diff --git a/ansible/roles/ooni-backend/templates/nginx-api-fsn.conf b/ansible/roles/ooni-backend/templates/nginx-api-fsn.conf index 9d6e1451..e288edef 100644 --- a/ansible/roles/ooni-backend/templates/nginx-api-fsn.conf +++ b/ansible/roles/ooni-backend/templates/nginx-api-fsn.conf @@ -5,6 +5,14 @@ proxy_cache_path /var/cache/nginx/ooni-api levels=1:2 keys_zone=apicache:100M max_size=5g inactive=24h use_temp_path=off; +# Trust getting real-ip from X-Forwarded-For when the addresses are AWS IPs +# see: https://serverfault.com/a/414166 +set_real_ip_from 10.0.0.0/16; +set_real_ip_from 18.0.0.0/8; +set_real_ip_from 3.0.0.0/8; +real_ip_header X-Forwarded-For; +real_ip_recursive on; + # anonymize ipaddr map $remote_addr $remote_addr_anon { ~(?P\d+\.\d+\.\d+)\. $ip.0; @@ -19,11 +27,15 @@ map $http_x_forwarded_for $remote_fwd_anon { default 0.0.0.0; } - # log anonymized ipaddr and caching status log_format ooni_api_fmt '$remote_addr_anon $remote_fwd_anon $upstream_cache_status [$time_local] ' '"$request" $status snt:$body_bytes_sent rt:$request_time uprt:$upstream_response_time "$http_referer" "$http_user_agent"'; +log_format netdata '$remote_addr_anon - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '$request_length $request_time $upstream_response_time ' + '"$http_referer" "$http_user_agent"'; + server { # TODO(bassosimone): we need support for cleartext HTTP to make sure that requests # over Tor correctly land to the proper backend. We are listening on this custom port @@ -34,6 +46,8 @@ server { listen [::]:443 ssl http2 default_server; server_name _; access_log syslog:server=unix:/dev/log,tag=ooniapi,severity=info ooni_api_fmt; + access_log /var/log/nginx/access.log netdata; + error_log syslog:server=unix:/dev/log,tag=ooniapi,severity=info; gzip on; gzip_types text/plain application/xml application/json; @@ -42,9 +56,9 @@ server { # and everyhing else client_max_body_size 200M; # for measurement POST - ssl_certificate {{ certpath }}{{ inventory_hostname }}/fullchain.pem; - ssl_certificate_key {{ certpath }}{{ inventory_hostname }}/privkey.pem; - ssl_trusted_certificate {{ certpath }}{{ inventory_hostname }}/chain.pem; # for ssl_stapling_verify + ssl_certificate /var/lib/dehydrated/certs/backend-fsn.ooni.org/fullchain.pem; + ssl_certificate_key /var/lib/dehydrated/certs/backend-fsn.ooni.org/privkey.pem; + ssl_trusted_certificate /var/lib/dehydrated/certs/backend-fsn.ooni.org/chain.pem; # for ssl_stapling_verify # Use the intermediate configuration to support legacy probes # https://ssl-config.mozilla.org/#server=nginx&version=1.14.2&config=intermediate&openssl=1.1.1d&guideline=5.6 @@ -69,6 +83,24 @@ server { resolver 127.0.0.1; + set $external_remote_addr $remote_addr; + #if ($remote_addr = "188.166.93.143") { + # # If remote_addr is ams-pg-test trust the X-Real-IP header + # set $external_remote_addr $http_x_real_ip; + #} + #if ($remote_addr = "142.93.237.101") { + # # If remote_addr is ams-pg trust the X-Real-IP header + # set $external_remote_addr $http_x_real_ip; + #} + #if ($remote_addr ~ "^3.") { + # # If remote_addr is AWS trust the X-Real-IP header + # set $external_remote_addr $http_x_real_ip; + #} + #if ($remote_addr ~ "^18.") { + # # If remote_addr is AWS trust the X-Real-IP header + # set $external_remote_addr $http_x_real_ip; + #} + # Registry # Should match: # - /api/v1/login @@ -77,19 +109,21 @@ server { location ~^/api/v1/(login|register|update) { proxy_http_version 1.1; proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Real-IP $external_remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 900; - proxy_pass https://registry.ooni.io:443; + proxy_pass https://ooniprobe.prod.ooni.io:443; } # Selectively route test-list/urls to the API - location ~^/api/v1/test-list/urls { + # location ~^/api/v1/test-list/urls { + location ~^/api/v1/(test-list|urls) { proxy_pass http://127.0.0.1:8000; proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Real-IP $external_remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_cache apicache; proxy_cache_min_uses 1; proxy_cache_lock on; @@ -108,24 +142,37 @@ server { add_header X-Content-Type-Options nosniff always; } - # Orchestrate - # Should match: - # - /api/v1/test-list - location ~^/api/v1/(test-list|urls) { + # reverse proxy incidents + location ~^/api/v1/incidents { proxy_http_version 1.1; proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Real-IP $external_remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 900; - proxy_pass https://orchestrate.ooni.io:443; - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - add_header X-Frame-Options DENY always; - add_header X-Content-Type-Options nosniff always; - + proxy_pass https://oonifindings.prod.ooni.io:443; } + # Orchestrate + # NOTE: we are now serving this from the ooniapi monolith + # Should match: + # - /api/v1/test-list + # location ~^/api/v1/(test-list|urls) { + # proxy_http_version 1.1; + # proxy_set_header Host $http_host; + # proxy_set_header X-Real-IP $external_remote_addr; + # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + # proxy_set_header X-Forwarded-Proto $scheme; + # proxy_read_timeout 900; + + # proxy_pass https://orchestrate.ooni.io:443; + # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + # add_header X-Frame-Options DENY always; + # add_header X-Content-Type-Options nosniff always; + + # } + # Web Connectivity Test Helper # Should match: # - / @@ -139,19 +186,20 @@ server { location ~^/web-connectivity/(status) { proxy_http_version 1.1; proxy_set_header Host $http_host; - proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Real-IP $external_remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 900; - proxy_pass https://wcth.ooni.io; + proxy_pass https://0.th.ooni.org; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Frame-Options DENY always; add_header X-Content-Type-Options nosniff always; + add_header Host "0.th.ooni.org"; } location /whoami { - return 200 "{{ inventory_hostname }}"; + return 200 "backend-fsn.ooni.org"; } location /metrics { @@ -169,7 +217,7 @@ server { rewrite ^/netdata/badge /api/v1/badge.svg break; proxy_pass http://127.0.0.1:19999; proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Real-IP $external_remote_addr; } # Expose package version badges @@ -209,15 +257,6 @@ server { proxy_pass https://0.th.ooni.org; } - set $external_remote_addr $remote_addr; - if ($remote_addr = "188.166.93.143") { - # If remote_addr is ams-pg-test trust the X-Real-IP header - set $external_remote_addr $http_x_real_ip; - } - if ($remote_addr = "142.93.237.101") { - # If remote_addr is ams-pg trust the X-Real-IP header - set $external_remote_addr $http_x_real_ip; - } proxy_set_header X-Real-IP $external_remote_addr; proxy_cache apicache;