run

#!/bin/bash

nginxConfig="/etc/nginx/nginx.conf"

# build nginx config
cat <<EOF > ${nginxConfig}
worker_processes 1;

events {
  worker_connections 1024;
  use epoll;
	multi_accept on;
}

http {
  # optimize for large files
  sendfile on;
  directio 512;
  aio on;
  tcp_nopush on;
  tcp_nodelay on;

  keepalive_timeout 90;

  # log format definition
  log_format rt_cache '\$remote_addr - \$upstream_cache_status [\$time_local]  '
                      '"\$request" \$status \$body_bytes_sent '
                      '"\$http_referer" "\$http_user_agent"';
  access_log          /var/log/nginx/access.log rt_cache;

  # open file caching
  open_file_cache            max=2000 inactive=5m;
  open_file_cache_valid      5m;
  open_file_cache_min_uses   1;
  open_file_cache_errors     on;

  # MIME type handling
  types_hash_max_size 2048;
  include /etc/nginx/mime.types;
  default_type application/octet-stream;
  types {
    application/x-plist plist;
  }

  # Don't include the nginx version number, etc
  server_tokens off;

  # Gzip Settings
  gzip on;
  gzip_min_length 1000;
  gzip_types application/x-javascript text/css application/javascript text/javascript text/plain text/xml;

  # caching
  proxy_cache_path        /cache/pkgs keys_zone=MUNKI_PKGS:5m levels=1:2 use_temp_path=off max_size=${MAX_SIZE} inactive=${EXPIRE_PKGS};
  proxy_cache_path        /cache/icons keys_zone=MUNKI_ICONS:5m levels=1:2 use_temp_path=off inactive=${EXPIRE_ICONS};
  proxy_cache_path        /cache/apple keys_zone=APPLE_SUS:5m levels=1:2 use_temp_path=off inactive=${EXPIRE_SUS};
  proxy_cache_path        /cache/other keys_zone=MUNKI_DEFAULT:5m levels=1:2 use_temp_path=off inactive=${EXPIRE_OTHER};
  proxy_cache_use_stale   error timeout invalid_header updating http_500 http_502 http_503 http_504;

  proxy_cache_valid         200 302 404   ${EXPIRE_OTHER};
  proxy_cache_revalidate    on;
  proxy_cache_lock          on;
  proxy_cache_lock_timeout  5m;

  server {
    listen ${PORT};
EOF

# enable SSL if asked
if [[ ${SSL} ]]; then
  cat <<EOF >> ${nginxConfig}

    ssl                 on;
    ssl_certificate     /etc/ssl/cert.pem;
    ssl_certificate_key /etc/ssl/cert.key;

EOF
fi

# server_name if provided
if [[ ${SERVER_NAME} ]]; then
  echo "    server_name       ${SERVER_NAME};" >> ${nginxConfig}
  echo "" >> ${nginxConfig}
  echo "    proxy_set_header  Host \$server_name;" >> ${nginxConfig}
else
  echo "    proxy_set_header  Host \$host;" >> ${nginxConfig}
fi

# continue
cat <<EOF >> ${nginxConfig}
    proxy_set_header  X-Real-IP \$remote_addr;
    proxy_set_header  X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Host \$server_name;

    proxy_ignore_headers  Cache-Control;
    proxy_hide_header     Cache-Control;

    proxy_cache    MUNKI_DEFAULT;

    location = / {
      return 204;
    }
EOF

# gruntwork staging server detection
if [[ ${GRUNTWORK} ]]; then
  echo "managed_installs" > /usr/share/nginx/html/gruntwork-only
  cat <<EOF >> ${nginxConfig}

    location ${MUNKI_ROOT}/manifests/gruntwork-only {
      alias /usr/share/nginx/html/gruntwork-only;
    }
EOF
fi

# continue
cat <<EOF >> ${nginxConfig}

    location ${MUNKI_ROOT}/catalogs/ {
      proxy_pass          ${UPSTREAM_SERVER}${MUNKI_ROOT}/catalogs/;

      proxy_ignore_headers  Cache-Control;
      proxy_hide_header     Cache-Control;

      proxy_set_header    X-Real-IP \$remote_addr;
      proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header    X-Forwarded-Host \$server_name;
EOF

# server_name if provided
if [[ ${SERVER_NAME} ]]; then
  echo "      proxy_set_header    Host \$server_name;" >> ${nginxConfig}
else
  echo "      proxy_set_header    Host \$host;" >> ${nginxConfig}
fi

# gruntwork staging server authorization
if [[ ${GRUNTWORK} ]]; then
  echo "      proxy_set_header    Authorization \"Basic ${GRUNTWORK}\";" >> ${nginxConfig}
fi

# continue
cat <<EOF >> ${nginxConfig}
    }

    location ${MUNKI_ROOT}/icons/ {
      proxy_pass          ${UPSTREAM_SERVER}${MUNKI_ROOT}/icons/;
      proxy_cache         MUNKI_ICONS;
      proxy_cache_valid   200 302 404   ${EXPIRE_ICONS};

      proxy_ignore_headers  Cache-Control;
      proxy_hide_header     Cache-Control;

      proxy_set_header    X-Real-IP \$remote_addr;
      proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header    X-Forwarded-Host \$server_name;
EOF

# server_name if provided
if [[ ${SERVER_NAME} ]]; then
  echo "      proxy_set_header    Host \$server_name;" >> ${nginxConfig}
else
  echo "      proxy_set_header    Host \$host;" >> ${nginxConfig}
fi

# gruntwork staging server authorization
if [[ ${GRUNTWORK} ]]; then
  echo "      proxy_set_header    Authorization \"Basic ${GRUNTWORK}\";" >> ${nginxConfig}
fi

# continue
cat <<EOF >> ${nginxConfig}
    }

    location ${MUNKI_ROOT}/client_resources/ {
      proxy_pass          ${UPSTREAM_SERVER}${MUNKI_ROOT}/client_resources/;
      proxy_cache         MUNKI_ICONS;
      proxy_cache_valid   200 302 404   ${EXPIRE_ICONS};

      proxy_ignore_headers  Cache-Control;
      proxy_hide_header     Cache-Control;

      proxy_set_header    X-Real-IP \$remote_addr;
      proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header    X-Forwarded-Host \$server_name;
EOF

# server_name if provided
if [[ ${SERVER_NAME} ]]; then
  echo "      proxy_set_header    Host \$server_name;" >> ${nginxConfig}
else
  echo "      proxy_set_header    Host \$host;" >> ${nginxConfig}
fi

# gruntwork staging server authorization
if [[ ${GRUNTWORK} ]]; then
  echo "      proxy_set_header    Authorization \"Basic ${GRUNTWORK}\";" >> ${nginxConfig}
fi

# continue
cat <<EOF >> ${nginxConfig}
    }

    location ${MUNKI_ROOT}/manifests/ {
      proxy_pass          ${UPSTREAM_SERVER}${MUNKI_ROOT}/manifests/;

      proxy_ignore_headers  Cache-Control;
      proxy_hide_header     Cache-Control;

      proxy_set_header    X-Real-IP \$remote_addr;
      proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header    X-Forwarded-Host \$server_name;
EOF

# server_name if provided
if [[ ${SERVER_NAME} ]]; then
  echo "      proxy_set_header    Host \$server_name;" >> ${nginxConfig}
else
  echo "      proxy_set_header    Host \$host;" >> ${nginxConfig}
fi

# gruntwork staging server authorization
if [[ ${GRUNTWORK} ]]; then
  echo "      proxy_set_header    Authorization \"Basic ${GRUNTWORK}\";" >> ${nginxConfig}
fi

# continue
cat <<EOF >> ${nginxConfig}
    }

    location ${MUNKI_ROOT}/pkgs/ {
      proxy_pass          ${UPSTREAM_SERVER}${MUNKI_ROOT}/pkgs/;
      proxy_cache         MUNKI_PKGS;
      proxy_cache_valid   200 206 302   ${EXPIRE_PKGS};
      slice               ${SLICE};
      proxy_cache_key     \$host\$uri\$is_args\$args\$slice_range;

      proxy_ignore_headers  Cache-Control;
      proxy_hide_header     Cache-Control;

      proxy_set_header    Range \$slice_range;
      proxy_set_header    X-Real-IP \$remote_addr;
      proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header    X-Forwarded-Host \$server_name;
EOF

# server_name if provided
if [[ ${SERVER_NAME} ]]; then
  echo "      proxy_set_header    Host \$server_name;" >> ${nginxConfig}
else
  echo "      proxy_set_header    Host \$host;" >> ${nginxConfig}
fi

# gruntwork staging server authorization
if [[ ${GRUNTWORK} ]]; then
  echo "      proxy_set_header    Authorization \"Basic ${GRUNTWORK}\";" >> ${nginxConfig}
fi

# split up server block for sus if needed
if [[ ${SERVER_NAME_SUS} ]]; then
  # reset our variables
  SERVER_NAME=${SERVER_NAME_SUS}
  UPSTREAM_SERVER=${UPSTREAM_SUS_SERVER}
  cat <<EOF >> ${nginxConfig}
    }
  }

  server {
    listen ${PORT};
EOF

  # enable SSL if asked
  if [[ ${SSL_SUS} ]]; then
    cat <<EOF >> ${nginxConfig}

    ssl                 on;
    ssl_certificate     /etc/ssl/cert_sus.pem;
    ssl_certificate_key /etc/ssl/cert_sus.key;

EOF
  fi

  # server_name if provided
  if [[ ${SERVER_NAME_SUS} ]]; then
    echo "    server_name       ${SERVER_NAME_SUS};" >> ${nginxConfig}
    echo "" >> ${nginxConfig}
    echo "    proxy_set_header  Host \$server_name;" >> ${nginxConfig}
  else
    echo "    proxy_set_header  Host \$host;" >> ${nginxConfig}
  fi

  # continue
  cat <<EOF >> ${nginxConfig}
    proxy_set_header  X-Real-IP \$remote_addr;
    proxy_set_header  X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Host \$server_name;

    proxy_ignore_headers  Cache-Control;
    proxy_hide_header     Cache-Control;

    proxy_cache    MUNKI_DEFAULT;

    location = / {
      return 204;
    }
EOF

else
  echo "    }" >> ${nginxConfig}
fi

# continue
cat <<EOF >> ${nginxConfig}

    location ${SUS_ROOT}/ {
      if ( \$http_user_agent ~ "Darwin/11" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
      if ( \$http_user_agent ~ "Darwin/12" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-mountainlion-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
      if ( \$http_user_agent ~ "Darwin/13" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-10.9-mountainlion-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
      if ( \$http_user_agent ~ "Darwin/14" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
      if ( \$http_user_agent ~ "Darwin/15" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
      if ( \$http_user_agent ~ "Darwin/16" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
      if ( \$http_user_agent ~ "Darwin/17" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
      if ( \$http_user_agent ~ "Darwin/18" ){
        rewrite ^${SUS_ROOT}/index(.*)\.sucatalog$ ${SUS_ROOT}/content/catalogs/others/index-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1$1.sucatalog last;
      }
    }

    location ${SUS_ROOT}/content/catalogs/ {
      proxy_pass          ${UPSTREAM_SERVER}${SUS_ROOT}/content/catalogs/;
    }

    location ${SUS_ROOT}/content/downloads/ {
      proxy_pass          ${UPSTREAM_SERVER}${SUS_ROOT}/content/downloads/;
      proxy_cache         APPLE_SUS;
      proxy_cache_valid   200 206 302   ${EXPIRE_SUS};

      proxy_ignore_headers  Cache-Control;
      proxy_hide_header     Cache-Control;

      slice               ${SLICE};
      proxy_cache_key     \$host\$uri\$is_args\$args\$slice_range;
      proxy_set_header    Range \$slice_range;
      proxy_set_header    X-Real-IP \$remote_addr;
      proxy_set_header    X-Forwarded-For \$proxy_add_x_forwarded_for;
      proxy_set_header    X-Forwarded-Host \$server_name;
      proxy_http_version  1.1;
EOF

# server_name if provided
if [[ ${SERVER_NAME} ]]; then
  echo "      proxy_set_header    Host \$server_name;" >> ${nginxConfig}
else
  echo "      proxy_set_header    Host \$host;" >> ${nginxConfig}
fi

# continue
cat <<EOF >> ${nginxConfig}
    }
  }
}
EOF

# enable avahi if the user wants it
if [[ ${AVAHI_HOST} ]]; then
  # configure avahi
  cat <<EOF > /etc/avahi/services/munki.service
<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
  <name replace-wildcards="yes">proxy</name>
  <service>
    <type>_munki._tcp</type>
    <port>${PORT}</port>
    <txt-record>protocol=http</txt-record>
    <txt-record>path=${MUNKI_ROOT}</txt-record>
  </service>
</service-group>
EOF

  sed -i -e "s/^#host-name=.*/host-name=${AVAHI_HOST}/" /etc/avahi/avahi-daemon.conf
  sed -i -e "s/^#domain-name=.*/domain-name=${AVAHI_DOMAIN}/" /etc/avahi/avahi-daemon.conf

  # start avahi
  echo "Starting mDNS service"
  avahi-daemon -D --no-drop-root
fi

# run nginx
nginx -g 'daemon off;'

# if we get this far nginx failed - lets output the config
cat -n /etc/nginx/nginx.conf