Skip to content

Commit 8e14344

Browse files
rshourourshourou
committed
replace nginx.conf w default.conf
1 parent fceedee commit 8e14344

3 files changed

Lines changed: 149 additions & 187 deletions

File tree

‎infrastructure/prime-app-ephemeral-template.yml‎

Lines changed: 147 additions & 185 deletions
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,8 @@ objects:
149149
mountPath: /etc/nginx/certs/plr
150150
- name: nginx-config
151151
readOnly: true
152-
mountPath: /etc/nginx/nginx.conf
153-
subPath: nginx.conf
152+
mountPath: /etc/nginx/conf.d/default.conf
153+
subPath: default.conf
154154
- name: env-config
155155
readOnly: true
156156
mountPath: /opt/app-root/src/assets/config-map.json
@@ -213,212 +213,174 @@ objects:
213213
labels:
214214
app.kubernetes.io/part-of: ${SVC_NAME}
215215
data:
216-
nginx.conf: |-
216+
default.conf: |-
217217
# Based on https://www.nginx.com/resources/wiki/start/topics/examples/full/#nginx-conf
218218
#user www www; ## Default: nobody
219+
server {
220+
listen 8080;
221+
server_name localhost *.gov.bc.ca;
222+
server_tokens off;
219223
220-
worker_processes auto;
221-
error_log "/var/log/nginx/error.log";
222-
pid "/tmp/nginx.pid";
224+
root /opt/app-root/src;
225+
index index.html index.htm;
223226
224-
events {
225-
worker_connections 1024;
226-
}
227-
228-
http {
229-
include /etc/nginx/mime.types;
230-
default_type application/octet-stream;
231-
log_format main '$remote_addr - $remote_user [$time_local] '
232-
'"$request" $status $body_bytes_sent "$http_referer" '
233-
'"$http_user_agent" "$http_x_forwarded_for"';
234-
access_log "/var/log/nginx/access.log" main;
235-
# add_header X-Frame-Options SAMEORIGIN;
236-
237-
client_body_temp_path "/tmp/client_body" 1 2;
238-
proxy_temp_path "/tmp/proxy" 1 2;
239-
fastcgi_temp_path "/tmp/fastcgi" 1 2;
240-
scgi_temp_path "/tmp/scgi" 1 2;
241-
uwsgi_temp_path "/tmp/uwsgi" 1 2;
242-
243-
sendfile on;
244-
# tcp_nopush on;
245-
tcp_nodelay off;
246-
gzip on;
247-
gzip_http_version 1.0;
248-
gzip_comp_level 2;
249-
gzip_proxied any;
250-
gzip_types text/plain text/css application/javascript text/xml application/xml+rss;
251-
keepalive_timeout 65;
252-
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
253-
ssl_ciphers HIGH:!aNULL:!MD5;
254-
client_max_body_size 80M;
255-
server_tokens off;
256-
257-
server {
258-
listen 8080;
259-
server_name localhost *.gov.bc.ca;
260-
server_tokens off;
227+
include mime.types;
228+
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
229+
add_header X-XSS-Protection "1; mode=block" always;
230+
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
231+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
232+
add_header X-Content-Type-Options "nosniff" always;
233+
add_header Referrer-Policy "no-referrer-when-downgrade";
261234
262-
root /opt/app-root/src;
263-
index index.html index.htm;
235+
gzip on;
236+
gzip_min_length 1000;
237+
gzip_proxied expired no-cache no-store private auth;
238+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
264239
265-
include mime.types;
266-
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
267-
add_header X-XSS-Protection "1; mode=block" always;
268-
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
269-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
270-
add_header X-Content-Type-Options "nosniff" always;
271-
add_header Referrer-Policy "no-referrer-when-downgrade";
272-
273-
gzip on;
274-
gzip_min_length 1000;
275-
gzip_proxied expired no-cache no-store private auth;
276-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
277-
278-
location / {
279-
try_files $uri $uri/ /index.html$args;
280-
}
281-
location /api/docman/ {
282-
proxy_pass http://${SVC_NAME}-document-manager:6001/;
283-
}
284-
location /api/v1/ {
285-
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
286-
}
287-
location /api/v1/PLRHL7 {
288-
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
289-
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
290-
}
291-
location /nginx_status {
292-
# Enable Nginx stats
293-
stub_status on;
294-
# Only allow access from localhost
295-
allow 127.0.0.1;
296-
# Other request should be denied
297-
deny all;
298-
# No need to log this request, its just noise
299-
access_log on;
300-
}
240+
location / {
241+
try_files $uri $uri/ /index.html$args;
242+
}
243+
location /api/docman/ {
244+
proxy_pass http://${SVC_NAME}-document-manager:6001/;
245+
}
246+
location /api/v1/ {
247+
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
301248
}
302-
server {
303-
listen 8443 ssl;
304-
server_name *.gov.bc.ca;
305-
ssl_password_file certs/passwd.txt;
306-
ssl_certificate certs/chained.crt;
307-
ssl_certificate_key certs/private.key;
308-
server_tokens off;
309-
# ssl_verify_client optional_no_ca;
249+
location /api/v1/PLRHL7 {
250+
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
251+
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
252+
}
253+
location /nginx_status {
254+
# Enable Nginx stats
255+
stub_status on;
256+
# Only allow access from localhost
257+
allow 127.0.0.1;
258+
# Other request should be denied
259+
deny all;
260+
# No need to log this request, its just noise
261+
access_log on;
262+
}
263+
}
264+
server {
265+
listen 8443 ssl;
266+
server_name *.gov.bc.ca;
267+
ssl_password_file certs/passwd.txt;
268+
ssl_certificate certs/chained.crt;
269+
ssl_certificate_key certs/private.key;
270+
server_tokens off;
271+
# ssl_verify_client optional_no_ca;
310272
311-
root /opt/app-root/src;
312-
index index.html index.htm;
273+
root /opt/app-root/src;
274+
index index.html index.htm;
313275
314-
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
315-
add_header X-XSS-Protection "1; mode=block" always;
316-
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
317-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
318-
add_header X-Content-Type-Options "nosniff" always;
319-
add_header Referrer-Policy "no-referrer-when-downgrade";
276+
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
277+
add_header X-XSS-Protection "1; mode=block" always;
278+
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
279+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
280+
add_header X-Content-Type-Options "nosniff" always;
281+
add_header Referrer-Policy "no-referrer-when-downgrade";
320282
321-
gzip on;
322-
gzip_min_length 1000;
323-
gzip_proxied expired no-cache no-store private auth;
324-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
283+
gzip on;
284+
gzip_min_length 1000;
285+
gzip_proxied expired no-cache no-store private auth;
286+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
325287
326-
location / {
327-
try_files $uri $uri/ /index.html$args;
328-
}
329-
location /api/docman/ {
330-
proxy_pass http://${SVC_NAME}-document-manager:6001/;
331-
}
332-
location /api/v1/ {
333-
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
334-
}
335-
location /api/v1/PLRHL7 {
336-
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
337-
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
338-
}
339-
location /nginx_status {
340-
# Enable Nginx stats
341-
stub_status on;
288+
location / {
289+
try_files $uri $uri/ /index.html$args;
290+
}
291+
location /api/docman/ {
292+
proxy_pass http://${SVC_NAME}-document-manager:6001/;
293+
}
294+
location /api/v1/ {
295+
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
296+
}
297+
location /api/v1/PLRHL7 {
298+
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
299+
# proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
300+
}
301+
location /nginx_status {
302+
# Enable Nginx stats
303+
stub_status on;
342304
343-
# Only allow access from localhost
344-
allow 127.0.0.1;
305+
# Only allow access from localhost
306+
allow 127.0.0.1;
345307
346-
# Other request should be denied
347-
deny all;
308+
# Other request should be denied
309+
deny all;
348310
349-
# No need to log this request, its just noise
350-
access_log on;
351-
}
311+
# No need to log this request, its just noise
312+
access_log on;
352313
}
353-
server {
354-
listen 8888;
355-
server_name *.gov.bc.ca;
356-
server_tokens off;
314+
}
315+
server {
316+
listen 8888;
317+
server_name *.gov.bc.ca;
318+
server_tokens off;
357319
358-
root /opt/app-root/src;
359-
index index.html index.htm;
320+
root /opt/app-root/src;
321+
index index.html index.htm;
360322
361-
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
362-
add_header X-XSS-Protection "1; mode=block" always;
363-
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
364-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
365-
add_header X-Content-Type-Options "nosniff" always;
366-
add_header Referrer-Policy "no-referrer-when-downgrade";
367-
gzip on;
368-
gzip_min_length 1000;
369-
gzip_proxied expired no-cache no-store private auth;
370-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
323+
add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
324+
add_header X-XSS-Protection "1; mode=block" always;
325+
add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
326+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
327+
add_header X-Content-Type-Options "nosniff" always;
328+
add_header Referrer-Policy "no-referrer-when-downgrade";
329+
gzip on;
330+
gzip_min_length 1000;
331+
gzip_proxied expired no-cache no-store private auth;
332+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
371333
372-
location / {
373-
try_files $uri $uri/ /index.html$args;
374-
}
375-
location /api/docman/ {
376-
proxy_pass http://${SVC_NAME}-document-manager:6001;
377-
}
378-
location /api/v1/ {
379-
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
380-
}
381-
location /nginx_status {
382-
# Enable Nginx stats
383-
stub_status on;
384-
# Only allow access from localhost
385-
allow 127.0.0.1;
386-
# Other request should be denied
387-
deny all;
388-
# No need to log this request, its just noise
389-
access_log on;
390-
}
334+
location / {
335+
try_files $uri $uri/ /index.html$args;
336+
}
337+
location /api/docman/ {
338+
proxy_pass http://${SVC_NAME}-document-manager:6001;
391339
}
392-
server {
393-
# Block for API end-points that require a client certificate (Multual Authentication)
394-
listen 8890 ssl;
395-
server_name *.gov.bc.ca;
396-
ssl_password_file certs/passwd.txt;
397-
ssl_certificate certs/chained.crt;
398-
ssl_certificate_key certs/private.key;
399-
server_tokens off;
400-
ssl_verify_client optional_no_ca;
401-
ssl_client_certificate certs/plr/trusted-ca-certs.pem;
402-
root /opt/app-root/src;
403-
index index.html index.htm;
340+
location /api/v1/ {
341+
proxy_pass http://${SVC_NAME}-webapi:8080/api/;
342+
}
343+
location /nginx_status {
344+
# Enable Nginx stats
345+
stub_status on;
346+
# Only allow access from localhost
347+
allow 127.0.0.1;
348+
# Other request should be denied
349+
deny all;
350+
# No need to log this request, its just noise
351+
access_log on;
352+
}
353+
}
354+
server {
355+
# Block for API end-points that require a client certificate (Multual Authentication)
356+
listen 8890 ssl;
357+
server_name *.gov.bc.ca;
358+
ssl_password_file certs/passwd.txt;
359+
ssl_certificate certs/chained.crt;
360+
ssl_certificate_key certs/private.key;
361+
server_tokens off;
362+
ssl_verify_client optional_no_ca;
363+
ssl_client_certificate certs/plr/trusted-ca-certs.pem;
364+
root /opt/app-root/src;
365+
index index.html index.htm;
404366
405-
# add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
406-
# add_header X-XSS-Protection "1; mode=block" always;
407-
# add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
408-
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
409-
add_header X-Content-Type-Options "nosniff" always;
410-
# add_header Referrer-Policy "no-referrer-when-downgrade";
411-
gzip on;
412-
gzip_min_length 1000;
413-
gzip_proxied expired no-cache no-store private auth;
414-
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
367+
# add_header X-Frame-Options "ALLOW-FROM common-logon-dev.hlth.gov.bc.ca" always;
368+
# add_header X-XSS-Protection "1; mode=block" always;
369+
# add_header Content-Security-Policy "frame-ancestors 'self' common-logon-dev.hlth.gov.bc.ca; style-src 'unsafe-inline' 'self' https://fonts.googleapis.com https://fonts.gstatic.com ; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com" always;
370+
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload" always;
371+
add_header X-Content-Type-Options "nosniff" always;
372+
# add_header Referrer-Policy "no-referrer-when-downgrade";
373+
gzip on;
374+
gzip_min_length 1000;
375+
gzip_proxied expired no-cache no-store private auth;
376+
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
415377
416-
location /api/v1/PLRHL7 {
417-
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
418-
proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
419-
}
378+
location /api/v1/PLRHL7 {
379+
proxy_pass http://${SVC_NAME}-webapi:8080/api/PLRHL7;
380+
proxy_set_header X-SSL-CERT $ssl_client_escaped_cert;
420381
}
421382
}
383+
422384
423385
# Frontend Service
424386
- apiVersion: v1

‎prime-angular-frontend/ci.dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM bitnami/nginx:1.21.5-debian-10-r3
1+
FROM nginxinc/nginx-unprivileged:1.20
22

33
COPY dist/angular-frontend/browser /opt/app-root/src
44

‎prime-angular-frontend/openshift.dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ RUN ng build --configuration=production
4444
########################################
4545
### Stage 2 - Production environment ###
4646
########################################
47-
FROM bitnami/nginx:1.21.5-debian-10-r3
47+
FROM nginxinc/nginx-unprivileged:1.20
4848
ARG SVC_NAME
4949
ENV SVC_NAME ${SVC_NAME}
5050

0 commit comments

Comments
 (0)