sascha/esphome
1
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2025-10-29 22:24:26 +00:00
Code Issues Releases Wiki Activity

Refactor NGINX configuration of Home Assistant Add-on (#4312)

Browse Source
This commit is contained in:
Franck Nijhof
2023-01-18 19:54:27 +01:00
committed by GitHub
parent fd6d6cfb6c
commit 84698ae888
10 changed files with 60 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docker/ha-addon-rootfs/etc/nginx/includes/proxy_params.conf
View File

@@ -1,9 +1,9 @@
proxy_http_version 1.1;
proxy_ignore_client_abort off;
proxy_read_timeout 86400s;
proxy_redirect off;
proxy_send_timeout 86400s;
proxy_max_temp_file_size 0;
proxy_http_version 1.1;
proxy_ignore_client_abort off;
proxy_read_timeout 86400s;
proxy_redirect off;
proxy_send_timeout 86400s;
proxy_max_temp_file_size 0;
proxy_set_header Accept-Encoding "";
proxy_set_header Connection $connection_upgrade;

6
docker/ha-addon-rootfs/etc/nginx/includes/server_params.conf
View File

@@ -1,5 +1,7 @@
root /dev/null;
server_name $hostname;
root /dev/null;
server_name $hostname;
client_max_body_size 512m;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

7
docker/ha-addon-rootfs/etc/nginx/includes/ssl_params.conf
View File

@@ -1,7 +1,6 @@
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA;
ssl_ecdh_curve secp384r1;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

3
docker/ha-addon-rootfs/etc/nginx/includes/upstream.conf Normal file
View File

@@ -0,0 +1,3 @@
upstream esphome {
server unix:/var/run/esphome.sock;
}

25
docker/ha-addon-rootfs/etc/nginx/nginx.conf
View File

@@ -2,7 +2,6 @@ daemon off;
user root;
pid /var/run/nginx.pid;
worker_processes 1;
# Hass.io addon log
error_log /proc/1/fd/1 error;
events {
worker_connections 1024;
@@ -10,24 +9,22 @@ events {
http {
include /etc/nginx/includes/mime.types;
access_log stdout;
default_type application/octet-stream;
gzip on;
keepalive_timeout 65;
sendfile on;
server_tokens off;
access_log off;
default_type application/octet-stream;
gzip on;
keepalive_timeout 65;
sendfile on;
server_tokens off;
tcp_nodelay on;
tcp_nopush on;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
# Use Hass.io supervisor as resolver
resolver 172.30.32.2;
upstream esphome {
server unix:/var/run/esphome.sock;
}
include /etc/nginx/includes/upstream.conf;
include /etc/nginx/servers/*.conf;
}

1
docker/ha-addon-rootfs/etc/nginx/servers/.gitkeep Normal file
View File

@@ -0,0 +1 @@
Without requirements or design, programming is the art of adding bugs to an empty text file. (Louis Srygley)

12
docker/ha-addon-rootfs/etc/nginx/servers/direct.disabled
View File

@@ -1,12 +0,0 @@
server {
listen %%port%% default_server;
include /etc/nginx/includes/server_params.conf;
include /etc/nginx/includes/proxy_params.conf;
# Clear Hass.io Ingress header
proxy_set_header X-HA-Ingress "";
location / {
proxy_pass http://esphome;
}
}

20
docker/ha-addon-rootfs/etc/nginx/servers/direct-ssl.disabled → docker/ha-addon-rootfs/etc/nginx/templates/direct.gtpl
View File

@@ -1,20 +1,26 @@
server {
listen %%port%% default_server ssl http2;
{{ if not .ssl }}
listen 6052 default_server;
{{ else }}
listen 6052 default_server ssl http2;
{{ end }}
include /etc/nginx/includes/server_params.conf;
include /etc/nginx/includes/proxy_params.conf;
{{ if .ssl }}
include /etc/nginx/includes/ssl_params.conf;
ssl on;
ssl_certificate /ssl/%%certfile%%;
ssl_certificate_key /ssl/%%keyfile%%;
# Clear Hass.io Ingress header
proxy_set_header X-HA-Ingress "";
ssl_certificate /ssl/{{ .certfile }};
ssl_certificate_key /ssl/{{ .keyfile }};
# Redirect http requests to https on the same port.
# https://rageagainstshell.com/2016/11/redirect-http-to-https-on-the-same-port-in-nginx/
error_page 497 https://$http_host$request_uri;
{{ end }}
# Clear Home Assistant Ingress header
proxy_set_header X-HA-Ingress "";
location / {
proxy_pass http://esphome;

4
docker/ha-addon-rootfs/etc/nginx/servers/ingress.conf → docker/ha-addon-rootfs/etc/nginx/templates/ingress.gtpl
View File

@@ -1,13 +1,13 @@
server {
listen %%interface%%:%%port%% default_server;
listen {{ .interface }}:{{ .port }} default_server;
include /etc/nginx/includes/server_params.conf;
include /etc/nginx/includes/proxy_params.conf;
# Set Home Assistant Ingress header
proxy_set_header X-HA-Ingress "YES";
location / {
# Only allow from Hass.io supervisor
allow 172.30.32.2;
deny all;