From fe74cdbfe12fd9d00ad8c4504cf860ecf07bc749 Mon Sep 17 00:00:00 2001 From: Olli-Antti Kivilahti Date: Thu, 11 Jun 2015 17:43:52 +0300 Subject: [PATCH] Bug 14448 - Nginx reverse proxy config baseline for Koha REST API. Tweaking needed to work with makefile. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Uses a self-signed SSL-certificate to service at port 444 by default. Reverse proxies to 127.0.0.1:8080 (expecting hypnotoad to be listening) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ¤¤ Koha API Nginx configuration ¤¤ ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Deploy the Nginx configuration ------------------------------ Run make to populate the koha-nginx-kohaapi.conf link to the /etc/nginx/sites-available/ -directory ..$ ln -s /home/koha/koha-dev/etc/koha-nginx-kohaapi.conf /etc/nginx/sites-available/kohaapi and enable with command ..$ ln -s /etc/nginx/sites-available/kohaapi /etc/nginx/sites-enabled/kohaapi Disable the default config ..$ rm /etc/nginx/sites-enabled/default Create a openssl self-signed certificate or use your own. --------------------------------------------------------- ..$ cd /etc/nginx ..$ mkdir ssl ..$ chmod 400 ssl ..$ cd ssl ..$ openssl req -x509 -sha256 -newkey rsa:2048 -keyout key.pem.secure -out cert.pem -days 720 ..$ openssl rsa -in key.pem.secure -out key.pem ..$ chmod 400 * Restart nginx ..$ service nginx restart --- etc/koha-nginx-kohaapi.conf | 52 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 etc/koha-nginx-kohaapi.conf diff --git a/etc/koha-nginx-kohaapi.conf b/etc/koha-nginx-kohaapi.conf new file mode 100644 index 0000000..db0098a --- /dev/null +++ b/etc/koha-nginx-kohaapi.conf @@ -0,0 +1,52 @@ +upstream hypnotoad { + server 127.0.0.1:8081; +} + +server { + listen 444; ## listen for ipv4 + listen [::]:444 default ipv6only=on; ## listen for ipv6 + proxy_connect_timeout 120s; #High value because some API requests (show all borrowers) take a LOT of time. + proxy_read_timeout 120s; + proxy_send_timeout 120s; + + #server_name ; + access_log /home/koha/koha-dev/var/log/kohaapi.access.log; + error_log /home/koha/koha-dev/var/log/kohaapi.error.log error; + + root /home/koha/kohaclone/api/; + index index.html; + + ssl on; + ssl_certificate ssl/cert.pem; + ssl_certificate_key ssl/key.pem; + + ssl_session_timeout 5m; + + ssl_protocols SSLv3 TLSv1; + ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP; + ssl_prefer_server_ciphers on; + + #Redirect root to the Swagger documentation + location = / { + rewrite ^/(.*) $scheme://$host:$server_port/v1/doc/; + } + #Don't proxy doc + location ^~ /v1/doc/ { + + } + # and no proxying the swagger.json + location = /v1/swagger.json { + + } + + #Proxy everything else + location /v1/ { + proxy_pass http://hypnotoad; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} -- 1.9.1