Skip to content

Commit f193a03

Browse files
brianwarnerKrinkle
brianwarner
authored and
Krinkle
committed
Build: Add Dockerfile for new static codeorigin server
* Add a basic Docker build. * Increase map_hash_bucket_size to accommodate longer CDN tokens. * Add project-specific forwards, and fix git forwards Per discussions, all origin requests redirect securely Signed-off-by: Brian Warner <brian@bdwarner.com>
1 parent 27a87f3 commit f193a03

6 files changed

Lines changed: 278 additions & 3 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33
/resources/sri-directives.json
44
/git/
55
/config.js*
6+
*.swp

‎Dockerfile‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
FROM nginx:alpine
2+
3+
# Install pre-reqs, since we're doing everything in one container for minimum complexity
4+
RUN apk add vim openrc
5+
6+
# Define the environment variable that will be used in the origin pull magic header
7+
ARG CDN_ACCESS_KEY=''
8+
9+
# Copy in the necessary config files
10+
COPY cfg/vimrc /etc/vim/vimrc
11+
COPY cfg/default.conf /etc/nginx/conf.d/default.conf
12+
13+
# If the CDN_ACCESS_KEY environment variable is *not* set, operate in "break glass" mode where the
14+
# container responds to all requests. Otherwise, look for the secret header the CDN adds to origin
15+
# pulls and only allow responses to those requests, and 301 the rest back to the CDN.
16+
#
17+
# Note: We're writing directly to the config files because nginx does not currently have a way to
18+
# access environment variables without significant workarounds. Furthermore, the variables are
19+
# required because nginx does not currently support nested if statements.
20+
RUN if [ -n "$CDN_ACCESS_KEY" ]; then \
21+
sed -i s/CDN_ACCESS_KEY_PLACEHOLDER/$CDN_ACCESS_KEY/g /etc/nginx/conf.d/default.conf && \
22+
sed -i s/##ACTIVATE-XCDNACCESS##//g /etc/nginx/conf.d/default.conf; \
23+
fi
24+
25+
# Load the releases into the container
26+
#
27+
# Avoid wildcard as that would flatten the directory structure.
28+
COPY cdn/ /usr/share/nginx/html/
29+
30+
EXPOSE 80
31+

‎README.md‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,55 @@
1-
codeorigin.jquery.com
1+
# Official project releases
22
=====================
33

4-
### Build
4+
This repo is used to build a Docker container that serves the codeorigin site for jQuery and related projects. It is designed to deploy easily, and includes a "break glass in case of emergency" minimal config mode should codeorigin need to be redeployed urgently.
55

6-
To build and deploy your changes for previewing in a [`jquery-wp-content`](https://github.com/jquery/jquery-wp-content) instance, follow the [workflow instructions](http://contribute.jquery.org/web-sites/#workflow) from our documentation on [contributing to jQuery Foundation web sites](http://contribute.jquery.org/web-sites/).
6+
It also contains the files necessary to build and deploy releases.jquery.com on a separate host, which provides an index of the files on codeorigin.
7+
8+
## Build a local copy of codeorigin
9+
10+
### Default, no restrictions (development or emergency mode)
11+
12+
To build a local container (defaults to "break glass" mode):
13+
14+
1. Install Docker
15+
1. Clone this repo, and `cd` into it
16+
1. Build the image: `docker build -t releases ./`
17+
1. Run the container, exposing port 80: `docker run -p 127.0.0.1:80:80/tcp releases`
18+
1. To exit the container, press `ctrl+c`
19+
20+
### Redirect non-origin pulls to CDN (production mode)
21+
22+
To build a local container in deployment mode (redirecting any requests without the magic header that indicates an origin pull), build the container with the header value in an environment variable:
23+
24+
1. Install Docker
25+
1. Clone this repo, and `cd` into it
26+
1. Generate a random string for the environment variable: ``CDN_ACCESS_KEY=`openssl rand -hex 32` ``
27+
1. Build the image: `docker build -t prod-releases --build-arg CDN_ACCESS_KEY=$CDN_ACCESS_KEY ./`
28+
1. Run the container, exposing port 80: `docker run -p 127.0.0.1:80:80/tcp prod-releases`
29+
1. To exit the container, press `ctrl+c`
30+
31+
Note that you will need to keep track of `$CDN_ACCESS_KEY` and add it to the headers sent for origin pulls. To test whether this is working correctly, you can use `curl`:
32+
33+
* This should always redirect to `code.jquery.com`: `curl -i localhost/jquery-3.1.1.js`
34+
* This should always deliver a copy of the file (don't forget to set the environment variable in your current shell): `curl -i -H "x-cdn-access: ${CDN_ACCESS_KEY}" localhost/jquery-3.1.1.js`
35+
36+
## Build the production site
37+
38+
To deploy, first generate the CDN access key. Next, you'll need to configure the container host to build from the Dockerfile in this repository, and use the CDN access key as build arguments. Finally, you'll configure the CDN to send both the Host header and the access key during origin pulls.
39+
40+
1. Generate the access key: ``CDN_ACCESS_KEY=`openssl rand -hex 16` ``
41+
1. Configure the container host to build from this repo, and set this build variable:
42+
* `CDN_ACCESS_KEY=(Insert the value of $CDN_ACCESS_KEY here)`
43+
1. Add the magic header and the host header at the CDN for origin pulls: `x-cdn-access: (Insert the value of $CDN_ACCESS_KEY here)|Host: (insert URL to app container)`
44+
45+
## In case of emergency
46+
47+
If you need to deploy a codeorigin container immediately, or if there are origin pull failures and you're not sure why, deploy the container without configuring the `CDN_ACCESS_KEY` environment variable. The codeorigin server will respond to all requests without redirecting non-origin pulls to the CDN, so this should be only used in case of emergencies.
48+
49+
## Build the releases sites
50+
51+
To build and deploy your changes for previewing in a [`jquery-wp-content`](https://github.com/jquery/jquery-wp-content) instance, follow the [workflow instructions](http://contribute.jquery.org/web-sites/#workflow) from our documentation on [contributing to jQuery web sites](http://contribute.jquery.org/web-sites/).
52+
53+
## Add or update project release files
54+
55+
To add a new release or update an existing one, simply commit the new file to the `cdn` directory and merge to the `main` branch. The container will rebuild automatically.

‎cfg/30-start-php-fpm7.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
php-fpm7 -D

‎cfg/default.conf‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
#
2+
# This file is responsible for the site which serves the main releases from codeorigin. By default,
3+
# it generates a site that operates in "break glass" emergency mode. All requests are served,
4+
# regardless of where they come from.
5+
#
6+
# In production, the CDN should add a private header to origin fetches. All requests which do not
7+
# include the correct header should be bounced via 301 redirect back to the CDN. This ensures that
8+
# even if a client attempts to link to codeorigin, it will still be served from the CDN. The end
9+
# result should be that codeorigin is only reachable for origin pulls from the CDN, decreasing its
10+
# load and reducing the attack surface for DDOSs.
11+
#
12+
# Configuration information is in the README.md file.
13+
#
14+
15+
# Increase map_hash_bucket_size to accommodate longer CDN tokens
16+
map_hash_bucket_size 128;
17+
18+
# Do not change the following lines. The Dockerfile will set the access key and remove the comment
19+
# at build time if the correct environment variable is set.
20+
##ACTIVATE-XCDNACCESS##map $http_x_cdn_access $reroute_to_cdn { default '1'; CDN_ACCESS_KEY_PLACEHOLDER '0'; }
21+
22+
server {
23+
listen 80;
24+
listen [::]:80;
25+
server_name localhost;
26+
27+
access_log /var/log/nginx/host.access.log main;
28+
29+
location / {
30+
root /usr/share/nginx/html;
31+
index index.html index.htm;
32+
33+
# Do not change the following line. The Dockerfile will set the access key and remove the
34+
# comment at build time if the correct environment variable is set.
35+
##ACTIVATE-XCDNACCESS##if ($reroute_to_cdn) { return 301 https://code2.jquery.com$uri; }
36+
37+
}
38+
39+
# PHP configuration for purge.php
40+
41+
location ~ \.php$ {
42+
root /usr/share/nginx/html;
43+
fastcgi_pass 127.0.0.1:9000;
44+
fastcgi_index index.php;
45+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
46+
include fastcgi_params;
47+
}
48+
49+
# Redirect requests to the root to the release viewer
50+
51+
location ~ ^/(?:/)?$ {
52+
expires off;
53+
gzip on;
54+
return 301 https://releases.jquery.com;
55+
}
56+
57+
# Redirect requests to paths known to be non-release files (e.g., git versions and their assets)
58+
# to the viewer. Jenkins needs access to the host that delivers these files, and codeorigin is
59+
# intended to be more tightly managed via github repo.
60+
61+
# Redirect to releases.jquery.com/
62+
63+
location ~ ^/git(?:/(.*))? {
64+
expires off;
65+
gzip on;
66+
return 301 https://releases.jquery.com$request_uri;
67+
}
68+
69+
# Redirect specific project pages to releases.jquery.com
70+
location ~ ^/jquery(?:/)?$ {
71+
expires off;
72+
gzip on;
73+
return 301 https://releases.jquery.com/jquery/;
74+
}
75+
76+
location ~ ^/ui(?:/)?$ {
77+
expires off;
78+
gzip on;
79+
return 301 https://releases.jquery.com/ui/;
80+
}
81+
82+
location ~ ^/mobile(?:/)?$ {
83+
expires off;
84+
gzip on;
85+
return 301 https://releases.jquery.com/mobile/;
86+
}
87+
88+
location ~ ^/color(?:/)?$ {
89+
expires off;
90+
gzip on;
91+
return 301 https://releases.jquery.com/color/;
92+
}
93+
94+
location ~ ^/qunit(?:/)?$ {
95+
expires off;
96+
gzip on;
97+
return 301 https://releases.jquery.com/qunit/;
98+
}
99+
100+
location ~ ^/pep(?:/)?$ {
101+
expires off;
102+
gzip on;
103+
return 301 https://releases.jquery.com/pep/;
104+
}
105+
106+
# Redirect to releases.jquery.com/git/
107+
108+
location ~* -git\.(js|min.js|slim.js|slim.min.js|css)$ {
109+
expires off;
110+
gzip on;
111+
return 301 https://releases.jquery.com/git$request_uri;
112+
}
113+
114+
location ^~ /mobile/git/ {
115+
expires off;
116+
gzip on;
117+
return 301 https://releases.jquery.com/git$request_uri;
118+
}
119+
120+
# Redirect some known legacy URLs that may still point to code.jquery.com. This list is a
121+
# workaround, and should not need to be expanded.
122+
123+
rewrite ^/ui/images/ui-icons_cc0000_256x240\.png$ https://releases.jquery.com/git/ui/images/ui-icons_cc0000_256x240.png permanent;
124+
rewrite ^/ui/images/ui-icons_777777_256x240\.png$ https://releases.jquery.com/git/ui/images/ui-icons_777777_256x240.png permanent;
125+
rewrite ^/ui/images/ui-icons_777620_256x240\.png$ https://releases.jquery.com/git/ui/images/ui-icons_777620_256x240.png permanent;
126+
rewrite ^/ui/images/ui-icons_555555_256x240\.png$ https://releases.jquery.com/git/ui/images/ui-icons_555555_256x240.png permanent;
127+
rewrite ^/ui/images/ui-icons_444444_256x240\.png$ https://releases.jquery.com/git/ui/images/ui-icons_444444_256x240.png permanent;
128+
rewrite ^/ui/images/ui-bg_flat_0_aaaaaa_40x100\.png$ https://releases.jquery.com/git/ui/images/ui-bg_flat_0_aaaaaa_40x100.png permanent;
129+
rewrite ^/ui/images/ui-icons_ffffff_256x240\.png$ https://releases.jquery.com/git/ui/images/ui-icons_ffffff_256x240.png permanent;
130+
rewrite ^/ui/_images/images/ui-icons_cc0000_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_cc0000_256x240.png permanent;
131+
rewrite ^/ui/_images/images/ui-bg_highlight-soft_75_cccccc_1x100\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_highlight-soft_75_cccccc_1x100.png permanent;
132+
rewrite ^/ui/_images/images/ui-icons_2e83ff_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_2e83ff_256x240.png permanent;
133+
rewrite ^/ui/_images/images/ui-bg_flat_75_ffffff_40x100\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_flat_75_ffffff_40x100.png permanent;
134+
rewrite ^/ui/_images/images/ui-bg_glass_95_fef1ec_1x400\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_glass_95_fef1ec_1x400.png permanent;
135+
rewrite ^/ui/_images/images/ui-icons_777777_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_777777_256x240.png permanent;
136+
rewrite ^/ui/_images/images/ui-bg_glass_65_ffffff_1x400\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_glass_65_ffffff_1x400.png permanent;
137+
rewrite ^/ui/_images/images/ui-icons_777620_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_777620_256x240.png permanent;
138+
rewrite ^/ui/_images/images/ui-icons_555555_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_555555_256x240.png permanent;
139+
rewrite ^/ui/_images/images/ui-bg_glass_75_e6e6e6_1x400\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_glass_75_e6e6e6_1x400.png permanent;
140+
rewrite ^/ui/_images/images/ui-icons_222222_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_222222_256x240.png permanent;
141+
rewrite ^/ui/_images/images/ui-icons_888888_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_888888_256x240.png permanent;
142+
rewrite ^/ui/_images/images/ui-icons_444444_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_444444_256x240.png permanent;
143+
rewrite ^/ui/_images/images/ui-icons_cd0a0a_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_cd0a0a_256x240.png permanent;
144+
rewrite ^/ui/_images/images/ui-bg_glass_55_fbf9ee_1x400\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_glass_55_fbf9ee_1x400.png permanent;
145+
rewrite ^/ui/_images/images/ui-icons_454545_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_454545_256x240.png permanent;
146+
rewrite ^/ui/_images/images/ui-bg_glass_75_dadada_1x400\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_glass_75_dadada_1x400.png permanent;
147+
rewrite ^/ui/_images/images/ui-bg_flat_0_aaaaaa_40x100\.png$ https://releases.jquery.com/git/ui/_images/images/ui-bg_flat_0_aaaaaa_40x100.png permanent;
148+
rewrite ^/ui/_images/images/ui-icons_ffffff_256x240\.png$ https://releases.jquery.com/git/ui/_images/images/ui-icons_ffffff_256x240.png permanent;
149+
rewrite ^/ui/_images/ui-bg_highlight-soft_75_cccccc_1x100\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_highlight-soft_75_cccccc_1x100.png permanent;
150+
rewrite ^/ui/_images/ui-icons_2e83ff_256x240\.png$ https://releases.jquery.com/git/ui/_images/ui-icons_2e83ff_256x240.png permanent;
151+
rewrite ^/ui/_images/ui-bg_flat_75_ffffff_40x100\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_flat_75_ffffff_40x100.png permanent;
152+
rewrite ^/ui/_images/ui-bg_glass_95_fef1ec_1x400\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_glass_95_fef1ec_1x400.png permanent;
153+
rewrite ^/ui/_images/ui-bg_glass_65_ffffff_1x400\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_glass_65_ffffff_1x400.png permanent;
154+
rewrite ^/ui/_images/ui-bg_glass_75_e6e6e6_1x400\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_glass_75_e6e6e6_1x400.png permanent;
155+
rewrite ^/ui/_images/ui-icons_222222_256x240\.png$ https://releases.jquery.com/git/ui/_images/ui-icons_222222_256x240.png permanent;
156+
rewrite ^/ui/_images/ui-icons_888888_256x240\.png$ https://releases.jquery.com/git/ui/_images/ui-icons_888888_256x240.png permanent;
157+
rewrite ^/ui/_images/ui-icons_cd0a0a_256x240\.png$ https://releases.jquery.com/git/ui/_images/ui-icons_cd0a0a_256x240.png permanent;
158+
rewrite ^/ui/_images/ui-bg_glass_55_fbf9ee_1x400\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_glass_55_fbf9ee_1x400.png permanent;
159+
rewrite ^/ui/_images/ui-icons_454545_256x240\.png$ https://releases.jquery.com/git/ui/_images/ui-icons_454545_256x240.png permanent;
160+
rewrite ^/ui/_images/ui-bg_glass_75_dadada_1x400\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_glass_75_dadada_1x400.png permanent;
161+
rewrite ^/ui/_images/ui-bg_flat_0_aaaaaa_40x100\.png$ https://releases.jquery.com/git/ui/_images/ui-bg_flat_0_aaaaaa_40x100.png permanent;
162+
163+
#error_page 404 /404.html;
164+
165+
# redirect server error pages to the static page /50x.html
166+
#
167+
error_page 500 502 503 504 /50x.html;
168+
location = /50x.html {
169+
root /usr/share/nginx/html;
170+
}
171+
}
172+
173+
# vim: ts=2 sw=2 et

‎cfg/vimrc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
set nocompatible " Use Vim defaults (much better!)
2+
set bs=2 " Allow backspacing over everything in insert mode
3+
set ai " Always set auto-indenting on
4+
set history=50 " keep 50 lines of command history
5+
set ruler " Show the cursor position all the time
6+
7+
" Don't use Ex mode, use Q for formatting
8+
map Q gq
9+
10+
" When doing tab completion, give the following files lower priority.
11+
set suffixes+=.info,.aux,.log,.dvi,.bbl,.out,.o,.lo
12+
13+
set modeline
14+
syntax on
15+
autocmd BufRead APKBUILD set filetype=sh
16+

0 commit comments

Comments
 (0)