hoellen/dockerfiles
1
0
Fork 0
mirror of https://github.com/hoellen/dockerfiles.git synced 2025-04-20 04:19:18 +00:00
Code Issues Projects Releases Wiki Activity

reverse: fix conf files

Browse Source
This commit is contained in:
Wonderfall 2016-05-27 18:10:08 +02:00
parent dd364bbc3c
commit 80372628b7
4 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
reverse/Dockerfile
View File

@ -110,6 +110,9 @@ RUN echo "@commuedge http://nl.alpinelinux.org/alpine/edge/community" >> /etc/ap
COPY nginx.conf /etc/nginx/conf/nginx.conf COPY nginx.conf /etc/nginx/conf/nginx.conf
COPY run.sh /usr/local/bin/run.sh COPY run.sh /usr/local/bin/run.sh
COPY ngxpasswd /usr/local/bin/ngxpasswd COPY ngxpasswd /usr/local/bin/ngxpasswd
COPY ssl_params /etc/nginx/conf/ssl_params
COPY headers_params /etc/nginx/conf/headers_params
COPY proxy_params /etc/nginx/conf/proxy_params
RUN chmod +x /usr/local/bin/* RUN chmod +x /usr/local/bin/*
@ -117,10 +120,6 @@ EXPOSE 8000 4430
VOLUME /sites-enabled /conf.d /passwds /certs /var/log/nginx VOLUME /sites-enabled /conf.d /passwds /certs /var/log/nginx
COPY ssl_params_d.conf /conf.d/ssl_params_d.conf
COPY headers_params_d.conf /conf.d/headers_params_d.conf
COPY proxy_params_d.conf /conf.d/proxy_params_d.conf
LABEL description="Secure reverse proxy using nginx" \ LABEL description="Secure reverse proxy using nginx" \
openssl="OpenSSL v${OPENSSL_VERSION}" \ openssl="OpenSSL v${OPENSSL_VERSION}" \
nginx="nginx v${NGINX_VERSION}" nginx="nginx v${NGINX_VERSION}"

4
reverse/headers_params Normal file
View File

@ -0,0 +1,4 @@
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

6
reverse/proxy_params Normal file
View File

@ -0,0 +1,6 @@
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Remote-Port $remote_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;

8
reverse/ssl_params Normal file
View File

@ -0,0 +1,8 @@
ssl_protocols TLSv1.2;
ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-CHACHA20-POLY1305-D:ECDHE-RSA-CHACHA20-POLY1305-D:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256”;
ssl_prefer_server_ciphers on;
ssl_ecdh_curve brainpoolP512r1:sect571r1:secp521r1:secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 5m;
ssl_session_tickets off;