1+ {{- if .Values.ingress.enableReverseProxy }}
2+ apiVersion : v1
3+ kind : ConfigMap
4+ metadata :
5+ name : {{ include "adhoc-odoo.fullname" . }}-nginx-config
6+ labels :
7+ {{- include "adhoc-odoo.labels" . | nindent 4 }}
8+ data :
9+ nginx.conf : |
10+ events {
11+ worker_connections 1024;
12+ }
13+ http {
14+ default_type application/octet-stream;
15+
16+ sendfile on;
17+ proxy_redirect off;
18+ server_tokens off;
19+
20+ access_log off;
21+ # access_log /dev/stdout;
22+ # error_log /dev/stderr;
23+
24+ keepalive_timeout 65;
25+ tcp_nodelay on;
26+
27+ # Proxy optimizations
28+ proxy_buffers 32 8k;
29+ proxy_buffer_size 4k;
30+ proxy_busy_buffers_size 8k;
31+ proxy_max_temp_file_size 2048m;
32+ proxy_temp_file_write_size 64k;
33+
34+ # Proxy cache
35+ proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache:10m max_size=10g inactive=60m;
36+
37+ # Default value '4 8k' is raising a '414 Request-URI Too Large' error
38+ # when '/web/webclient/translations/' is requested with a lot of module names
39+ # as GET parameters (performed on user login), rendering a blank page.
40+ # Source: https://github.com/camptocamp/docker-odoo-nginx/blob/891ad970/9.0/templates/nginx.conf.tmpl#L46-L50
41+ large_client_header_buffers 4 12k;
42+
43+ types_hash_max_size 1024;
44+ types_hash_bucket_size 512;
45+
46+ server_names_hash_bucket_size 64;
47+ server_names_hash_max_size 512;
48+
49+ # Gzip
50+ gzip on;
51+ gzip_http_version 1.0;
52+ gzip_proxied any;
53+ gzip_min_length 500;
54+ gzip_disable "MSIE [1-6]\.";
55+ gzip_types text/plain text/xml text/css
56+ text/comma-separated-values
57+ text/javascript
58+ application/json
59+ application/xml
60+ application/x-javascript
61+ application/javascript
62+ application/atom+xml;
63+
64+ upstream odoo {
65+ server {{ include "adhoc-odoo.serviceNameSuffix" . }}-http:80;
66+ keepalive 32; # Mejora rendimiento para conexiones persistentes
67+ }
68+
69+ {{- $usewebsocket := .Values.odoo.performance.workers | toString | int -}}
70+ {{- if gt $usewebsocket 0 }}
71+ upstream odoochat {
72+ server {{ include "adhoc-odoo.serviceNameSuffix" . }}-websocket:80;
73+ keepalive 32; # Mejora rendimiento para conexiones persistentes
74+ }
75+ {{- end }}
76+
77+ # Used by websocket
78+ # https://www.odoo.com/documentation/18.0/administration/on_premise/deploy.html?highlight=nginx#https
79+ map $http_upgrade $connection_upgrade {
80+ default upgrade;
81+ '' close;
82+ }
83+
84+ # Used by static files
85+ # https://www.odoo.com/documentation/18.0/administration/on_premise/deploy.html?highlight=nginx#serving-static-files
86+ map $sent_http_content_type $content_type_csp {
87+ default "";
88+ ~image/ "default-src 'none'";
89+ }
90+
91+ server {
92+ listen 80 default;
93+ client_max_body_size 1G;
94+
95+
96+ # Prevent browsers from ever sending a plain HTTP request to this domain
97+ # https://www.odoo.com/documentation/18.0/administration/on_premise/deploy.html?highlight=nginx#https-hardening
98+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
99+
100+ # Additional configuration for the session_id cookie.
101+ # The Secure flag ensures it is never transmitted over HTTP
102+ # SameSite=Lax to prevent authenticated CSRF.
103+ # https://www.odoo.com/documentation/18.0/administration/on_premise/deploy.html?highlight=nginx#https-hardening
104+ proxy_cookie_flags session_id samesite=lax secure;
105+
106+ # Security
107+ add_header X-Content-Type-Options "nosniff";
108+ add_header X-Frame-Options "SAMEORIGIN";
109+ add_header X-XSS-Protection "1; mode=block";
110+ # Cookies are set to Secure and HttpOnly
111+ proxy_cookie_path / "/; Secure; HttpOnly; SameSite=Lax";
112+ # Additional protection against clickjacking
113+ add_header Content-Security-Policy "frame-ancestors 'self'";
114+
115+ # Redirect requests to odoo backend server
116+ location / {
117+ proxy_pass http://odoo;
118+ # Add Headers for odoo proxy mode
119+ proxy_set_header X-Forwarded-For $http_x_forwarded_for;
120+ proxy_set_header X-Real-IP $remote_addr;
121+
122+ proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
123+ proxy_set_header Forwarded "for=$http_x_forwarded_for;proto=$scheme";
124+
125+ proxy_set_header Host $http_host;
126+ proxy_redirect off;
127+ }
128+
129+ {{- if gt $usewebsocket 0 }}
130+ # Redirect longpoll requests to odoo longpolling port (Odoo <= 15.0)
131+ location /longpolling {
132+ proxy_pass http://odoochat;
133+ # Add Headers for odoo proxy mode
134+ proxy_set_header X-Forwarded-For $http_x_forwarded_for;
135+ proxy_set_header X-Real-IP $remote_addr;
136+
137+ proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
138+ proxy_set_header Forwarded "for=$http_x_forwarded_for;proto=$scheme";
139+
140+ proxy_set_header Host $http_host;
141+ proxy_redirect off;
142+ # Avoid premature disconections
143+ proxy_read_timeout 86400s;
144+ proxy_send_timeout 86400s;
145+ }
146+
147+ # Redirect websocket requests to odoo gevent port (Odoo >= 16.0)
148+ location /websocket {
149+ proxy_pass http://odoochat;
150+ proxy_http_version 1.1;
151+ proxy_set_header Upgrade $http_upgrade;
152+ proxy_set_header Connection $connection_upgrade;
153+ # Add Headers for odoo proxy mode
154+ proxy_set_header X-Forwarded-For $http_x_forwarded_for;
155+ proxy_set_header X-Real-IP $remote_addr;
156+
157+ proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
158+ proxy_set_header Forwarded "for=$http_x_forwarded_for;proto=$scheme";
159+
160+ proxy_set_header Host $http_host;
161+ proxy_redirect off;
162+ # Avoid premature disconections
163+ proxy_read_timeout 86400s;
164+ proxy_send_timeout 86400s;
165+ }
166+ {{- end }}
167+
168+ # Static files are still served by Odoo, because Nginx doesn't have access to
169+ # the Odoo source code. However, they are cached.
170+ location ~ ^/[^/]+/static/.+$ {
171+ proxy_buffering on;
172+ proxy_pass http://odoo;
173+
174+ proxy_cache cache;
175+ proxy_cache_valid 60m;
176+ proxy_cache_valid any 1m;
177+ proxy_cache_revalidate on;
178+ proxy_cache_use_stale error timeout updating;
179+ proxy_cache_background_update on;
180+ proxy_cache_lock on;
181+
182+ expires 24h;
183+ # expires 365d; # TODO: Check if this is a good idea
184+ add_header Cache-Control "public, immutable";
185+ # proxy_cache_valid 200 302 365d; # Cache más largo para respuestas exitosas
186+ # proxy_cache_valid 404 1m; # Cache corto para 404
187+ # add_header X-Cache-Status $upstream_cache_status; # Para debugging
188+
189+ # Security recommendations
190+ # https://www.odoo.com/documentation/18.0/administration/on_premise/deploy.html?highlight=nginx#serving-static-files
191+ add_header Content-Security-Policy $content_type_csp;
192+
193+ # Add Headers for odoo proxy mode
194+ proxy_set_header X-Forwarded-For $http_x_forwarded_for;
195+ proxy_set_header X-Real-IP $remote_addr;
196+
197+ proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
198+ proxy_set_header Forwarded "for=$http_x_forwarded_for;proto=$scheme";
199+
200+ proxy_set_header Host $http_host;
201+ proxy_redirect off;
202+ }
203+
204+ # Filestore storage files are served by Nginx thanks to the X-Accel extension
205+ # Requires the `x_sendfile = True` configuration in Odoo.
206+ # https://www.odoo.com/documentation/18.0/administration/on_premise/deploy.html?highlight=nginx#serving-attachments
207+ location /web/filestore {
208+ internal;
209+ alias /mnt/filestore;
210+ }
211+ }
212+ }
213+
214+ {{- end }}
0 commit comments