|
| 1 | +# |
| 2 | +# This file is responsible for the site which serves the main releases from codeorigin. By default, |
| 3 | +# it generates a site that operates in "break glass" emergency mode. All requests are served, |
| 4 | +# regardless of where they come from. |
| 5 | +# |
| 6 | +# In production, the CDN should add a private header to origin fetches. All requests which do not |
| 7 | +# include the correct header should be bounced via 301 redirect back to the CDN. This ensures that |
| 8 | +# even if a client attempts to link to codeorigin, it will still be served from the CDN. The end |
| 9 | +# result should be that codeorigin is only reachable for origin pulls from the CDN, decreasing its |
| 10 | +# load and reducing the attack surface for DDOSs. |
| 11 | +# |
| 12 | +# How to enable production mode: |
| 13 | +# |
| 14 | +# **VERY IMPORTANT**: You must first configure the CDN to send the header **BEFORE** you configure |
| 15 | +# codeorigin to ignore requests that omit the header. If you do not preserve this order you will |
| 16 | +# create a 301 redirect loop and **break a substantial portion of the internet.** |
| 17 | +# |
| 18 | +# 1. Add a header to origin pulls named "cdn-access". Set the value to something long and random. An |
| 19 | +# md5 hash of some random letters is probably good enough. |
| 20 | +# |
| 21 | +# 2. Rebuild this container and set the environment variable CDN_ACCESS_KEY to the value in step 1. |
| 22 | +# |
| 23 | +# 3. Test the container: |
| 24 | +# * First, check that requests with the correct header will not be redirected. This should always |
| 25 | +# return the actual file contents of the 3.5.1 release. |
| 26 | +# |
| 27 | +# * `curl -i -H 'cdn-access: {value from step 1}' https://CONTAINER_URL/jquery-3.5.1.js` |
| 28 | +# |
| 29 | +# * Next, check that requests without the header are redirected to code.jquery.com. This should |
| 30 | +# always return "HTTP/1.1 301 Moved Permanently" |
| 31 | +# |
| 32 | +# * `curl -i https://CONTAINER_URL/jquery-3.5.1.js` |
| 33 | +# |
| 34 | +# 4. Update the DNS to point the codeorigin CNAME to https://CONTAINER_URL |
| 35 | +# |
| 36 | +# |
| 37 | +# How to enable "Break glass" mode: |
| 38 | +# |
| 39 | +# If everything has melted down and you need to go into "break glass" mode, deploy this container |
| 40 | +# without a CDN_ACCESS_KEY environment variable. It will serve all requests without redirecting to |
| 41 | +# the CDN, regardless of the presence or absence of the header. |
| 42 | +# |
| 43 | +# What this means in real terms is that requests to https://code.jquery.com will still go through |
| 44 | +# the CDN, but requests to https://codeorigin.jquery.com will hit this container directly. This is a |
| 45 | +# recipe for a DDOS (innocent or intentional), so this should be a last resort while other issues |
| 46 | +# are worked out. |
| 47 | +# |
| 48 | + |
| 49 | +# Do not change the following line. The Dockerfile will add CDN header detection at build time if |
| 50 | +# the correct environment variable is set. |
| 51 | +##PLACEHOLDER-cdn_header_detection-DO_NOT_CHANGE## |
| 52 | + |
| 53 | + |
| 54 | +# CDN_ACCESS_KEY "0"; |
| 55 | +server { |
| 56 | + listen 80; |
| 57 | + listen [::]:80; |
| 58 | + server_name localhost; |
| 59 | + |
| 60 | + access_log /var/log/nginx/host.access.log main; |
| 61 | + |
| 62 | + location / { |
| 63 | + root /usr/share/nginx/html; |
| 64 | + index index.html index.htm; |
| 65 | + |
| 66 | + # Do not change the following line. The Dockerfile will add the reroute logic at build time if |
| 67 | + # the correct environment variable is set. |
| 68 | + ##PLACEHOLDER-cdn_reroute-DO_NOT_CHANGE## |
| 69 | + |
| 70 | + } |
| 71 | + |
| 72 | + #error_page 404 /404.html; |
| 73 | + |
| 74 | + # redirect server error pages to the static page /50x.html |
| 75 | + # |
| 76 | + error_page 500 502 503 504 /50x.html; |
| 77 | + location = /50x.html { |
| 78 | + root /usr/share/nginx/html; |
| 79 | + } |
| 80 | +} |
| 81 | + |
| 82 | +# vim: ts=2 sw=2 et |
0 commit comments