blob: 89e575af54baf37940287b734087033ec9570e11 [file] [log] [blame]
causten508f7b52017-09-26 11:08:47 -05001
2user www-data;
3worker_processes 1;
4
5error_log stderr;
6
7pid /run/nginx/nginx.pid;
8
9
10# Nginx requires this section, even if no options
11events {
12}
13
14# Note that a lot of these settings come from the OWASP Secure
15# Configuration guide for nginx
16# https://www.owasp.org/index.php/SCG_WS_nginx
Andrew Geisslerf3fee442018-05-31 07:02:43 -070017# and the mozilla security guidelines
18# https://wiki.mozilla.org/Security/Server_Side_TLS
causten508f7b52017-09-26 11:08:47 -050019
20http {
21 include mime.types;
22
23 # For certain locations, only allow one connection per IP
24 limit_conn_zone $binary_remote_addr zone=addr:10m;
25
26 # Default log format
27 log_format main '$remote_addr - $remote_user [$time_local] "$request" '
28 '$status $body_bytes_sent "$http_referer" '
29 '"$http_user_agent" "$http_x_forwarded_for"';
30
31 # Comment out to enable access log in /var/log/nginx/
32 access_log off;
33
Andrew Geissler00786372018-05-15 07:08:55 -070034 client_body_timeout 30;
causten508f7b52017-09-26 11:08:47 -050035 client_header_timeout 10;
36 keepalive_timeout 5 5;
Andrew Geissler00786372018-05-15 07:08:55 -070037 send_timeout 30;
causten508f7b52017-09-26 11:08:47 -050038
39 # Do not return nginx version to clients
40 server_tokens off;
41
42 client_max_body_size 100k;
43 client_body_buffer_size 100K;
44 client_header_buffer_size 1k;
45 large_client_header_buffers 4 8k;
46
Chris Austenc0f03ac2017-09-29 18:30:03 -050047 # redirect all http traffic to https
causten508f7b52017-09-26 11:08:47 -050048 server {
Chris Austenc0f03ac2017-09-29 18:30:03 -050049 listen 80 default_server;
50 listen [::]:80 default_server;
51 server_name _;
52 return 301 https://$host$request_uri;
53 }
54
55 server {
56 listen 443 ssl;
causten508f7b52017-09-26 11:08:47 -050057 server_name 127.0.0.1;
58
59 ssl on;
60 ssl_certificate @CERTPATH@/cert.pem;
61 ssl_certificate_key @CERTPATH@/cert.pem;
62 ssl_session_timeout 5m;
63 ssl_protocols TLSv1.2;
Andrew Geisslerf3fee442018-05-31 07:02:43 -070064 ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256";
causten508f7b52017-09-26 11:08:47 -050065 ssl_prefer_server_ciphers on;
66
67 location / {
68 # Use 127.0.0.1 instead of localhost since nginx will
69 # first use ipv6 address of ::1 which the upstream server
70 # is not listening on. This generates an error msg to
71 # the journal. Nginx then uses the 127.0.0.1 and everything
72 # works fine but want to avoid the error msg to the log.
Chris Austenc0f03ac2017-09-29 18:30:03 -050073 proxy_pass http://127.0.0.1:8081/;
Andrew Geissleraca0a2e2018-04-10 10:44:14 -070074
75 # WebSocket support
76 proxy_http_version 1.1;
77 proxy_set_header Upgrade $http_upgrade;
78 proxy_set_header Connection "upgrade";
causten508f7b52017-09-26 11:08:47 -050079 }
80 location ~ (/org/openbmc/control/flash/bmc/action/update|/upload/image|/download/dump) {
Lei YU8344b232018-05-23 14:36:00 +080081 # Marked as 33MB to allow for firmware image updating and dump
causten508f7b52017-09-26 11:08:47 -050082 # downloads
Lei YU8344b232018-05-23 14:36:00 +080083 client_max_body_size 33M;
causten508f7b52017-09-26 11:08:47 -050084
85 # Only 1 connection at a time here from an IP
86 limit_conn addr 1;
87
Chris Austenc0f03ac2017-09-29 18:30:03 -050088 proxy_pass http://127.0.0.1:8081;
causten508f7b52017-09-26 11:08:47 -050089 }
Andrew Geisslerb86af8b2018-07-16 13:01:49 -070090 location /redfish {
91 proxy_pass http://127.0.0.1:8082;
92 proxy_http_version 1.1;
93 }
causten508f7b52017-09-26 11:08:47 -050094
95 include /etc/nginx/sites-enabled/443_*.conf;
96 }
97}