55 lines
2.1 KiB
Plaintext
55 lines
2.1 KiB
Plaintext
# nginx gateway untuk docker-socket-proxy.
|
|
#
|
|
# File ini adalah TEMPLATE: pada container start, docker-entrypoint nginx
|
|
# menjalankan envsubst dan mengganti ${PROXY_API_KEY} dengan nilai env
|
|
# PROXY_API_KEY (variabel nginx seperti $http_x_api_key TIDAK ikut diganti),
|
|
# lalu menulis hasilnya ke /etc/nginx/conf.d/default.conf.
|
|
#
|
|
# Kebijakan:
|
|
# * Semua request WAJIB membawa header `X-Api-Key` == PROXY_API_KEY (401 bila
|
|
# salah/kosong). nginx membalas 401 TANPA meneruskan ke proxy.
|
|
# * Allowlist path (desain §2): hanya route yang dibutuhkan KONTROL oleh
|
|
# control-panel. Selain itu di-block 403 — termasuk route berbahaya
|
|
# (exec, create, images, networks, volumes, dll) sekalipun ACL proxy longgar.
|
|
# * Aksi tulis restart/start/stop hanya via POST (selainnya 405).
|
|
|
|
server {
|
|
listen 80 default_server;
|
|
server_name _;
|
|
|
|
# ==== API-key check (sebelum diproses location mana pun) ====
|
|
if ($http_x_api_key != "${PROXY_API_KEY}") {
|
|
return 401;
|
|
}
|
|
|
|
# ==== Route yang diizinkan (allowlist) ====
|
|
|
|
# Health/info daemon + event stream
|
|
location = /_ping { proxy_pass http://docker-proxy:2375; }
|
|
location = /version { proxy_pass http://docker-proxy:2375; }
|
|
location = /info { proxy_pass http://docker-proxy:2375; }
|
|
location = /events { proxy_pass http://docker-proxy:2375; }
|
|
|
|
# List container (tanpa id) — GET /containers/json
|
|
location = /containers/json { proxy_pass http://docker-proxy:2375; }
|
|
|
|
# Operasi per-container yang dibutuhkan kontrol/observability
|
|
location ~ ^/containers/[^/]+/json$ { proxy_pass http://docker-proxy:2375; }
|
|
location ~ ^/containers/[^/]+/logs$ { proxy_pass http://docker-proxy:2375; }
|
|
location ~ ^/containers/[^/]+/stats$ { proxy_pass http://docker-proxy:2375; }
|
|
location ~ ^/containers/[^/]+/top$ { proxy_pass http://docker-proxy:2375; }
|
|
|
|
# Aksi tulis — hanya POST (restart/start/stop)
|
|
location ~ ^/containers/[^/]+/(restart|start|stop)$ {
|
|
if ($request_method != POST) {
|
|
return 405;
|
|
}
|
|
proxy_pass http://docker-proxy:2375;
|
|
}
|
|
|
|
# ==== Semua path lain di-block ====
|
|
location / {
|
|
return 403;
|
|
}
|
|
}
|