C12

docker-compose.yml

@@ -6,13 +6,16 @@ services:
     container_name: workshop-proxy
     depends_on:
       - backend-a
+      - backend-a2
       - backend-b
       - backend-c
     ports:
       - "8080:80"
+      - "8443:443"
     volumes:
       - ./proxy/nginx.conf:/etc/nginx/nginx.conf:ro,z
       - ./proxy/html:/usr/share/nginx/html:ro,z
+      - ./certs/live:/etc/nginx/certs:ro,z
 
   backend-a:
     image: nginx:1.27-alpine
@@ -20,6 +23,12 @@ services:
     volumes:
       - ./backends/a:/usr/share/nginx/html:ro,z
 
+  backend-a2:
+    image: nginx:1.27-alpine
+    container_name: workshop-backend-a2
+    volumes:
+      - ./backends/a2:/usr/share/nginx/html:ro,z
+
   backend-b:
     image: nginx:1.27-alpine
     container_name: workshop-backend-b

proxy/nginx.broken.conf

@@ -8,8 +8,8 @@ http {
   sendfile on;
   server_tokens off;
 
-  upstream backend_a_typo {
+  upstream backend_a {
-    server backend-a:8080;
+    server backend-a:80;
   }
 
   upstream backend_b {
@@ -33,7 +33,7 @@ http {
     }
 
     location /service/b {
-      proxy_pass http://backend_b;
+      proxy_pass http://backend_b/;
       proxy_set_header Host $host;
       proxy_set_header X-Forwarded-Proto http;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy/nginx.conf

@@ -8,8 +8,15 @@ http {
   sendfile on;
   server_tokens off;
 
+  log_format workshop '$remote_addr - $request '
+                      'status=$status upstream=$upstream_addr '
+                      'rt=$request_time urt=$upstream_response_time';
+
+  access_log /var/log/nginx/access.log workshop;  
+
   upstream backend_a {
     server backend-a:80;
+    server backend-a2:80;
   }
 
   upstream backend_b {
@@ -24,35 +31,73 @@ http {
     listen 80;
     server_name _;
 
+    location / {
+      return 301 https://$host:8443$request_uri;
+    }
+
+     location = /healthz {
+      default_type text/plain;
+      return 200 "ok\n";
+    }
+
+    location = /internal/status {
+      access_log off;
+      default_type text/plain;
+
+      if ($remote_addr != 127.0.0.1) {
+        return 403;
+      }
+      
+      return 200 "internal ok\n";
+    }
+  }
+
+  server {
+    listen 443 ssl;
+    server_name localhost;
+    ssl_certificate /etc/nginx/certs/localhost.crt;
+    ssl_certificate_key /etc/nginx/certs/localhost.key;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+    add_header Strict-Transport-Security "max-age=3600; includeSubDomains" always;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+
     location / {
       root /usr/share/nginx/html;
       try_files $uri $uri/ /index.html;
     }
 
-    location /service/a {
+    location = /service/a {
       proxy_pass http://backend_a/;
       proxy_set_header Host $host;
       proxy_set_header X-Forwarded-Proto http;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_hide_header ETag;
     }
 
-    location /service/b {
+    location = /demo/a {
+      proxy_pass http://backend_a/;
+    }
+
+    location = /service/b {
       proxy_pass http://backend_b/;
       proxy_set_header Host $host;
       proxy_set_header X-Forwarded-Proto http;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
 
-    location /service/c {
+    location = /service/c {
       proxy_pass http://backend_c/;
       proxy_set_header Host $host;
       proxy_set_header X-Forwarded-Proto http;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
-
-    location = /healthz {
-      default_type text/plain;
-      return 200 "ok\n";
-    }
   }
 }

proxy/nginx.conf.bak

@@ -0,0 +1,88 @@
+events {
+  worker_connections 1024;
+}
+
+http {
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+  sendfile on;
+  server_tokens off;
+
+  log_format workshop '$remote_addr - $request '
+                      'status=$status upstream=$upstream_addr '
+                      'rt=$request_time urt=$upstream_response_time';
+
+  access_log /var/log/nginx/access.log workshop;  
+
+  upstream backend_a {
+    server backend-a:80;
+    server backend-a2:80;
+  }
+
+  upstream backend_b {
+    server backend-b:80;
+  }
+
+  upstream backend_c {
+    server backend-c:80;
+  }
+
+  server {
+    listen 80;
+    server_name _;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+    add_header Cross-Origin-Opener-Policy "same-origin" always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+
+    location / {
+      root /usr/share/nginx/html;
+      try_files $uri $uri/ /index.html;
+    }
+
+    location = /service/a {
+      proxy_pass http://backend_a/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-Proto http;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_hide_header ETag;
+    }
+
+    location = /demo/a {
+      proxy_pass http://backend_a/;
+    }
+
+    location = /service/b {
+      proxy_pass http://backend_b/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-Proto http;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    location = /service/c {
+      proxy_pass http://backend_c/;
+      proxy_set_header Host $host;
+      proxy_set_header X-Forwarded-Proto http;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    location = /healthz {
+      default_type text/plain;
+      return 200 "ok\n";
+    }
+
+    location = /internal/status {
+      access_log off;
+      default_type text/plain;
+
+      if ($remote_addr != 127.0.0.1) {
+        return 403;
+      }
+      
+      return 200 "internal ok\n";
+    }
+  }
+}