summaryrefslogtreecommitdiff
path: root/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf
diff options
context:
space:
mode:
authorDave Cobbley <david.j.cobbley@linux.intel.com>2018-08-23 04:40:54 +0300
committerBrad Bishop <bradleyb@fuzziesquirrel.com>2018-08-23 19:39:42 +0300
commit194ff4f1f5d44b12e9cb06ddafa6adb20174a13c (patch)
tree823835cd29daf8901a31ac14c7e6534abf199be3 /meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf
parent4feb727cd6b77a68bdaca63e121b378d814f5eaf (diff)
downloadopenbmc-194ff4f1f5d44b12e9cb06ddafa6adb20174a13c.tar.xz
[Subtree] Bring openbmc machines to top level
The new subtree model brings the subtrees up from the openbmc-machines layer. Change-Id: I58a03ae1be374bc79ae1438e65e888375d12d0c0 Signed-off-by: Dave Cobbley <david.j.cobbley@linux.intel.com> Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Diffstat (limited to 'meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf')
-rw-r--r--meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf114
1 files changed, 0 insertions, 114 deletions
diff --git a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf b/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf
deleted file mode 100644
index 7d65183ec..000000000
--- a/meta-openbmc-machines/meta-openpower/meta-ibm/recipes-httpd/nginx/files/nginx.conf
+++ /dev/null
@@ -1,114 +0,0 @@
-
-user www-data;
-worker_processes 1;
-
-error_log stderr;
-
-pid /run/nginx/nginx.pid;
-
-
-# Nginx requires this section, even if no options
-events {
-}
-
-# Note that a lot of these settings come from the OWASP Secure
-# Configuration guide for nginx
-# https://www.owasp.org/index.php/SCG_WS_nginx
-# and the mozilla security guidelines
-# https://wiki.mozilla.org/Security/Server_Side_TLS
-
-http {
- include mime.types;
-
- # For certain locations, only allow one connection per IP
- limit_conn_zone $binary_remote_addr zone=addr:10m;
-
- # Default log format
- log_format main '$remote_addr - $remote_user [$time_local] "$request" '
- '$status $body_bytes_sent "$http_referer" '
- '"$http_user_agent" "$http_x_forwarded_for"';
-
- # Comment out to enable access log in /var/log/nginx/
- access_log off;
-
- client_body_timeout 30;
- client_header_timeout 10;
- keepalive_timeout 5 5;
- send_timeout 30;
-
- # Do not return nginx version to clients
- server_tokens off;
-
- client_max_body_size 100k;
- client_body_buffer_size 100K;
- client_header_buffer_size 1k;
- large_client_header_buffers 4 8k;
-
- # redirect all http traffic to https
- server {
- listen 80 default_server;
- listen [::]:80 default_server;
- server_name _;
- return 301 https://$host$request_uri;
- }
-
- server {
- listen 443 ssl;
- server_name 127.0.0.1;
-
- ssl on;
- ssl_certificate @CERTPATH@/cert.pem;
- ssl_certificate_key @CERTPATH@/cert.pem;
- ssl_session_timeout 5m;
- ssl_protocols TLSv1.2;
- ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256";
- ssl_prefer_server_ciphers on;
-
- location / {
- # This location lets us serve the static pre-compressed webui
- # content (rooted at /usr/share/www). Also if the URI points to
- # something else (that is unmatched by other locations), we
- # fallback to the rest server. This approach is based on the
- # guide at https://docs.nginx.com/nginx/admin-guide/web-server/serving-static-content.
- root /usr/share/www;
- # For clients that support gzip encoding, serve them
- # pre-compressed gzip content. For clients that don't,
- # uncompress on the BMC. The module gunzip requires
- # gzip_static to be set to 'always'; gzip_static is the
- # module that serves compressed content for clients that
- # support gzip.
- gunzip on;
- gzip_static always;
- try_files $uri $uri/ @rest_server;
- }
- location @rest_server {
- # Use 127.0.0.1 instead of localhost since nginx will
- # first use ipv6 address of ::1 which the upstream server
- # is not listening on. This generates an error msg to
- # the journal. Nginx then uses the 127.0.0.1 and everything
- # works fine but want to avoid the error msg to the log.
- proxy_pass http://127.0.0.1:8081;
-
- # WebSocket support
- proxy_http_version 1.1;
- proxy_set_header Upgrade $http_upgrade;
- proxy_set_header Connection "upgrade";
- }
- location ~ (/org/openbmc/control/flash/bmc/action/update|/upload/image|/download/dump) {
- # Marked as 33MB to allow for firmware image updating and dump
- # downloads
- client_max_body_size 33M;
-
- # Only 1 connection at a time here from an IP
- limit_conn addr 1;
-
- proxy_pass http://127.0.0.1:8081;
- }
- location /redfish {
- proxy_pass http://127.0.0.1:8082;
- proxy_http_version 1.1;
- }
-
- include /etc/nginx/sites-enabled/443_*.conf;
- }
-}