Skip to content

refactor: disable orchestrate and point to new ooniprobe ecs service #524

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DecFox wants to merge 6 commits into
base: master
Choose a base branch
from
Open

refactor: disable orchestrate and point to new ooniprobe ecs service #524

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4d29c86
refactor: disable orchestrate and point to new ooniprobe ecs service
DecFox Feb 19, 2025
35436f9
refactor: sync nginx conf with current backend-fsn
DecFox Feb 20, 2025
6915fca
Update nginx-api-fsn.conf
hellais Mar 17, 2025
3e5284e
Update nginx-api-fsn.conf
hellais Mar 17, 2025
c221ca3
Update nginx-api-fsn.conf
hellais Mar 17, 2025
58e6a4d
Add incidents reverse proxy
hellais May 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
101 changes: 70 additions & 31 deletions ansible/roles/ooni-backend/templates/nginx-api-fsn.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@
proxy_cache_path /var/cache/nginx/ooni-api levels=1:2 keys_zone=apicache:100M
max_size=5g inactive=24h use_temp_path=off;

# Trust getting real-ip from X-Forwarded-For when the addresses are AWS IPs
# see: https://serverfault.com/a/414166
set_real_ip_from 10.0.0.0/16;
set_real_ip_from 18.0.0.0/8;
set_real_ip_from 3.0.0.0/8;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

# anonymize ipaddr
map $remote_addr $remote_addr_anon {
~(?P<ip>\d+\.\d+\.\d+)\. $ip.0;
Expand All @@ -19,11 +27,15 @@ map $http_x_forwarded_for $remote_fwd_anon {
default 0.0.0.0;
}


# log anonymized ipaddr and caching status
log_format ooni_api_fmt '$remote_addr_anon $remote_fwd_anon $upstream_cache_status [$time_local] '
'"$request" $status snt:$body_bytes_sent rt:$request_time uprt:$upstream_response_time "$http_referer" "$http_user_agent"';

log_format netdata '$remote_addr_anon - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'$request_length $request_time $upstream_response_time '
'"$http_referer" "$http_user_agent"';

server {
# TODO(bassosimone): we need support for cleartext HTTP to make sure that requests
# over Tor correctly land to the proper backend. We are listening on this custom port
Expand All @@ -34,6 +46,8 @@ server {
listen [::]:443 ssl http2 default_server;
server_name _;
access_log syslog:server=unix:/dev/log,tag=ooniapi,severity=info ooni_api_fmt;
access_log /var/log/nginx/access.log netdata;

error_log syslog:server=unix:/dev/log,tag=ooniapi,severity=info;
gzip on;
gzip_types text/plain application/xml application/json;
Expand All @@ -42,9 +56,9 @@ server {
# and everyhing else
client_max_body_size 200M; # for measurement POST

ssl_certificate {{ certpath }}{{ inventory_hostname }}/fullchain.pem;
ssl_certificate_key {{ certpath }}{{ inventory_hostname }}/privkey.pem;
ssl_trusted_certificate {{ certpath }}{{ inventory_hostname }}/chain.pem; # for ssl_stapling_verify
ssl_certificate /var/lib/dehydrated/certs/backend-fsn.ooni.org/fullchain.pem;
ssl_certificate_key /var/lib/dehydrated/certs/backend-fsn.ooni.org/privkey.pem;
ssl_trusted_certificate /var/lib/dehydrated/certs/backend-fsn.ooni.org/chain.pem; # for ssl_stapling_verify

# Use the intermediate configuration to support legacy probes
# https://ssl-config.mozilla.org/#server=nginx&version=1.14.2&config=intermediate&openssl=1.1.1d&guideline=5.6
Expand All @@ -69,6 +83,24 @@ server {

resolver 127.0.0.1;

set $external_remote_addr $remote_addr;
#if ($remote_addr = "188.166.93.143") {
# # If remote_addr is ams-pg-test trust the X-Real-IP header
# set $external_remote_addr $http_x_real_ip;
#}
#if ($remote_addr = "142.93.237.101") {
# # If remote_addr is ams-pg trust the X-Real-IP header
# set $external_remote_addr $http_x_real_ip;
#}
#if ($remote_addr ~ "^3.") {
# # If remote_addr is AWS trust the X-Real-IP header
# set $external_remote_addr $http_x_real_ip;
#}
#if ($remote_addr ~ "^18.") {
# # If remote_addr is AWS trust the X-Real-IP header
# set $external_remote_addr $http_x_real_ip;
#}

# Registry
# Should match:
# - /api/v1/login
Expand All @@ -77,19 +109,21 @@ server {
location ~^/api/v1/(login|register|update) {
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-IP $external_remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;

proxy_pass https://registry.ooni.io:443;
proxy_pass https://ooniprobe.prod.ooni.io:443;
}

# Selectively route test-list/urls to the API
location ~^/api/v1/test-list/urls {
# location ~^/api/v1/test-list/urls {
location ~^/api/v1/(test-list|urls) {
proxy_pass http://127.0.0.1:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-IP $external_remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_cache apicache;
proxy_cache_min_uses 1;
proxy_cache_lock on;
Expand All @@ -108,24 +142,37 @@ server {
add_header X-Content-Type-Options nosniff always;
}

# Orchestrate
# Should match:
# - /api/v1/test-list
location ~^/api/v1/(test-list|urls) {
# reverse proxy incidents
location ~^/api/v1/incidents {
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-IP $external_remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;

proxy_pass https://orchestrate.ooni.io:443;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;

proxy_pass https://oonifindings.prod.ooni.io:443;
}

# Orchestrate
# NOTE: we are now serving this from the ooniapi monolith
# Should match:
# - /api/v1/test-list
# location ~^/api/v1/(test-list|urls) {

@hellais hellais Feb 20, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe let's just add a comment above this to mention we are serving this from ooniapi monolith

# proxy_http_version 1.1;
# proxy_set_header Host $http_host;
# proxy_set_header X-Real-IP $external_remote_addr;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_set_header X-Forwarded-Proto $scheme;
# proxy_read_timeout 900;

# proxy_pass https://orchestrate.ooni.io:443;
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# add_header X-Frame-Options DENY always;
# add_header X-Content-Type-Options nosniff always;

# }

# Web Connectivity Test Helper
# Should match:
# - /
Expand All @@ -139,19 +186,20 @@ server {
location ~^/web-connectivity/(status) {
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-IP $external_remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;

proxy_pass https://wcth.ooni.io;
proxy_pass https://0.th.ooni.org;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;
add_header Host "0.th.ooni.org";
}

location /whoami {
return 200 "{{ inventory_hostname }}";
return 200 "backend-fsn.ooni.org";
}

location /metrics {
Expand All @@ -169,7 +217,7 @@ server {
rewrite ^/netdata/badge /api/v1/badge.svg break;
proxy_pass http://127.0.0.1:19999;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Real-IP $external_remote_addr;
}

# Expose package version badges
Expand Down Expand Up @@ -209,15 +257,6 @@ server {
proxy_pass https://0.th.ooni.org;
}

set $external_remote_addr $remote_addr;
if ($remote_addr = "188.166.93.143") {
# If remote_addr is ams-pg-test trust the X-Real-IP header
set $external_remote_addr $http_x_real_ip;
}
if ($remote_addr = "142.93.237.101") {
# If remote_addr is ams-pg trust the X-Real-IP header
set $external_remote_addr $http_x_real_ip;
}
proxy_set_header X-Real-IP $external_remote_addr;

proxy_cache apicache;
Expand Down