Mickey
498 lines
17 KiB
Python
498 lines
17 KiB
Python
#!/usr/bin/env python3
|
|
|
|
from __future__ import annotations
|
|
|
|
import html
|
|
from pathlib import Path
|
|
import re
|
|
import sys
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parent.parent
|
|
CONFIG_PATH = ROOT / "config" / "proxy.yaml"
|
|
GENERATED_DIR = ROOT / "generated"
|
|
NGINX_OUTPUT_PATH = GENERATED_DIR / "default.conf"
|
|
INDEX_OUTPUT_PATH = GENERATED_DIR / "index.html"
|
|
|
|
|
|
class ConfigError(ValueError):
|
|
pass
|
|
|
|
|
|
def parse_scalar(raw: str):
|
|
value = raw.strip()
|
|
if not value:
|
|
return ""
|
|
if value[0] == value[-1] and value[0] in {"'", '"'}:
|
|
return value[1:-1]
|
|
if re.fullmatch(r"-?\d+", value):
|
|
return int(value)
|
|
return value
|
|
|
|
|
|
def parse_config(path: Path) -> dict:
|
|
config: dict[str, object] = {}
|
|
routes: list[dict[str, object]] = []
|
|
current_route: dict[str, object] | None = None
|
|
in_routes = False
|
|
|
|
for line_number, raw_line in enumerate(path.read_text(encoding="utf-8").splitlines(), start=1):
|
|
line = raw_line.split("#", 1)[0].rstrip()
|
|
if not line.strip():
|
|
continue
|
|
|
|
indent = len(line) - len(line.lstrip(" "))
|
|
stripped = line.strip()
|
|
|
|
if indent == 0:
|
|
current_route = None
|
|
if stripped == "routes:":
|
|
in_routes = True
|
|
continue
|
|
in_routes = False
|
|
if ":" not in stripped:
|
|
raise ConfigError(f"{path}:{line_number}: expected key: value pair")
|
|
key, value = stripped.split(":", 1)
|
|
config[key.strip()] = parse_scalar(value)
|
|
continue
|
|
|
|
if not in_routes:
|
|
raise ConfigError(f"{path}:{line_number}: unexpected indentation outside routes")
|
|
|
|
if indent == 2 and stripped.startswith("- "):
|
|
payload = stripped[2:].strip()
|
|
current_route = {}
|
|
routes.append(current_route)
|
|
if payload:
|
|
if ":" not in payload:
|
|
raise ConfigError(f"{path}:{line_number}: expected key: value after '-'")
|
|
key, value = payload.split(":", 1)
|
|
current_route[key.strip()] = parse_scalar(value)
|
|
continue
|
|
|
|
if indent == 4 and current_route is not None:
|
|
if ":" not in stripped:
|
|
raise ConfigError(f"{path}:{line_number}: expected key: value in route entry")
|
|
key, value = stripped.split(":", 1)
|
|
current_route[key.strip()] = parse_scalar(value)
|
|
continue
|
|
|
|
raise ConfigError(f"{path}:{line_number}: unsupported YAML structure")
|
|
|
|
config["routes"] = routes
|
|
return config
|
|
|
|
|
|
def validate_config(config: dict) -> dict:
|
|
server_name = config.get("server_name")
|
|
certificate_name = config.get("certificate_name")
|
|
routes = config.get("routes")
|
|
|
|
if not isinstance(server_name, str) or not server_name:
|
|
raise ConfigError("server_name must be a non-empty string")
|
|
if not isinstance(certificate_name, str) or not certificate_name:
|
|
raise ConfigError("certificate_name must be a non-empty string")
|
|
if not isinstance(routes, list) or not routes:
|
|
raise ConfigError("routes must contain at least one route")
|
|
|
|
normalized_routes = []
|
|
seen_suffixes = set()
|
|
for index, route in enumerate(routes, start=1):
|
|
if not isinstance(route, dict):
|
|
raise ConfigError(f"route #{index} must be a mapping")
|
|
|
|
project_dir = route.get("project_dir")
|
|
path_suffix = route.get("path_suffix")
|
|
port = route.get("port")
|
|
upstream_scheme = route.get("upstream_scheme", "http")
|
|
upstream_host = route.get("upstream_host", "host.docker.internal")
|
|
|
|
if not isinstance(project_dir, str) or not project_dir:
|
|
raise ConfigError(f"route #{index}: project_dir must be a non-empty string")
|
|
if not isinstance(path_suffix, str) or not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._/-]*", path_suffix):
|
|
raise ConfigError(
|
|
f"route #{index}: path_suffix must match [A-Za-z0-9][A-Za-z0-9._/-]*"
|
|
)
|
|
if path_suffix.startswith("/") or path_suffix.endswith("/"):
|
|
raise ConfigError(f"route #{index}: path_suffix must not start or end with '/'")
|
|
if path_suffix in seen_suffixes:
|
|
raise ConfigError(f"route #{index}: duplicate path_suffix '{path_suffix}'")
|
|
seen_suffixes.add(path_suffix)
|
|
if not isinstance(port, int) or not (1 <= port <= 65535):
|
|
raise ConfigError(f"route #{index}: port must be an integer between 1 and 65535")
|
|
if upstream_scheme not in {"http", "https"}:
|
|
raise ConfigError(f"route #{index}: upstream_scheme must be http or https")
|
|
if not isinstance(upstream_host, str) or not upstream_host:
|
|
raise ConfigError(f"route #{index}: upstream_host must be a non-empty string")
|
|
|
|
normalized_routes.append(
|
|
{
|
|
"project_dir": project_dir,
|
|
"path_suffix": path_suffix,
|
|
"port": port,
|
|
"upstream_scheme": upstream_scheme,
|
|
"upstream_host": upstream_host,
|
|
}
|
|
)
|
|
|
|
return {
|
|
"server_name": server_name,
|
|
"certificate_name": certificate_name,
|
|
"routes": normalized_routes,
|
|
}
|
|
|
|
|
|
def _is_docker_host(upstream_host: str) -> bool:
|
|
return upstream_host != "host.docker.internal"
|
|
|
|
|
|
def _upstream_var(suffix: str) -> str:
|
|
return f"upstream_{suffix.replace('-', '_')}"
|
|
|
|
|
|
def _proxy_pass_directive(upstream_host: str, port: int, upstream_scheme: str, suffix: str, upstream_path: str = "/") -> str:
|
|
target = f"{upstream_scheme}://{upstream_host}:{port}{upstream_path}"
|
|
if _is_docker_host(upstream_host):
|
|
var = _upstream_var(suffix)
|
|
return f" set ${var} {target};\n proxy_pass ${var};"
|
|
return f" proxy_pass {target};"
|
|
|
|
|
|
def _render_static_location(host: str, port: int, suffix: str) -> str:
|
|
target = f"http://{host}:{port}/static/"
|
|
if _is_docker_host(host):
|
|
var = f"$upstream_{suffix.replace('-', '_')}_static"
|
|
return f" set {var} {target};\n proxy_pass {var};"
|
|
return f" proxy_pass {target};"
|
|
|
|
|
|
def render_location(route: dict[str, object]) -> str:
|
|
suffix = str(route["path_suffix"])
|
|
upstream_scheme = str(route["upstream_scheme"])
|
|
upstream_host = str(route["upstream_host"])
|
|
port = int(route["port"])
|
|
project_dir = str(route["project_dir"])
|
|
upstream_path = "/"
|
|
if suffix == "jellyfin":
|
|
upstream_path = ""
|
|
ssl_directives = ""
|
|
if upstream_scheme == "https":
|
|
ssl_directives = "\n proxy_ssl_server_name on;\n proxy_ssl_verify off;"
|
|
proxy_pass_block = _proxy_pass_directive(upstream_host, port, upstream_scheme, suffix, upstream_path)
|
|
|
|
return f""" # {project_dir}
|
|
location = /{suffix} {{
|
|
return 301 /{suffix}/;
|
|
}}
|
|
|
|
location /{suffix}/ {{
|
|
{proxy_pass_block}
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_set_header X-Forwarded-Prefix /{suffix};
|
|
proxy_set_header X-Forwarded-Uri $request_uri;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_http_version 1.1;
|
|
proxy_redirect off;
|
|
proxy_buffering off;{ssl_directives}
|
|
}}
|
|
"""
|
|
|
|
|
|
def render_nginx(config: dict) -> str:
|
|
server_name = config["server_name"]
|
|
certificate_name = config["certificate_name"]
|
|
routes: list[dict] = config["routes"]
|
|
|
|
route_blocks = "\n".join(render_location(route) for route in routes)
|
|
|
|
has_docker_upstream = any(_is_docker_host(str(route["upstream_host"])) for route in routes)
|
|
resolver_block = ""
|
|
if has_docker_upstream:
|
|
resolver_block = "\n resolver 127.0.0.11 valid=10s ipv6=off;\n"
|
|
|
|
extra_locations = ""
|
|
race_management_route = next((route for route in routes if route["project_dir"] == "/opt/docker/apps/race-management"), None)
|
|
if race_management_route is not None:
|
|
race_management_host = str(race_management_route["upstream_host"])
|
|
race_management_port = int(race_management_route["port"])
|
|
race_management_suffix = str(race_management_route["path_suffix"])
|
|
static_proxy_line = _render_static_location(race_management_host, race_management_port, race_management_suffix)
|
|
extra_locations += f"""
|
|
location /{race_management_suffix}/static/ {{
|
|
{static_proxy_line}
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
"""
|
|
digiped_route = next((route for route in routes if route["path_suffix"] == "digiped"), None)
|
|
if digiped_route is not None:
|
|
digiped_host = str(digiped_route["upstream_host"])
|
|
digiped_port = int(digiped_route["port"])
|
|
extra_locations += f"""
|
|
# digiped uses Angular's Vite dev server, which still emits a few root-level requests.
|
|
location /@vite/ {{
|
|
proxy_pass http://{digiped_host}:{digiped_port}/@vite/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
|
|
location /@fs/ {{
|
|
proxy_pass http://{digiped_host}:{digiped_port}/@fs/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
|
|
location ~ ^/(main|polyfills|styles)\\.js$ {{
|
|
proxy_pass http://{digiped_host}:{digiped_port}$request_uri;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
|
|
location = /styles.css {{
|
|
proxy_pass http://{digiped_host}:{digiped_port}/styles.css;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
|
|
location ~ ^/chunk-[A-Z0-9]+\\.js$ {{
|
|
proxy_pass http://{digiped_host}:{digiped_port}$request_uri;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
|
|
location = /favicon.ico {{
|
|
proxy_pass http://{digiped_host}:{digiped_port}/favicon.ico;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
|
|
location = /digiped.png {{
|
|
proxy_pass http://{digiped_host}:{digiped_port}/digiped.png;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port 443;
|
|
proxy_http_version 1.1;
|
|
proxy_redirect off;
|
|
proxy_buffering off;
|
|
}}
|
|
"""
|
|
return f"""map $http_upgrade $connection_upgrade {{
|
|
default upgrade;
|
|
'' close;
|
|
}}
|
|
|
|
server {{
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name {server_name};
|
|
|
|
location /.well-known/acme-challenge/ {{
|
|
root /var/www/certbot;
|
|
}}
|
|
|
|
location / {{
|
|
return 301 https://$host$request_uri;
|
|
}}
|
|
}}
|
|
|
|
server {{
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name {server_name};
|
|
|
|
client_max_body_size 256M;
|
|
ssl_certificate /etc/letsencrypt/live/{certificate_name}/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/{certificate_name}/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 10m;{resolver_block}
|
|
add_header X-Frame-Options DENY;
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
location /.well-known/acme-challenge/ {{
|
|
root /var/www/certbot;
|
|
}}
|
|
|
|
{extra_locations}
|
|
{route_blocks}
|
|
location = / {{
|
|
auth_basic "Restricted";
|
|
auth_basic_user_file /etc/nginx/.htpasswd;
|
|
root /usr/share/nginx/html;
|
|
try_files /index.html =404;
|
|
}}
|
|
|
|
location / {{
|
|
return 404;
|
|
}}
|
|
}}
|
|
"""
|
|
|
|
|
|
def render_index(config: dict) -> str:
|
|
server_name = html.escape(str(config["server_name"]))
|
|
items = "\n".join(
|
|
(
|
|
f' <li><a href="/{html.escape(str(route["path_suffix"]))}/">'
|
|
f'/{html.escape(str(route["path_suffix"]))}/</a>'
|
|
f' <span>{html.escape(str(route["project_dir"]))}</span></li>'
|
|
)
|
|
for route in config["routes"]
|
|
)
|
|
return f"""<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>{server_name} proxy</title>
|
|
<style>
|
|
:root {{
|
|
color-scheme: light;
|
|
font-family: "Segoe UI", sans-serif;
|
|
background: #f4f1ea;
|
|
color: #1f2933;
|
|
}}
|
|
body {{
|
|
margin: 0;
|
|
min-height: 100vh;
|
|
display: grid;
|
|
place-items: center;
|
|
background:
|
|
radial-gradient(circle at top left, rgba(192, 132, 84, 0.18), transparent 35%),
|
|
linear-gradient(135deg, #f7f3ec, #efe5d5);
|
|
}}
|
|
main {{
|
|
width: min(760px, calc(100vw - 2rem));
|
|
background: rgba(255, 255, 255, 0.92);
|
|
border: 1px solid rgba(31, 41, 51, 0.08);
|
|
border-radius: 20px;
|
|
padding: 2rem;
|
|
box-shadow: 0 24px 60px rgba(31, 41, 51, 0.12);
|
|
}}
|
|
h1 {{
|
|
margin-top: 0;
|
|
font-size: clamp(2rem, 5vw, 3rem);
|
|
}}
|
|
ul {{
|
|
padding-left: 1.25rem;
|
|
}}
|
|
li {{
|
|
margin: 0.8rem 0;
|
|
}}
|
|
a {{
|
|
color: #8f3b1b;
|
|
font-weight: 700;
|
|
text-decoration: none;
|
|
}}
|
|
span {{
|
|
color: #52606d;
|
|
font-size: 0.95rem;
|
|
}}
|
|
code {{
|
|
background: #f3ede3;
|
|
padding: 0.15rem 0.35rem;
|
|
border-radius: 6px;
|
|
}}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<main>
|
|
<h1>{server_name}</h1>
|
|
<p>Configured reverse-proxy routes:</p>
|
|
<ul>
|
|
{items}
|
|
</ul>
|
|
<p>Edit <code>config/proxy.yaml</code>, regenerate, then restart the proxy container.</p>
|
|
</main>
|
|
</body>
|
|
</html>
|
|
"""
|
|
|
|
|
|
def main() -> int:
|
|
try:
|
|
config = validate_config(parse_config(CONFIG_PATH))
|
|
except (OSError, ConfigError) as exc:
|
|
print(f"error: {exc}", file=sys.stderr)
|
|
return 1
|
|
|
|
GENERATED_DIR.mkdir(parents=True, exist_ok=True)
|
|
NGINX_OUTPUT_PATH.write_text(render_nginx(config), encoding="utf-8")
|
|
INDEX_OUTPUT_PATH.write_text(render_index(config), encoding="utf-8")
|
|
print(f"Rendered {NGINX_OUTPUT_PATH}")
|
|
print(f"Rendered {INDEX_OUTPUT_PATH}")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|