From be449204a896698d9ba6f4acc3ba9bfb428061ab Mon Sep 17 00:00:00 2001 From: Franck Nijhof Date: Sun, 24 Jan 2021 20:27:52 +0100 Subject: [PATCH] Refactor NGINX configuration --- traccar/config.json | 1 - traccar/rootfs/etc/cont-init.d/nginx.sh | 48 +++++++------------ .../rootfs/etc/nginx/includes/resolver.conf | 1 - traccar/rootfs/etc/nginx/nginx.conf | 9 ---- traccar/rootfs/etc/nginx/servers/.gitkeep | 1 + .../etc/nginx/servers/direct-ssl.disabled | 14 ------ .../rootfs/etc/nginx/servers/direct.disabled | 10 ---- .../rootfs/etc/nginx/templates/direct.gtpl | 21 ++++++++ .../ingress.conf => templates/ingress.gtpl} | 5 +- 9 files changed, 44 insertions(+), 66 deletions(-) delete mode 100644 traccar/rootfs/etc/nginx/includes/resolver.conf create mode 100644 traccar/rootfs/etc/nginx/servers/.gitkeep delete mode 100644 traccar/rootfs/etc/nginx/servers/direct-ssl.disabled delete mode 100644 traccar/rootfs/etc/nginx/servers/direct.disabled create mode 100644 traccar/rootfs/etc/nginx/templates/direct.gtpl rename traccar/rootfs/etc/nginx/{servers/ingress.conf => templates/ingress.gtpl} (69%) diff --git a/traccar/config.json b/traccar/config.json index 82fa262..2d18625 100755 --- a/traccar/config.json +++ b/traccar/config.json @@ -11,7 +11,6 @@ "startup": "services", "arch": ["aarch64", "amd64", "armhf", "armv7", "i386"], "init": false, - "hassio_api": true, "host_network": true, "ports": { "80/tcp": null diff --git a/traccar/rootfs/etc/cont-init.d/nginx.sh b/traccar/rootfs/etc/cont-init.d/nginx.sh index bfdd27c..43aaec8 100644 --- a/traccar/rootfs/etc/cont-init.d/nginx.sh +++ b/traccar/rootfs/etc/cont-init.d/nginx.sh @@ -3,36 +3,24 @@ # Home Assistant Community Add-on: Traccar # Configures NGINX for use with the Traccar server # ============================================================================== -declare port -declare certfile -declare dns_host -declare ingress_interface -declare ingress_port -declare keyfile -port=$(bashio::addon.port 80) -if bashio::var.has_value "${port}"; then - bashio::config.require.ssl - - if bashio::config.true 'ssl'; then - certfile=$(bashio::config 'certfile') - keyfile=$(bashio::config 'keyfile') - - mv /etc/nginx/servers/direct-ssl.disabled /etc/nginx/servers/direct.conf - sed -i "s#%%certfile%%#${certfile}#g" /etc/nginx/servers/direct.conf - sed -i "s#%%keyfile%%#${keyfile}#g" /etc/nginx/servers/direct.conf - - else - mv /etc/nginx/servers/direct.disabled /etc/nginx/servers/direct.conf - fi +# Generate Ingress configuration +bashio::var.json \ + interface "$(bashio::addon.ip_address)" \ + port "$(bashio::addon.ingress_port)" \ + | tempio \ + -template /etc/nginx/templates/ingress.gtpl \ + -out /etc/nginx/servers/ingress.conf - sed -i "s/%%port%%/${port}/g" /etc/nginx/servers/direct.conf +# Generate direct access configuration, if enabled. +if bashio::var.has_value "$(bashio::addon.port 80)"; then + bashio::config.require.ssl + bashio::var.json \ + certfile "$(bashio::config 'certfile')" \ + keyfile "$(bashio::config 'keyfile')" \ + port "^$(bashio::addon.port 80)" \ + ssl "^$(bashio::config 'ssl')" \ + | tempio \ + -template /etc/nginx/templates/direct.gtpl \ + -out /etc/nginx/servers/direct.conf fi - -ingress_port=$(bashio::addon.ingress_port) -ingress_interface=$(bashio::addon.ip_address) -sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf -sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf - -dns_host=$(bashio::dns.host) -sed -i "s/%%dns_host%%/${dns_host}/g" /etc/nginx/includes/resolver.conf diff --git a/traccar/rootfs/etc/nginx/includes/resolver.conf b/traccar/rootfs/etc/nginx/includes/resolver.conf deleted file mode 100644 index d864899..0000000 --- a/traccar/rootfs/etc/nginx/includes/resolver.conf +++ /dev/null @@ -1 +0,0 @@ -resolver %%dns_host%%; diff --git a/traccar/rootfs/etc/nginx/nginx.conf b/traccar/rootfs/etc/nginx/nginx.conf index 7ae5c82..22f1331 100644 --- a/traccar/rootfs/etc/nginx/nginx.conf +++ b/traccar/rootfs/etc/nginx/nginx.conf @@ -16,13 +16,6 @@ pcre_jit on; # Write error log to the add-on log. error_log /proc/1/fd/1 error; -# Load allowed environment vars -env SUPERVISOR_TOKEN; -env DISABLE_HA_AUTHENTICATION; - -# Load dynamic modules. -include /etc/nginx/modules/*.conf; - # Max num of simultaneous connections by a worker process. events { worker_connections 512; @@ -50,8 +43,6 @@ http { '' close; } - include /etc/nginx/includes/resolver.conf; include /etc/nginx/includes/upstream.conf; - include /etc/nginx/servers/*.conf; } diff --git a/traccar/rootfs/etc/nginx/servers/.gitkeep b/traccar/rootfs/etc/nginx/servers/.gitkeep new file mode 100644 index 0000000..85ad51b --- /dev/null +++ b/traccar/rootfs/etc/nginx/servers/.gitkeep @@ -0,0 +1 @@ +Without requirements or design, programming is the art of adding bugs to an empty text file. (Louis Srygley) diff --git a/traccar/rootfs/etc/nginx/servers/direct-ssl.disabled b/traccar/rootfs/etc/nginx/servers/direct-ssl.disabled deleted file mode 100644 index 44b3c4e..0000000 --- a/traccar/rootfs/etc/nginx/servers/direct-ssl.disabled +++ /dev/null @@ -1,14 +0,0 @@ -server { - listen %%port%% default_server ssl http2; - - include /etc/nginx/includes/server_params.conf; - include /etc/nginx/includes/ssl_params.conf; - include /etc/nginx/includes/proxy_params.conf; - - ssl_certificate /ssl/%%certfile%%; - ssl_certificate_key /ssl/%%keyfile%%; - - location / { - proxy_pass http://backend; - } -} diff --git a/traccar/rootfs/etc/nginx/servers/direct.disabled b/traccar/rootfs/etc/nginx/servers/direct.disabled deleted file mode 100644 index 43a3175..0000000 --- a/traccar/rootfs/etc/nginx/servers/direct.disabled +++ /dev/null @@ -1,10 +0,0 @@ -server { - listen %%port%% default_server; - - include /etc/nginx/includes/server_params.conf; - include /etc/nginx/includes/proxy_params.conf; - - location / { - proxy_pass http://backend; - } -} diff --git a/traccar/rootfs/etc/nginx/templates/direct.gtpl b/traccar/rootfs/etc/nginx/templates/direct.gtpl new file mode 100644 index 0000000..b9f8b11 --- /dev/null +++ b/traccar/rootfs/etc/nginx/templates/direct.gtpl @@ -0,0 +1,21 @@ +server { + {{ if not .ssl }} + listen {{ .port }} default_server; + {{ else }} + listen {{ .port }} default_server ssl http2; + {{ end }} + + include /etc/nginx/includes/server_params.conf; + include /etc/nginx/includes/proxy_params.conf; + + {{ if .ssl }} + include /etc/nginx/includes/ssl_params.conf; + + ssl_certificate /ssl/{{ .certfile }}; + ssl_certificate_key /ssl/{{ .keyfile }}; + {{ end }} + + location / { + proxy_pass http://backend; + } +} diff --git a/traccar/rootfs/etc/nginx/servers/ingress.conf b/traccar/rootfs/etc/nginx/templates/ingress.gtpl similarity index 69% rename from traccar/rootfs/etc/nginx/servers/ingress.conf rename to traccar/rootfs/etc/nginx/templates/ingress.gtpl index d655706..c630406 100644 --- a/traccar/rootfs/etc/nginx/servers/ingress.conf +++ b/traccar/rootfs/etc/nginx/templates/ingress.gtpl @@ -1,9 +1,12 @@ server { - listen %%interface%%:%%port%% default_server; + listen {{ .interface }}:{{ . port }} default_server; include /etc/nginx/includes/server_params.conf; include /etc/nginx/includes/proxy_params.conf; + allow 172.30.32.2; + deny all; + location / { allow 172.30.32.2; deny all;