Mainflux.mainflux/docker/nginx/nginx-x509.conf

#
# Copyright (c) 2018
# Mainflux
#
# SPDX-License-Identifier: Apache-2.0
#
# This is the Mainflux NGINX configuration for mututal authentication based on X.509 certifiactes.

user nginx;
worker_processes auto;
pid /run/nginx.pid;
load_module /etc/nginx/modules/ngx_stream_js_module.so;
load_module /etc/nginx/modules/ngx_http_js_module.so;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    js_include authorization.js;
    js_set $auth_key setKey;

    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;

        # These paths are set to its default values as
        # a volume in the docker/docker-compose.yml file.
        ssl_certificate /etc/ssl/certs/mainflux-server.crt;
        ssl_certificate_key /etc/ssl/private/mainflux-server.key;
        ssl_client_certificate /etc/ssl/certs/ca.crt;
        ssl_verify_client optional;
        ssl_verify_depth 2;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1;
        ssl_session_tickets off;
        ssl_stapling off;
        ssl_stapling_verify on;
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 5s;

        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header Access-Control-Allow-Origin '*';
        add_header Access-Control-Allow-Methods '*';
        add_header Access-Control-Allow-Headers '*';

        server_name localhost;

        # Proxy pass to users service
        location ~ ^/(users|tokens) {
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass http://users:8180;

            # Allow OPTIONS method CORS
            if ($request_method = OPTIONS ) {
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 200;
            }
        }

        # Proxy pass to things service
        location ~ ^/(things|channels) {
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://things:8182;

            # Allow OPTIONS method CORS
            if ($request_method = OPTIONS ) {
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 200;
            }
        }

        location /version {
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass http://things:8182;

            # Allow OPTIONS method CORS
            if ($request_method = OPTIONS ) {
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 200;
            }
        }

        # Proxy pass to mainflux-http-adapter
        location /http/ {
            if ($ssl_client_verify != SUCCESS) {
                return 403;
            }
            if ($auth_key = '') {
                return 403;
            }

            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Authorization $auth_key;
            proxy_pass http://http-adapter:8185/;

            # Allow OPTIONS method CORS
            if ($request_method = OPTIONS ) {
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 200;
            }
        }

        # Proxy pass to mainflux-ws-adapter
        location /ws/ {
            if ($ssl_client_verify != SUCCESS) {
                return 403;
            }
            if ($auth_key = '') {
                return 403;
            }

            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_connect_timeout 7d;
            proxy_send_timeout 7d;
            proxy_read_timeout 7d;
            proxy_pass http://ws-adapter:8186/;

            # Allow OPTIONS method CORS
            if ($request_method = OPTIONS ) {
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 200;
            }
        }

        # Proxy pass to mainflux-mqtt-adapter over WS
        location /mqtt {
            if ($ssl_client_verify != SUCCESS) {
                return 403;
            }
            if ($auth_key = '') {
                return 403;
            }
            
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_connect_timeout 7d;
            proxy_send_timeout 7d;
            proxy_read_timeout 7d;
            proxy_pass http://mqtt-adapter:8880/;

            # Allow OPTIONS method CORS
            if ($request_method = OPTIONS ) {
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 200;
            }
        }

        location / {
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_pass http://ui:MF_UI_PORT/;

            # Allow OPTIONS method CORS
            if ($request_method = OPTIONS ) {
                add_header Content-Length 0;
                add_header Content-Type text/plain;
                return 200;
            }
        }
    }

    error_log  info.log info;
    error_log  error.log error;
    error_log  warn.log warn;
}

# MQTT
stream {
    js_include authorization.js;
    server {
        listen 8883 ssl;
        listen [::]:8883 ssl;

        # These paths are set to its default values as
        # a volume in the docker/docker-compose.yml file.
        ssl_certificate /etc/ssl/certs/mainflux-server.crt;
        ssl_certificate_key /etc/ssl/private/mainflux-server.key;
        ssl_client_certificate /etc/ssl/certs/ca.crt;
        ssl_verify_client on;
        ssl_verify_depth 2;
        ssl_dhparam /etc/ssl/certs/dhparam.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_ecdh_curve secp384r1;
        ssl_session_tickets off;
        resolver 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout 5s;
        js_preread authenticate;

        proxy_pass mqtt-adapter:1883;
    }
}

error_log  info.log info;
error_log  error.log error;
error_log  warn.log warn;