first commit

server-ce/nginx/clsi-nginx.conf

@@ -0,0 +1,61 @@
+# keep in sync with clsi-startup.sh files
+# keep in sync with clsi/nginx.conf
+# Changes to the above:
+#  - added debug header
+#  - remove CORS rules, Server-CE/Server-Pro runs behind a single origin
+#  - change /output path to /var/lib/overleaf/data/output
+
+server {
+  # Extra header for debugging.
+  add_header 'X-Served-By' 'clsi-nginx' always;
+
+  # Security-Headers
+  add_header 'X-Content-Type-Options' 'nosniff' always;
+  add_header 'X-Download-Options' 'noopen' always;
+  add_header 'X-Frame-Options' 'SAMEORIGIN' always;
+  add_header 'X-XSS-Protection' '1; mode=block' always;
+
+  listen 8080;
+  server_name clsi-nginx;
+  server_tokens off;
+  access_log off;
+  # Ignore symlinks possibly created by users
+  disable_symlinks on;
+  # enable compression for tex auxiliary files, but not for pdf files
+  gzip on;
+  gzip_types text/plain;
+  gzip_proxied any;
+  types {
+      text/plain log blg aux stdout stderr;
+      application/pdf pdf;
+  }
+  # handle output files for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
+    alias /var/lib/overleaf/data/output/$1-$2/generated-files/$3/output.$4;
+  }
+  # handle .blg files for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/(.+)\.blg$ {
+    alias /var/lib/overleaf/data/output/$1-$2/generated-files/$3/$4.blg;
+  }
+  # handle output files for anonymous users
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
+    alias /var/lib/overleaf/data/output/$1/generated-files/$2/output.$3;
+  }
+  # handle .blg files for anonymous users
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/(.+)\.blg$ {
+    alias /var/lib/overleaf/data/output/$1/generated-files/$2/$3.blg;
+  }
+
+  # PDF range for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+    # Cache for one day
+    expires 1d;
+    alias /var/lib/overleaf/data/output/$1-$2/content/$3;
+  }
+  # PDF range for anonymous users
+  location ~ ^/project/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+    # Cache for one day
+    expires 1d;
+    alias /var/lib/overleaf/data/output/$1/content/$2;
+  }
+}

server-ce/nginx/nginx.conf.template

@@ -0,0 +1,81 @@
+## ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ##
+## ! This file was generated from a template ! ##
+## ! See /etc/nginx/templates/               ! ##
+## ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ##
+daemon off;
+user www-data;
+worker_processes ${NGINX_WORKER_PROCESSES};
+pid /run/nginx.pid;
+
+events {
+	worker_connections ${NGINX_WORKER_CONNECTIONS};
+	# multi_accept on;
+}
+
+http {
+
+	##
+	# Basic Settings
+	##
+
+	sendfile on;
+	tcp_nopush on;
+	tcp_nodelay on;
+	keepalive_timeout ${NGINX_KEEPALIVE_TIMEOUT};
+	types_hash_max_size 2048;
+	# server_tokens off;
+
+	# server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# Logging Settings
+	##
+
+	access_log /var/log/nginx/access.log;
+	error_log /var/log/nginx/error.log;
+
+	##
+	# Gzip Settings
+	##
+
+	gzip on;
+	gzip_disable "msie6";
+	gzip_proxied any; # allow upstream server to compress.
+
+	client_max_body_size 50m;
+
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	# gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+
+	##
+	# nginx-naxsi config
+	##
+	# Uncomment it if you installed nginx-naxsi
+	##
+
+	#include /etc/nginx/naxsi_core.rules;
+
+	##
+	# nginx-passenger config
+	##
+	# Uncomment it if you installed nginx-passenger
+	##
+
+	#passenger_root /usr;
+	#passenger_ruby /usr/bin/ruby;
+
+	##
+	# Virtual Host Configs
+	##
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}

server-ce/nginx/overleaf.conf

@@ -0,0 +1,82 @@
+server {
+	listen         80;
+	server_name    _; # Catch all, see http://nginx.org/en/docs/http/server_names.html
+
+	root /overleaf/services/web/public/;
+
+	# block external access to prometheus /metrics
+	location /metrics {
+		internal;
+	}
+
+	location / {
+		proxy_pass http://127.0.0.1:4000;
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection "upgrade";
+		proxy_set_header Host $host;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_read_timeout 10m;
+		proxy_send_timeout 10m;
+	}
+
+	location /socket.io {
+		proxy_pass http://127.0.0.1:3026;
+		proxy_http_version 1.1;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection "upgrade";
+		proxy_set_header Host $host;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_read_timeout 10m;
+		proxy_send_timeout 10m;
+	}
+
+	location /stylesheets {
+		expires 1y;
+	}
+
+	location /minjs {
+		expires 1y;
+	}
+
+	location /img {
+		expires 1y;
+	}
+
+  # handle output files for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
+  # handle output files for anonymous users
+  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/output\.([a-z.]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
+  # PDF range for specific users
+  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
+  # PDF range for anonymous users
+  location ~ ^/project/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
+		proxy_pass http://127.0.0.1:8080; # clsi-nginx.conf
+		proxy_http_version 1.1;
+  }
+
+  # block external access to metrics
+  location ~* ^/metrics/?$ {
+    return 404 'Not found';
+  }
+
+  # block external access to all health checks /health_check, /health_check/full, etc
+  location ~* ^/health_check {
+    return 404 'Not found';
+  }
+
+  # Load any extra configuration for this vhost
+  include /etc/nginx/vhost-extras/overleaf/*.conf;
+}