snippets added

Dockerfile

@@ -1,3 +1,4 @@
 FROM docker.triton2.fet.at/openrestyfet
 COPY ./conf.d/* /etc/nginx/conf.d/
+copy ./snippets/* /usr/local/openresty/nginx/conf/
 ENV PATH "$PATH:/usr/local/openresty/bin"

README.md

@@ -1,5 +1,5 @@
 # Anleitung für Proxy Server in der FET 
-
+## Installation 
 
 location / {
     include proxy.conf;

snippets/auto_ssl.conf

@@ -0,0 +1,5 @@
+location /.well-known/acme-challenge/ {
+      content_by_lua_block {
+        auto_ssl:challenge_server()
+      }
+    }

snippets/default_proxy.conf

@@ -0,0 +1,6 @@
+location / {
+    include proxy.conf;
+    include secure.conf;
+    proxy_buffering off;
+    proxy_pass http://$proxy_host:$proxy_port;
+}

snippets/internal_proxy.conf

@@ -0,0 +1,6 @@
+location / {
+    include proxy.conf;
+    include ldap.conf;
+    proxy_buffering off;
+    proxy_pass http://$proxy_host:$proxy_port;
+}

snippets/internal_sub_proxy.conf

@@ -0,0 +1,9 @@
+location /$proxy_location {
+    include ldap.conf;
+    rewrite_log on;
+    rewrite /$proxy_location/(.*) /$1 break;
+    rewrite ^/$proxy_location$ /$proxy_location/ permanent;
+    include proxy.conf;
+    proxy_buffering off;
+    proxy_pass http://$proxy_host:$proxy_port;
+}

snippets/ldap.conf

@@ -0,0 +1,2 @@
+auth_ldap "FET Login";
+auth_ldap_servers fet;

snippets/secure.conf

@@ -0,0 +1,10 @@
+
+add_header Content-Security-Policy "default-src 'none'; img-src 'self'; \
+    script-src 'self'; style-src 'self' 'unsafe-inline'; \
+    font-src 'self'; base-uri 'self'; form-action 'self';\
+     connect-src 'self'; frame-ancestors 'none'";
+add_header X-Content-Type-Options nosniff;
+add_header X-Frame-Options DENY;
+add_header X-XSS-Protection "1; mode=block" always;
+add_header Referrer-Policy "strict-origin";
+add_header Strict-Transport-Security "max-age=31536000" always;

snippets/ssl.conf

@@ -0,0 +1,16 @@
+ssl_certificate_by_lua_block {
+      auto_ssl:ssl_certificate()
+}
+
+    # You must still define a static ssl_certificate file for nginx to start.
+    #
+    # You may generate a self-signed fallback with:
+    #
+    # openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 \
+    #   -subj '/CN=sni-support-required-for-valid-ssl' \
+    #   -keyout /etc/ssl/resty-auto-ssl-fallback.key \
+    #   -out /etc/ssl/resty-auto-ssl-fallback.crt
+ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
+ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
+ssl_protocols TLSv1.2 TLSv1.3;
+add_header Strict-Transport-Security "max-age=31536000" always;