119 lines
5.0 KiB
Plaintext
119 lines
5.0 KiB
Plaintext
# Copyright 2026 Google LLC
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
server {
|
|
listen 443 ssl default_server;
|
|
listen [::]:443 ssl default_server;
|
|
http2 on;
|
|
server_name _;
|
|
|
|
# TLS / SSL Configuration
|
|
ssl_certificate /etc/nginx/certs/tls.crt;
|
|
ssl_certificate_key /etc/nginx/certs/tls.key;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_timeout 1d;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_tickets off;
|
|
|
|
# Security Headers
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
# Embedded Docker DNS Resolver for dynamic container discovery
|
|
# 127.0.0.11 is Docker's internal DNS server
|
|
resolver 127.0.0.11 valid=5s ipv6=off;
|
|
resolver_timeout 5s;
|
|
|
|
# Health check endpoint
|
|
location = /healthz {
|
|
access_log off;
|
|
default_type text/plain;
|
|
return 200 "OK\n";
|
|
}
|
|
|
|
# --------------------------------------------------------------------------
|
|
# 1. Backend Core Management API (Auth, OTP, Session Lifecycle)
|
|
# --------------------------------------------------------------------------
|
|
location /api/ {
|
|
set $backend_upstream "backend:8000";
|
|
proxy_pass http://$backend_upstream;
|
|
include /etc/nginx/includes/proxy_headers.conf;
|
|
include /etc/nginx/includes/websocket_params.conf;
|
|
}
|
|
|
|
# --------------------------------------------------------------------------
|
|
# 2. Dynamic Artemis Session Containers: Real-time Trace & Event Stream (SSE/WS)
|
|
# Target container: artemis-session-<session_id>:8080
|
|
# --------------------------------------------------------------------------
|
|
location ~ ^/session/(?<session_id>[a-zA-Z0-9_-]+)/artemis/stream/(?<stream_path>.*)$ {
|
|
set $artemis_host "artemis-session-$session_id";
|
|
proxy_pass http://$artemis_host:8080/stream/$stream_path$is_args$args;
|
|
include /etc/nginx/includes/sse_params.conf;
|
|
include /etc/nginx/includes/websocket_params.conf;
|
|
}
|
|
|
|
# --------------------------------------------------------------------------
|
|
# 3. Dynamic Artemis Session Containers: REST APIs & Admin Console
|
|
# Target container: artemis-session-<session_id>:8080
|
|
# --------------------------------------------------------------------------
|
|
location ~ ^/session/(?<session_id>[a-zA-Z0-9_-]+)/artemis/(?<artemis_path>.*)$ {
|
|
set $artemis_host "artemis-session-$session_id";
|
|
proxy_pass http://$artemis_host:8080/$artemis_path$is_args$args;
|
|
include /etc/nginx/includes/proxy_headers.conf;
|
|
include /etc/nginx/includes/websocket_params.conf;
|
|
}
|
|
|
|
# --------------------------------------------------------------------------
|
|
# 4. Cuttlefish Emulator WebRTC Signaling & Stream Proxy
|
|
# Proxies signaling requests to the Cloud Orchestrator / CVD daemon
|
|
# --------------------------------------------------------------------------
|
|
location ~ ^/session/(?<session_id>[a-zA-Z0-9_-]+)/cuttlefish/(?<cf_path>.*)$ {
|
|
# Host gateway communication or cloud-orchestrator container
|
|
set $cuttlefish_upstream "host.docker.internal:8443";
|
|
proxy_pass http://$cuttlefish_upstream/$cf_path$is_args$args;
|
|
include /etc/nginx/includes/proxy_headers.conf;
|
|
include /etc/nginx/includes/websocket_params.conf;
|
|
}
|
|
|
|
# --------------------------------------------------------------------------
|
|
# 5. Static Frontend Single Page Application (Served via Backend or Static Dist)
|
|
# --------------------------------------------------------------------------
|
|
location / {
|
|
set $backend_upstream "backend:8000";
|
|
proxy_pass http://$backend_upstream;
|
|
include /etc/nginx/includes/proxy_headers.conf;
|
|
}
|
|
|
|
# --------------------------------------------------------------------------
|
|
# 6. Custom JSON Error Pages for Ephemeral Container Boot & Teardown States
|
|
# --------------------------------------------------------------------------
|
|
error_page 502 /502.json;
|
|
error_page 504 /504.json;
|
|
|
|
location = /502.json {
|
|
root /usr/share/nginx/html;
|
|
internal;
|
|
default_type application/json;
|
|
}
|
|
|
|
location = /504.json {
|
|
root /usr/share/nginx/html;
|
|
internal;
|
|
default_type application/json;
|
|
}
|
|
}
|