nginx.conf

# Copyright (c) 2025 Battelle Energy Alliance, LLC.  All rights reserved.

daemon off;

worker_processes 1;

events { worker_connections 1024; }

http {

  include /etc/nginx/conf.d/*.conf;
  include /etc/nginx/mime.types;
  sendfile on;

  client_max_body_size 20m;
  client_body_buffer_size 128k;
  client_header_buffer_size 256k;
  large_client_header_buffers 8 256k;

  fastcgi_buffers 16 64k;
  fastcgi_buffer_size 256k;
  fastcgi_read_timeout 300s;
  fastcgi_busy_buffers_size 384k;
  fastcgi_request_buffering off;

  proxy_connect_timeout 180s;
  proxy_read_timeout 300s;
  proxy_send_timeout 300s;
  proxy_buffer_size 512k;
  proxy_buffers 16 4m;
  proxy_busy_buffers_size 16m;

  # if LDAP authentication is enabled, this will configure the ldap_server section
  include /etc/nginx/nginx_ldap_rt.conf;

  upstream arkime {
    server arkime:8005;
  }

  upstream api {
    server api:5000;
  }

  upstream upload {
    server upload:80;
  }

  upstream htadmin {
    server htadmin:80;
  }

  upstream dashboards {
    server dashboards:5601;
  }

  upstream dashboards-maps {
    server dashboards-helper:28991;
  }

  upstream opensearch {
    server opensearch:9200;
  }

  upstream logstash-stats {
    server logstash:9600;
  }

  upstream netbox {
    server netbox:8080;
  }

  upstream extracted-file-http-server {
    server file-monitor:8440;
  }

  # health check ("here I am") without authentication
  server {
    listen 8443;
    include /etc/nginx/nginx_ssl_config.conf;

    location / {
      add_header Content-Type text/plain;
      return 200 'Malcolm\n';
    }
  }

  # Main web interface
  server {
    listen 443;
    include /etc/nginx/nginx_ssl_config.conf;

    # favicon, logos, banners, etc.
    include /etc/nginx/nginx_image_aliases.conf;

    # HTTP basic user management (doesn't use nginx_auth_rt as it does its own auth directly)
    location /auth {
      proxy_pass http://htadmin;
      proxy_redirect off;
      proxy_set_header Accept-Encoding "";
      proxy_set_header Host htadmin.malcolm.local;
      rewrite ^/auth/?(.*) /$1 break;
      subs_filter_types '*';
      subs_filter '(src|action|href)="([\w\.-]+\.(php|css|js))' '$1="/auth/$2' gir;
      subs_filter 'href="styles/' 'href="/auth/styles/' gi;
      subs_filter 'src="script/' 'src="/auth/script/' gi;
      subs_filter '/fonts/glyphicons' '/auth/fonts/glyphicons' gi;
    }
    location ~* ^/(htadmin|admin_login)(\.php)\b(.*) {
      proxy_pass http://htadmin/$1$2$3;
      proxy_redirect off;
      proxy_set_header Accept-Encoding "";
      proxy_set_header Host htadmin.malcolm.local;
      subs_filter_types '*';
      subs_filter '(src|action|href)="([\w\.-]+\.(php|css|js))' '$1="/auth/$2' gir;
      subs_filter 'href="styles/' 'href="/auth/styles/' gi;
      subs_filter 'src="script/' 'src="/auth/script/' gi;
      subs_filter '/fonts/glyphicons' '/auth/fonts/glyphicons' gi;
    }

    # Malcolm file upload
    location /upload {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      rewrite ^/upload(.*)/?$ /$1 break;
      proxy_pass http://upload;
      proxy_redirect off;
      proxy_set_header Host upload.malcolm.local;
      proxy_request_buffering off;
      proxy_buffering off;
      client_max_body_size 50G;
    }
    location /server/php {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      proxy_pass http://upload/server/php;
      proxy_redirect off;
      proxy_set_header Host upload.malcolm.local;
      proxy_request_buffering off;
      proxy_buffering off;
      client_max_body_size 50G;
    }

    # netbox
    location /netbox {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://netbox;
      proxy_redirect off;
      proxy_set_header Host netbox.malcolm.local;
      proxy_set_header X-Forwarded-Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Remote-Auth $authenticated_user;
    }
    # netbox from dashboards pivot link (because Dashboards is prepending its own prefix, we have to handle it)
    location ~* ^/dashboards/app/netbox/(.*) {
      set $forwarded_scheme $scheme;
      if ($http_x_forwarded_proto = 'https') {
          set $forwarded_scheme https;
      }
      set $fwuri $1;
      rewrite ^/dashboards/app/netbox/(.*) $forwarded_scheme://$host/netbox/$1 redirect;
      proxy_pass http://netbox;
      proxy_redirect off;
      proxy_set_header Host netbox.malcolm.local;
      proxy_set_header X-Forwarded-Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Remote-Auth $authenticated_user;
    }

    # extracted file download
    location ~* ^/extracted-files\b(.*) {
      include /etc/nginx/nginx_auth_rt.conf;
      # thanks to https://stackoverflow.com/a/31440150, handle spaces in names
      set $filereq $1;
      proxy_pass http://extracted-file-http-server$filereq$is_args$args;
      proxy_redirect off;
      proxy_set_header Host file-monitor.malcolm.local;
    }

    # extracted files from dashboards link (because Dashboards is prepending its own prefix, we have to handle it)
    location ~* ^/dashboards/app/extracted-files/(.*) {
      set $forwarded_scheme $scheme;
      if ($http_x_forwarded_proto = 'https') {
          set $forwarded_scheme https;
      }
      set $fwuri $1;
      rewrite ^/dashboards/app/extracted-files/(.*) $forwarded_scheme://$host/extracted-files/$1 redirect;
      proxy_pass http://extracted-file-http-server;
      proxy_redirect off;
      proxy_set_header Host file-monitor.malcolm.local;
    }

    # extracted file download hedgehog redirect
    location ~* ^/(dashboards/app/)?hh-extracted-files/([a-zA-Z0-9-\.]+)\b(.*) {
      include /etc/nginx/nginx_auth_rt.conf;
      include /etc/nginx/nginx_system_resolver.conf;
      set $upstream $2:8006;
      set $filereq $3;
      rewrite ^/(dashboards/app/)?hh-extracted-files/([a-zA-Z0-9-\.]+)(.*)$ $filereq break;
      proxy_pass https://$upstream;
      proxy_ssl_verify off;
      proxy_set_header Host $2;
      proxy_set_header X-Malcolm-Forward "/hh-extracted-files/$2";
    }

    # Arkime -> Dashboards shortcut
    location ~* /idark2dash(.*) {
      set $filter_start_time now-1d;
      if ($arg_start != '') {
        set $filter_start_time \'$arg_start\';
      }

      set $filter_stop_time now;
      if ($arg_stop != '') {
        set $filter_stop_time \'$arg_stop\';
      }

      set $filter_field undefined;
      if ($arg_field != '') {
        set $filter_field $arg_field;
      }

      set $filter_value undefined;
      if ($arg_value != '') {
        set $filter_value $arg_value;
      }

      include /etc/nginx/nginx_idark2dash_rewrite_rt.conf;
    }

    # Dashboards -> Arkime shortcut
    location ~* /iddash2ark/(.*) {
      set $forwarded_scheme $scheme;
      if ($http_x_forwarded_proto = 'https') {
          set $forwarded_scheme https;
      }
      rewrite ^.*/iddash2ark/(.*) $forwarded_scheme://$host/arkime/sessions?expression=($1) redirect;
      proxy_pass https://arkime;
      proxy_ssl_verify off;
      proxy_redirect off;
      proxy_set_header Host arkime.malcolm.local;
      proxy_set_header http_auth_http_user $authenticated_user;
      proxy_set_header Authorization "";
    }

    # OpenSearch dashboards (or Kibana)
    location /dashboards {
      include /etc/nginx/nginx_dashboards_rewrite_rt.conf;
    }

    # offline region maps for dashboards
    location /world.geojson {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://dashboards-maps;
      proxy_redirect off;
      proxy_set_header Host dashboards-helper.malcolm.local;
    }

    # Fix cyberchef JS module(s)
    # https://localhost/arkime/session/190924-KgO9H30qhdREw7ltsDXn1Rgp/modules/Regex.js
    location ~* ^/arkime/session/.*/(modules/.*\.js) {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_hide_header Content-Type;
      proxy_set_header Content-Type "application/javascript";
      add_header Content-Type "application/javascript";
      default_type application/javascript;
      add_header X-Content-Type-Options 'nosniff';
      proxy_pass https://arkime/cyberchef/$1;
      proxy_ssl_verify off;
      proxy_redirect off;
      proxy_set_header Host arkime.malcolm.local;
      proxy_set_header http_auth_http_user $authenticated_user;
      proxy_set_header Authorization "";
    }

    # passthrough Logstash statistics from the Malcolm API
    location /mapi/logstash/ {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://logstash-stats/;
      proxy_redirect off;
    }

    # passthrough OpenSearch from the Malcolm API
    location /mapi/opensearch/ {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://opensearch/;
      proxy_redirect off;
      proxy_set_header Host os.malcolm.local;
      client_max_body_size 50m;
    }

    # passthrough NetBox from the Malcolm API
    location /mapi/netbox/ {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://netbox/netbox/api/;
      proxy_redirect off;
      proxy_set_header Host netbox.malcolm.local;
      proxy_set_header X-Forwarded-Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Remote-Auth $authenticated_user;
    }

    # Malcolm API
    location /mapi {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://api;
      proxy_redirect off;
      proxy_set_header Host api.malcolm.local;
    }

    # Arkime
    location /arkime {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass https://arkime;
      proxy_redirect off;
      proxy_set_header Host arkime.malcolm.local;
      proxy_set_header http_auth_http_user $authenticated_user;
      proxy_set_header Authorization "";
    }

    # Landing Page and README
    location / {
      include /etc/nginx/nginx_auth_rt.conf;
      root /usr/share/nginx/html;
      index index.html
      try_files $uri $uri/ =404;
      error_page 404 /404.html;
      error_page 502 /502.html;
    }
  }

  # OpenSearch API
  server {
    listen 9200;
    include /etc/nginx/nginx_ssl_config.conf;

    # use either auth_basic or auth_ldap
    include /etc/nginx/nginx_auth_rt.conf;

    # favicon, logos, banners, etc.
    include /etc/nginx/nginx_image_aliases.conf;

    location / {
      proxy_pass http://opensearch;
      proxy_redirect off;
      proxy_set_header Host os.malcolm.local;
      client_max_body_size 50m;
    }
  }

}