Add Nginx as a external facing reverse proxy
Ultimate goal is to allow anyone to add one or more http services.
Doing this still allows other groups to not be required to use
them
https://lists.ozlabs.org/pipermail/openbmc/2017-September/009231.html
Also note, this commit launches nginx on 8081. Once advice on
how to get it to launch I'll be moving it to 443 and gevent to
8081.
Initially this will only be used in the meta-ibm layer.
Signed-off-by: Chris Austen <austenc@us.ibm.com>
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I34b076898469f2fa9a0186ca3fb3abc77ae52fe7
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/gen-cert.sh b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/gen-cert.sh
new file mode 100644
index 0000000..480266f
--- /dev/null
+++ b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/gen-cert.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+PEM="/etc/ssl/certs/nginx/cert.pem"
+
+if [ ! -f $PEM ]; then
+ openssl req -x509 -sha256 -newkey rsa:2048 -keyout $PEM -out $PEM \
+ -days 3650 -subj "/O=openbmc-project.xyz/CN=localhost" \
+ -nodes
+fi
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf
new file mode 100644
index 0000000..516973c
--- /dev/null
+++ b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf
@@ -0,0 +1,79 @@
+
+user www-data;
+worker_processes 1;
+
+error_log stderr;
+
+pid /run/nginx/nginx.pid;
+
+
+# Nginx requires this section, even if no options
+events {
+}
+
+# Note that a lot of these settings come from the OWASP Secure
+# Configuration guide for nginx
+# https://www.owasp.org/index.php/SCG_WS_nginx
+
+http {
+ include mime.types;
+
+ # For certain locations, only allow one connection per IP
+ limit_conn_zone $binary_remote_addr zone=addr:10m;
+
+ # Default log format
+ log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+ '$status $body_bytes_sent "$http_referer" '
+ '"$http_user_agent" "$http_x_forwarded_for"';
+
+ # Comment out to enable access log in /var/log/nginx/
+ access_log off;
+
+ client_body_timeout 10;
+ client_header_timeout 10;
+ keepalive_timeout 5 5;
+ send_timeout 10;
+
+ # Do not return nginx version to clients
+ server_tokens off;
+
+ client_max_body_size 100k;
+ client_body_buffer_size 100K;
+ client_header_buffer_size 1k;
+ large_client_header_buffers 4 8k;
+
+ server {
+ listen 8081 ssl;
+ server_name 127.0.0.1;
+
+ ssl on;
+ ssl_certificate @CERTPATH@/cert.pem;
+ ssl_certificate_key @CERTPATH@/cert.pem;
+ ssl_session_timeout 5m;
+ ssl_protocols TLSv1.2;
+ ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@STRENGTH";
+
+ ssl_prefer_server_ciphers on;
+
+ location / {
+ # Use 127.0.0.1 instead of localhost since nginx will
+ # first use ipv6 address of ::1 which the upstream server
+ # is not listening on. This generates an error msg to
+ # the journal. Nginx then uses the 127.0.0.1 and everything
+ # works fine but want to avoid the error msg to the log.
+ proxy_pass https://127.0.0.1:443/;
+ }
+ location ~ (/org/openbmc/control/flash/bmc/action/update|/upload/image|/download/dump) {
+ # Marked as 32MB to allow for firmware image updating and dump
+ # downloads
+ client_max_body_size 32M;
+
+ # Only 1 connection at a time here from an IP
+ limit_conn addr 1;
+
+ proxy_pass https://127.0.0.1:443;
+ }
+
+ include /etc/nginx/sites-enabled/443_*.conf;
+ }
+}
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.service b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.service
new file mode 100644
index 0000000..5873491
--- /dev/null
+++ b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=The NGINX HTTP and reverse proxy server
+After=network.target
+
+[Service]
+Type=forking
+ExecStartPre=/usr/bin/env gen-cert.sh
+ExecStartPre=-/usr/bin/env mkdir /var/volatile/nginx/
+ExecStartPre=/usr/bin/env nginx -t -p /var/volatile/nginx
+ExecStart=/usr/bin/env nginx -p /var/volatile/nginx
+ExecReload=/usr/bin/env kill -s HUP $MAINPID
+ExecStop=/usr/bin/env kill -s QUIT $MAINPID
+PrivateTmp=true
+
+[Install]
+WantedBy={SYSTEMD_DEFAULT_TARGET}
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.socket b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.socket
new file mode 100644
index 0000000..24be604
--- /dev/null
+++ b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.socket
@@ -0,0 +1,8 @@
+[Unit]
+Description=Nginx
+
+[Socket]
+ListenStream=8081
+
+[Install]
+WantedBy=sockets.target
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/nginx_%.bbappend b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/nginx_%.bbappend
new file mode 100644
index 0000000..8a58341
--- /dev/null
+++ b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/nginx_%.bbappend
@@ -0,0 +1,33 @@
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+inherit systemd
+inherit obmc-phosphor-systemd
+
+SRC_URI += " \
+ file://nginx.conf \
+ file://nginx.service \
+ file://gen-cert.sh \
+ "
+
+EXTRA_OECONF =+ " --without-select_module"
+
+SSLCERTPATH = "/etc/ssl/certs/nginx/"
+
+
+do_install_append() {
+
+ install -m 644 ${WORKDIR}/nginx.conf ${D}${sysconfdir}/nginx
+ install -m 0755 ${WORKDIR}/gen-cert.sh ${D}${sbindir}/gen-cert.sh
+
+ install -d ${D}${SSLCERTPATH}
+ chown -R www:www-data ${D}${SSLCERTPATH}
+
+
+ echo SSLCERTPATH
+ echo ${SSLCERTPATH}
+ sed -i 's,@CERTPATH@,${SSLCERTPATH},g' ${D}${sysconfdir}/nginx/nginx.conf
+}
+
+FILES_${PN} += " ${SSLCERTPATH} "
+
+SYSTEMD_SERVICE_${PN} += " nginx.service"
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend
index b8927b9..7b61d8c 100644
--- a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend
+++ b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-phosphor/packagegroups/packagegroup-obmc-apps.bbappend
@@ -1 +1,2 @@
RDEPENDS_${PN}-logging += "ibm-logging"
+RDEPENDS_${PN}-extras += "nginx"