Skip to content

Commit ea0f066

Browse files
author
Matthew Fisher
committed
Merge pull request #2194 from bacongobbler/ssl_router
feat(router): add optional controller SSL support
2 parents 4851192 + 1f74eeb commit ea0f066

9 files changed

Lines changed: 48 additions & 12 deletions

File tree

‎deisctl/units/deis-router.service‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ EnvironmentFile=/etc/environment
66
TimeoutStartSec=20m
77
ExecStartPre=/bin/sh -c "IMAGE=`/run/deis/bin/get_image /deis/router` && docker history $IMAGE >/dev/null || docker pull $IMAGE"
88
ExecStartPre=/bin/sh -c "docker inspect deis-router >/dev/null && docker rm -f deis-router || true"
9-
ExecStart=/bin/sh -c "IMAGE=`/run/deis/bin/get_image /deis/router` && docker run --name deis-router --rm -p 80:80 -p 2222:2222 -e EXTERNAL_PORT=80 -e HOST=$COREOS_PRIVATE_IPV4 $IMAGE"
9+
ExecStart=/bin/sh -c "IMAGE=`/run/deis/bin/get_image /deis/router` && docker run --name deis-router --rm -p 80:80 -p 2222:2222 -p 443:443 -e EXTERNAL_PORT=80 -e HOST=$COREOS_PRIVATE_IPV4 $IMAGE"
1010
ExecStopPost=-/usr/bin/docker rm -f deis-router
1111
Restart=on-failure
1212
RestartSec=5

‎docs/managing_deis/router_settings.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ setting description
5555
/deis/router/gzipVary nginx gzipVary setting (default: on)
5656
/deis/router/gzipDisable nginx gzipDisable setting (default: "msie6")
5757
/deis/router/gzipTypes nginx gzipTypes setting (default: "application/x-javascript application/xhtml+xml application/xml application/xml+rss application/json text/css text/javascript text/plain text/xml")
58+
/deis/router/sslCert cluster-wide SSL certificate
59+
/deis/router/sslKey cluster-wide SSL private key
5860
/deis/services/* healthy application containers reported by deis/publisher
5961
/deis/store/gateway/host host of the store gateway component (set by store-gateway)
6062
/deis/store/gateway/port port of the store gateway component (set by store-gateway)

‎router/conf.d/deis.cert.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[template]
2+
src = "deis.cert"
3+
dest = "/etc/ssl/deis.cert"
4+
uid = 0
5+
gid = 0
6+
mode = "0644"
7+
keys = [
8+
"/deis/router",
9+
]

‎router/conf.d/deis.conf.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[template]
2+
src = "deis.conf"
3+
dest = "/opt/nginx/conf/deis.conf"
4+
uid = 0
5+
gid = 0
6+
mode = "0644"
7+
keys = [
8+
"/deis/router",
9+
]

‎router/conf.d/deis.key.toml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
[template]
2+
src = "deis.key"
3+
dest = "/etc/ssl/deis.key"
4+
uid = 0
5+
gid = 0
6+
mode = "0644"
7+
keys = [
8+
"/deis/router",
9+
]

‎router/templates/deis.cert‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{{ .deis_router_sslCert }}

‎router/templates/deis.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
server_name_in_redirect off;
2+
port_in_redirect off;
3+
4+
{{ if .deis_router_sslCert }}
5+
listen 443 ssl spdy;
6+
ssl_certificate /etc/ssl/deis.cert;
7+
ssl_certificate_key /etc/ssl/deis.key;
8+
{{ end }}

‎router/templates/deis.key‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{{ .deis_router_sslKey }}

‎router/templates/nginx.conf‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,7 @@ http {
5050

5151
server {
5252
server_name ~^deis\.(?<domain>.+)$;
53-
server_name_in_redirect off;
54-
port_in_redirect off;
53+
include deis.conf;
5554

5655
location / {
5756
proxy_buffering off;
@@ -75,8 +74,7 @@ http {
7574

7675
server {
7776
server_name ~^deis-store\.(?<domain>.+)$;
78-
server_name_in_redirect off;
79-
port_in_redirect off;
77+
include deis.conf;
8078

8179
location / {
8280
proxy_buffering off;
@@ -101,25 +99,24 @@ http {
10199

102100
server {
103101
server_name ~^{{ Base $service.Key }}\.(?<domain>.+)${{ range $app_domains := $domains }}{{ if eq (Base $service.Key) (Base $app_domains.Key) }} {{ $app_domains.Value }}{{ end }}{{ end }};
104-
105-
server_name_in_redirect off;
106-
port_in_redirect off;
102+
include deis.conf;
107103

108104
location / {
109105
proxy_buffering off;
110106
proxy_set_header Host $host;
111-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
107+
proxy_set_header X-Forwarded-Proto $scheme;
108+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
112109
proxy_redirect off;
113110
proxy_connect_timeout 10s;
114111
proxy_send_timeout 1200s;
115112
proxy_read_timeout 1200s;
116113
proxy_http_version 1.1;
117-
proxy_set_header Upgrade $http_upgrade;
118-
proxy_set_header Connection $connection_upgrade;
114+
proxy_set_header Upgrade $http_upgrade;
115+
proxy_set_header Connection $connection_upgrade;
119116

120117
proxy_next_upstream error timeout http_502 http_503 http_504;
121118

122-
add_header X-Deis-Upstream $upstream_addr;
119+
add_header X-Deis-Upstream $upstream_addr;
123120

124121
proxy_pass http://{{ Base $service.Key }};
125122
}

0 commit comments

Comments
 (0)