eletrotupi / tcc/ commit / cb9679c

deploy/nginx: serve the logs UI at /logs behind basic auth

VictoriaLogs has no auth of its own, so reaching vmui without a tunnel
needs a front door. The vhost proxies /logs to the loopback VictoriaLogs
under its path prefix, requires a basic-auth credential, and the nginx
role provisions the htpasswd file so the block always loads
Pedro Lucas Porcellis porcellis@eletrotupi.com · 14 days ago cb9679c266556ca42899ace6162ef176d8a43ff4 Browse files
Parents c26ff2e
Changed files
3
Additions
+33
Deletions
0
ansible/roles/nginx/defaults/main.yml modified+8
ansible/roles/nginx/defaults/main.yml
1 1 
---
2 2 
# roles/nginx/defaults/main.yml
3 3
4 4 
nginx_conf_dir: /etc/nginx/http.d          # Alpine nginx include dir
5 5 
nginx_well_known_root: /var/www            # served for ACME HTTP-01 challenges
6 6 
nginx_static_root: /srv/static             # thesis PDF lives here
7 7 
nginx_proxy_pass: http://127.0.0.1:3000    # the api container
8 8 
nginx_cert_dir: /etc/ssl/uacme
9 9 
nginx_acme_wrapper: /usr/local/bin/acme-update-certs
10 +
11 + 
# VictoriaLogs UI (vmui), proxied at https://<host>/logs/ behind basic auth
12 + 
# Must match -http.pathPrefix on the victorialogs service
13 + 
nginx_logs_proxy_pass: http://127.0.0.1:9428
14 + 
nginx_logs_htpasswd_file: /etc/nginx/.htpasswd-logs
15 + 
# CHANGE ME: a "user:hash" line, e.g. from `openssl passwd -apr1`
16 + 
# The default is the throwaway "logs" user with password "nexo-logs"
17 + 
nginx_logs_htpasswd: "logs:$apr1$Bb2qaSgH$TUfwUmDTRR/FpOLRu.Jnj/"
ansible/roles/nginx/tasks/main.yml modified+10
ansible/roles/nginx/tasks/main.yml
1 1 
---
2 2 
# roles/nginx/tasks/main.yml
3 3 
# Publishes the vhost, two-phase around the ACME certificate
4 4 
#
5 5 
#   deploy.yml (this role) will HTTP-only block, then obtain cert via the wrapper then
44 44 
    name: nginx
45 45 
    enabled: true
46 46 
    state: started
47 47 
  tags: [nginx]
48 48
49 + 
- name: Install the logs UI htpasswd file
50 + 
  ansible.builtin.copy:
51 + 
    dest: "{{ nginx_logs_htpasswd_file }}"
52 + 
    content: "{{ nginx_logs_htpasswd }}\n"
53 + 
    owner: root
54 + 
    group: root
55 + 
    mode: "0640"
56 + 
  notify: reload nginx
57 + 
  tags: [nginx]
58 +
49 59 
- name: Check whether the certificate exists
50 60 
  ansible.builtin.stat:
51 61 
    path: "{{ nginx_cert_dir }}/{{ vhosts[0] }}/cert.pem"
52 62 
  register: nginx_cert
53 63 
  tags: [nginx]
97 107 
      run this once by hand and then re-run deploy.yml:
98 108
99 109 
        doas -u acme uacme -v -h /usr/share/uacme/uacme.sh new {{ vhosts[0] }}
100 110 
  when: not nginx_cert_after.stat.exists
101 111 
  tags: [nginx]
ansible/roles/nginx/templates/site.https.j2 modified+15
ansible/roles/nginx/templates/site.https.j2
1 1 
server {
2 2 
    listen 80;
3 3 
    server_name {{ vhosts[0] }};
4 4
5 5 
    location ^~ /.well-known {
29 29 
        alias {{ nginx_static_root }}/monografia.pdf;
30 30 
        add_header Content-Type application/pdf;
31 31 
        add_header Content-Disposition "inline";
32 32 
    }
33 33
34 + 
    location = /logs {
35 + 
        return 302 /logs/select/vmui/;
36 + 
    }
37 +
38 + 
    location /logs/ {
39 + 
        auth_basic "nexo logs";
40 + 
        auth_basic_user_file {{ nginx_logs_htpasswd_file }};
41 +
42 + 
        proxy_pass {{ nginx_logs_proxy_pass }};
43 + 
        proxy_set_header Host $host;
44 + 
        proxy_set_header X-Real-IP $remote_addr;
45 + 
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
46 + 
        proxy_set_header X-Forwarded-Proto $scheme;
47 + 
    }
48 +
34 49 
    location / {
35 50 
        proxy_pass {{ nginx_proxy_pass }};
36 51 
        proxy_set_header Host $host;
37 52 
        proxy_set_header X-Real-IP $remote_addr;
38 53 
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
42 57
43 58 
    location ^~ /.well-known {
44 59 
        root /var/www;
45 60 
    }
46 61 
}