feat(router): PROXY protocol support

Author: johanneswuerbach

router/image/templates/deis.conf

@@ -1,9 +1,9 @@
 server_name_in_redirect off;
 port_in_redirect off;
-listen 80;
+listen 80{{ if .deis_router_proxyProtocol }} proxy_protocol{{ end }};
 
 {{ if .deis_router_sslCert }}
-listen 443 ssl spdy;
+listen 443 ssl spdy{{ if .deis_router_proxyProtocol }} proxy_protocol{{ end }};
 ssl_certificate /etc/ssl/deis.cert;
 ssl_certificate_key /etc/ssl/deis.key;
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

router/image/templates/nginx.conf

@@ -47,7 +47,12 @@ http {
 
     client_max_body_size {{ or (.deis_router_bodySize) "1m" }};
 
-    log_format upstreaminfo '[$time_local] - $remote_addr - $remote_user - $status - "$request" - $bytes_sent - "$http_referer" - "$http_user_agent" - "$server_name" - $upstream_addr - $http_host - $upstream_response_time - $request_time';
+    {{ $useProxyProtocol := or (.deis_router_proxyProtocol) "false" }}{{ if ne $useProxyProtocol "false" }}
+    set_real_ip_from {{ or (.deis_router_proxyRealIpCidr) "10.0.0.0/8" }};
+    real_ip_header proxy_protocol;
+    {{ end }}
+
+    log_format upstreaminfo '[$time_local] - {{ if .deis_router_proxyProtocol }}$proxy_protocol_addr{{ else }}$remote_addr{{ end }} - $remote_user - $status - "$request" - $bytes_sent - "$http_referer" - "$http_user_agent" - "$server_name" - $upstream_addr - $http_host - $upstream_response_time - $request_time';
 
     # send logs to STDOUT so they can be seen using 'docker logs'
     access_log /opt/nginx/logs/access.log upstreaminfo;
@@ -82,7 +87,11 @@ http {
             {{ if eq $useFirewall "true" }}include                     /opt/nginx/firewall/active-mode.rules;{{ end }}
             proxy_buffering             off;
             proxy_set_header            Host $host;
+            {{ if ne $useProxyProtocol "false" }}
+            proxy_set_header            X-Forwarded-For $proxy_protocol_addr;
+            {{ else }}
             proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
+            {{ end }}
             proxy_redirect              off;
             proxy_connect_timeout       {{ or (.deis_router_controller_timeout_connect) "10s" }};
             proxy_send_timeout          {{ or (.deis_router_controller_timeout_send) "20m" }};
@@ -126,7 +135,11 @@ http {
             {{ if eq $useFirewall "true" }}include                     /opt/nginx/firewall/active-mode.rules;{{ end }}
             proxy_buffering             off;
             proxy_set_header            Host $host;
+            {{ if ne $useProxyProtocol "false" }}
+            proxy_set_header            X-Forwarded-For $proxy_protocol_addr;
+            {{ else }}
             proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
+            {{ end }}
             proxy_redirect              off;
             proxy_connect_timeout       10s;
             proxy_send_timeout          {{ $defaultTimeout }}s;
@@ -168,8 +181,8 @@ http {
         {{ if index $root (printf "deis_certs_%s_cert" (Replace (Base $domain.Key) "-" "_" -1)) }}
         server_name_in_redirect off;
         port_in_redirect off;
-        listen 80;
-        listen 443 ssl spdy;
+        listen 80{{ if ne $useProxyProtocol "false" }} proxy_protocol{{ end }};
+        listen 443 ssl spdy{{ if ne $useProxyProtocol "false" }} proxy_protocol{{ end }};
         ssl_certificate /etc/ssl/deis/certs/{{ Base $domain.Key }}.cert;
         ssl_certificate_key /etc/ssl/deis/keys/{{ Base $domain.Key }}.key;
         ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
@@ -194,7 +207,11 @@ http {
             }
             proxy_set_header            X-Forwarded-Port  $access_port;
             proxy_set_header            X-Forwarded-Proto $access_scheme;
+            {{ if ne $useProxyProtocol "false" }}
+            proxy_set_header            X-Forwarded-For   $proxy_protocol_addr;
+            {{ else }}
             proxy_set_header            X-Forwarded-For   $proxy_add_x_forwarded_for;
+            {{ end }}
             proxy_set_header            X-Forwarded-Ssl   $access_ssl;
             proxy_redirect              off;
             proxy_connect_timeout       30s;
@@ -244,7 +261,11 @@ http {
             }
             proxy_set_header            X-Forwarded-Port  $access_port;
             proxy_set_header            X-Forwarded-Proto $access_scheme;
+            {{ if ne $useProxyProtocol "false" }}
+            proxy_set_header            X-Forwarded-For   $proxy_protocol_addr;
+            {{ else }}
             proxy_set_header            X-Forwarded-For   $proxy_add_x_forwarded_for;
+            {{ end }}
             proxy_set_header            X-Forwarded-Ssl   $access_ssl;
             proxy_redirect              off;
             proxy_connect_timeout       30s;
@@ -278,7 +299,7 @@ http {
 
     # healthcheck
     server {
-        listen 80 default_server;
+        listen 80 default_server{{ if .deis_router_proxyProtocol }} proxy_protocol{{ end }};
         location /health-check {
             default_type 'text/plain';
             access_log off;