max num of simultaneous connections by a worker process. events { worker_connections 512; @@ -30,11 +24,7 @@ events { http { include /etc/nginx/includes/mime.types; - log_format homeassistant '[$time_local] $status ' - '$http_x_forwarded_for($remote_addr) ' - '$request ($http_user_agent)'; - - access_log /proc/1/fd/1 homeassistant; + access_log off; client_max_body_size 4G; default_type application/octet-stream; gzip on; @@ -49,8 +39,6 @@ http { '' close; } - include /etc/nginx/includes/resolver.conf; include /etc/nginx/includes/upstream.conf; - include /etc/nginx/servers/*.conf; } diff --git a/thelounge/rootfs/etc/nginx/servers/direct.disabled b/thelounge/rootfs/etc/nginx/servers/direct.disabled deleted file mode 100644 index db08519..0000000 --- a/thelounge/rootfs/etc/nginx/servers/direct.disabled +++ /dev/null @@ -1,10 +0,0 @@ -server { - listen 80 default_server; - - include /etc/nginx/includes/server_params.conf; - include /etc/nginx/includes/proxy_params.conf; - - location / { - proxy_pass http://backend; - } -} diff --git a/thelounge/rootfs/etc/nginx/servers/ingress.conf b/thelounge/rootfs/etc/nginx/servers/ingress.conf index d655706..a07470c 100644 --- a/thelounge/rootfs/etc/nginx/servers/ingress.conf +++ b/thelounge/rootfs/etc/nginx/servers/ingress.conf @@ -1,5 +1,5 @@ server { - listen %%interface%%:%%port%% default_server; + listen 8099 default_server; include /etc/nginx/includes/server_params.conf; include /etc/nginx/includes/proxy_params.conf; diff --git a/thelounge/rootfs/etc/nginx/servers/direct-ssl.disabled b/thelounge/rootfs/etc/nginx/templates/direct.gtpl similarity index 56% rename from thelounge/rootfs/etc/nginx/servers/direct-ssl.disabled rename to thelounge/rootfs/etc/nginx/templates/direct.gtpl index ccae456..944260c 100644 --- a/thelounge/rootfs/etc/nginx/servers/direct-ssl.disabled +++ b/thelounge/rootfs/etc/nginx/templates/direct.gtpl @@ -1,13 +1,19 @@ server { + {{ if not .ssl }} + listen 80 default_server; + {{ else }} listen 80 default_server ssl http2; + {{ end }} include /etc/nginx/includes/server_params.conf; - include /etc/nginx/includes/ssl_params.conf; include /etc/nginx/includes/proxy_params.conf; - ssl on; - ssl_certificate /ssl/%%certfile%%; - ssl_certificate_key /ssl/%%keyfile%%; + {{ if .ssl }} + include /etc/nginx/includes/ssl_params.conf; + + ssl_certificate /ssl/{{ .certfile }}; + ssl_certificate_key /ssl/{{ .keyfile }}; + {{ end }} location / { proxy_pass http://backend;