copilot/nginx/etc/nginx/nginx.conf.ctmpl

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    map $status $isError {
        ~^2 0;
        default 1;
    }

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log         /var/log/nginx/access.log  main;
    sendfile           on;
    keepalive_timeout  65;

    # Environment variables that are provided to us at the time our Nginx 
    # config is generated from this template
    {{ $acme_domain := env "ACME_DOMAIN" }} # Domain that we're requesting certs for if set
    {{ $ssl_ready := env "SSL_READY" }}     # true if certs have been written to disk

    {{ if service "joyent-portal-ui" }}
    upstream joyent-portal-ui {
        # write the address:port pairs for each healthy joyent-portal-ui node
        {{range service "joyent-portal-ui"}}
        server {{.Address}}:{{.Port}};
        {{end}}
        least_conn;
    }{{ end }}

    # If we're listening on https, define an http listener that redirects everything to https
    {{ if eq $ssl_ready "true" }}
    server { 
        server_name _;
        listen      80;

        # Respond to health requests defined in containerpilot.json
        location /nginx-health {
            stub_status;
            allow 127.0.0.1;
            deny all;
            # Don't log these requests unless they fail
            access_log /var/log/nginx/access.log  main if=$isError;
        }

        location / {
            return 301 https://$host$request_uri;
        }
    }
    {{ end }}

    server {
        server_name _;
        # Listen on port 80 unless we have certificates installed, then listen on 443
        listen {{ if ne $ssl_ready "true" }}80{{ else }}443 ssl{{ end }};
        {{ if eq $ssl_ready "true" }}
        ssl_certificate /var/www/ssl/fullchain.pem;
        ssl_certificate_key /var/www/ssl/privkey.pem;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;
        {{ end }}

        {{ if service "joyent-portal-ui" }}
        location ^~ / {
            proxy_pass http://joyent-portal-ui;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_redirect off;
        }
        {{end}}

        # Respond to health requests defined in containerpilot.json
        location /nginx-health {
            stub_status;
            allow 127.0.0.1;
            deny all;
            # Don't log these requests unless they fail
            access_log /var/log/nginx/access.log  main if=$isError;
        }

        # Respond to ACME certificate request challenges
        location /.well-known/acme-challenge {
            alias /var/www/acme/challenge;
        }
    }
}