From fe74cdbfe12fd9d00ad8c4504cf860ecf07bc749 Mon Sep 17 00:00:00 2001
From: Olli-Antti Kivilahti <olli-antti.kivilahti@jns.fi>
Date: Thu, 11 Jun 2015 17:43:52 +0300
Subject: [PATCH] Bug 14448 - Nginx reverse proxy config baseline for Koha REST
 API. Tweaking needed to work with makefile.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Uses a self-signed SSL-certificate to service at port 444 by default.
Reverse proxies to 127.0.0.1:8080 (expecting hypnotoad to be listening)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤ Koha API Nginx configuration ¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Deploy the Nginx configuration
------------------------------

Run make to populate the koha-nginx-kohaapi.conf

link to the /etc/nginx/sites-available/ -directory
..$ ln -s /home/koha/koha-dev/etc/koha-nginx-kohaapi.conf /etc/nginx/sites-available/kohaapi
and enable with command
..$ ln -s /etc/nginx/sites-available/kohaapi /etc/nginx/sites-enabled/kohaapi

Disable the default config
..$ rm /etc/nginx/sites-enabled/default

Create a openssl self-signed certificate or use your own.
---------------------------------------------------------

..$ cd /etc/nginx
..$ mkdir ssl
..$ chmod 400 ssl
..$ cd ssl
..$ openssl req -x509 -sha256 -newkey rsa:2048 -keyout key.pem.secure -out cert.pem -days 720
..$ openssl rsa -in key.pem.secure -out key.pem
..$ chmod 400 *

Restart nginx
..$ service nginx restart
---
 etc/koha-nginx-kohaapi.conf | 52 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 etc/koha-nginx-kohaapi.conf

diff --git a/etc/koha-nginx-kohaapi.conf b/etc/koha-nginx-kohaapi.conf
new file mode 100644
index 0000000..db0098a
--- /dev/null
+++ b/etc/koha-nginx-kohaapi.conf
@@ -0,0 +1,52 @@
+upstream hypnotoad {
+    server 127.0.0.1:8081;
+}
+
+server {
+    listen 444;                          ## listen for ipv4
+    listen [::]:444 default ipv6only=on; ## listen for ipv6
+    proxy_connect_timeout 120s; #High value because some API requests (show all borrowers) take a LOT of time.
+    proxy_read_timeout 120s;
+    proxy_send_timeout 120s;
+
+    #server_name <your_Koha_DNS_Name>;
+    access_log /home/koha/koha-dev/var/log/kohaapi.access.log;
+    error_log  /home/koha/koha-dev/var/log/kohaapi.error.log error;
+
+    root /home/koha/kohaclone/api/;
+    index index.html;
+
+    ssl on;
+    ssl_certificate     ssl/cert.pem;
+    ssl_certificate_key ssl/key.pem;
+
+    ssl_session_timeout 5m;
+
+    ssl_protocols SSLv3 TLSv1;
+    ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
+    ssl_prefer_server_ciphers on;
+
+    #Redirect root to the Swagger documentation
+    location = / {
+        rewrite ^/(.*) $scheme://$host:$server_port/v1/doc/;
+    }
+    #Don't proxy doc
+    location ^~ /v1/doc/ {
+
+    }
+    # and no proxying the swagger.json
+    location = /v1/swagger.json {
+
+    }
+
+    #Proxy everything else
+    location /v1/ {
+        proxy_pass http://hypnotoad;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
-- 
1.9.1