sudo mkdir -p /usr/local/openresty/nginx/conf/ && cat << 'EOF' | sudo tee /usr/local/openresty/nginx/conf/nginx.conf > /dev/null
user iota;
worker_processes auto;
error_log logs/error.log;
pid /usr/local/openresty/nginx/logs/nginx.pid;
events {
worker_connections 4096;
}
http {
default_type application/json;
keepalive_timeout 70;
init_by_lua 'require "cjson"';
ssl_session_cache shared:SSL:32m;
ssl_session_timeout 5m;
server_tokens off;
add_header X-XSS-Protection '1; mode=block';
add_header X-Content-Type-Options nosniff;
log_format main '$remote_addr - $remote_user [$time_local] $status '
'"$request" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
upstream iri {
server 127.0.0.1:14267;
}
upstream grafana {
server 127.0.0.1:3000;
}
upstream prometheus {
server 127.0.0.1:9090;
}
upstream iota_exporter {
server 127.0.0.1:9311;
}
upstream ipm {
server 127.0.0.1:8888;
}
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 120;
proxy_send_timeout 120;
proxy_read_timeout 120;
proxy_buffers 32 4k;
client_max_body_size 1m;
client_body_buffer_size 128k;
limit_req_zone $binary_remote_addr zone=iri:10m rate=5r/s;
limit_req_zone $binary_remote_addr zone=grafana:10m rate=25r/s;
limit_req_zone $binary_remote_addr zone=prometheus:10m rate=25r/s;
limit_req_zone $binary_remote_addr zone=iota_exporter:10m rate=25r/s;
limit_req_zone $binary_remote_addr zone=ipm:10m rate=25r/s;
server {
listen 14265 default_server deferred;
listen 443 ssl http2 deferred;
server_name v22018117236076934.nicesrv.de;
ssl_certificate /etc/letsencrypt/live/v22018117236076934.nicesrv.de/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/v22018117236076934.nicesrv.de/privkey.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security 'max-age=63072000; includeSubdomains';
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/v22018117236076934.nicesrv.de/fullchain.pem;
resolver 8.8.8.8 8.8.4.4 9.9.9.9 valid=300s;
resolver_timeout 1s;
error_page 405 @error405;
location @error405 {
add_header Allow 'GET, HEAD, OPTIONS, POST' always;
}
location /grafana/ {
limit_req zone=grafana burst=50 nodelay;
limit_req_log_level warn;
limit_req_status 444;
proxy_pass http://grafana/;
}
location /prometheus/ {
auth_basic "Prometheus";
auth_basic_user_file /usr/local/openresty/nginx/conf/.htpasswd;
limit_req zone=prometheus burst=50 nodelay;
limit_req_log_level warn;
limit_req_status 444;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
sub_filter_once off;
sub_filter '="/' '="/prometheus/';
sub_filter 'var PATH_PREFIX = "";' 'var PATH_PREFIX = "/prometheus";';
rewrite ^/prometheus/?$ /prometheus/graph redirect;
rewrite ^/prometheus/(.*)$ /$1 break;
proxy_pass http://prometheus/;
}
location /iota_exporter/ {
auth_basic "IOTA Prometheus Exporter";
auth_basic_user_file /usr/local/openresty/nginx/conf/.htpasswd;
limit_req zone=iota_exporter burst=50 nodelay;
limit_req_log_level warn;
limit_req_status 444;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://iota_exporter/;
}
location /ipm/ {
auth_basic "IOTA Peer Manager";
auth_basic_user_file /usr/local/openresty/nginx/conf/.htpasswd;
limit_req zone=ipm burst=50 nodelay;
limit_req_log_level warn;
limit_req_status 444;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
sub_filter_once off;
sub_filter '="/' '="/ipm/';
sub_filter 'var PATH_PREFIX = "";' 'var PATH_PREFIX = "/ipm";';
rewrite ^/ipm/(.*)$ /$1 break;
proxy_pass http://ipm/;
}
location /socket.io/ {
auth_basic_user_file /usr/local/openresty/nginx/conf/.htpasswd;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass "http://127.0.0.1:8888";
}
location / {
limit_req zone=iri burst=10 nodelay;
limit_req_log_level warn;
limit_req_status 444;
if ( $request_method !~ ^(HEAD|OPTIONS|POST)$ ) {
return 405;
}
if ( $request_method = OPTIONS ) {
proxy_pass http://iri;
}
if ( $request_method = POST ) {
set $upstream '';
access_by_lua_block {
ngx.req.read_body()
local cjson = require('cjson')
local data = ngx.req.get_body_data()
local json_data = cjson.decode(data)
local req_command = json_data["command"]
local allowed_pub_commands = {
'getNodeInfo',
'getTips',
'findTransactions',
'getTrytes',
'getInclusionStates',
'getBalances',
'getTransactionsToApprove',
'attachToTangle',
'interruptAttachingToTangle',
'broadcastTransactions',
'storeTransactions',
'wereAddressesSpentFrom'
}
local function has_value (tab, val)
for k, v in pairs(tab) do
if v == val then
return true
end
end
return false
end
if has_value(allowed_pub_commands, req_command) then
ngx.var.upstream = "iri"
else
ngx.exit(405)
end
}
proxy_pass http://$upstream;
}
}
}
}
EOF
