v2.1.0 (#293)
* Fix wrapping when too many hosts are shown (#207) * Update npm packages, fixes CVE-2019-10757 * Revert some breaking packages * Major overhaul - Docker buildx support in CI - Cypress API Testing in CI - Restructured folder layout (insert clean face meme) - Added Swagger documentation and validate API against that (to be completed) - Use common base image for all supported archs, which includes updated nginx with ipv6 support - Updated certbot and changes required for it - Large amount of Hosts names will wrap in UI - Updated packages for frontend - Version bump 2.1.0 * Updated documentation * Fix JWT expire time going crazy. Now set to 1day * Backend JS formatting rules * Remove v1 importer, I doubt anyone is using v1 anymore * Added backend formatting rules and enforce them in Jenkins builds * Fix CI, doesn't need a tty * Thanks bcrypt. Why can't you just be normal. * Cleanup after syntax check Co-authored-by: Marcelo Castagna <margaale@users.noreply.github.com>
This commit is contained in:
jc21
GitHub
1
docker/rootfs/etc/nginx/conf.d/include/.gitignore
vendored
Normal file
1
docker/rootfs/etc/nginx/conf.d/include/.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
resolvers.conf
|
||||
31
docker/rootfs/etc/nginx/conf.d/include/assets.conf
Normal file
31
docker/rootfs/etc/nginx/conf.d/include/assets.conf
Normal file
@ -0,0 +1,31 @@
|
||||
location ~* ^.*\.(css|js|jpe?g|gif|png|woff|eot|ttf|svg|ico|css\.map|js\.map)$ {
|
||||
if_modified_since off;
|
||||
|
||||
# use the public cache
|
||||
proxy_cache public-cache;
|
||||
proxy_cache_key $host$request_uri;
|
||||
|
||||
# ignore these headers for media
|
||||
proxy_ignore_headers Set-Cookie Cache-Control Expires X-Accel-Expires;
|
||||
|
||||
# cache 200s and also 404s (not ideal but there are a few 404 images for some reason)
|
||||
proxy_cache_valid any 30m;
|
||||
proxy_cache_valid 404 1m;
|
||||
|
||||
# strip this header to avoid If-Modified-Since requests
|
||||
proxy_hide_header Last-Modified;
|
||||
proxy_hide_header Cache-Control;
|
||||
proxy_hide_header Vary;
|
||||
|
||||
proxy_cache_bypass 0;
|
||||
proxy_no_cache 0;
|
||||
|
||||
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504 http_404;
|
||||
proxy_connect_timeout 5s;
|
||||
proxy_read_timeout 45s;
|
||||
|
||||
expires @30m;
|
||||
access_log off;
|
||||
|
||||
include conf.d/include/proxy.conf;
|
||||
}
|
||||
136
docker/rootfs/etc/nginx/conf.d/include/block-exploits.conf
Normal file
136
docker/rootfs/etc/nginx/conf.d/include/block-exploits.conf
Normal file
@ -0,0 +1,136 @@
|
||||
## Block SQL injections
|
||||
set $block_sql_injections 0;
|
||||
|
||||
if ($query_string ~ "union.*select.*\(") {
|
||||
set $block_sql_injections 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "union.*all.*select.*") {
|
||||
set $block_sql_injections 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "concat.*\(") {
|
||||
set $block_sql_injections 1;
|
||||
}
|
||||
|
||||
if ($block_sql_injections = 1) {
|
||||
return 403;
|
||||
}
|
||||
|
||||
## Block file injections
|
||||
set $block_file_injections 0;
|
||||
|
||||
if ($query_string ~ "[a-zA-Z0-9_]=http://") {
|
||||
set $block_file_injections 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
|
||||
set $block_file_injections 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
|
||||
set $block_file_injections 1;
|
||||
}
|
||||
|
||||
if ($block_file_injections = 1) {
|
||||
return 403;
|
||||
}
|
||||
|
||||
## Block common exploits
|
||||
set $block_common_exploits 0;
|
||||
|
||||
if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
|
||||
set $block_common_exploits 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
|
||||
set $block_common_exploits 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
|
||||
set $block_common_exploits 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "proc/self/environ") {
|
||||
set $block_common_exploits 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
|
||||
set $block_common_exploits 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "base64_(en|de)code\(.*\)") {
|
||||
set $block_common_exploits 1;
|
||||
}
|
||||
|
||||
if ($block_common_exploits = 1) {
|
||||
return 403;
|
||||
}
|
||||
|
||||
## Block spam
|
||||
set $block_spam 0;
|
||||
|
||||
if ($query_string ~ "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
|
||||
set $block_spam 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "\b(erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
|
||||
set $block_spam 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
|
||||
set $block_spam 1;
|
||||
}
|
||||
|
||||
if ($query_string ~ "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
|
||||
set $block_spam 1;
|
||||
}
|
||||
|
||||
if ($block_spam = 1) {
|
||||
return 403;
|
||||
}
|
||||
|
||||
## Block user agents
|
||||
set $block_user_agents 0;
|
||||
|
||||
# Disable Akeeba Remote Control 2.5 and earlier
|
||||
if ($http_user_agent ~ "Indy Library") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
# Common bandwidth hoggers and hacking tools.
|
||||
if ($http_user_agent ~ "libwww-perl") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~ "GetRight") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~ "GetWeb!") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~ "Go!Zilla") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~ "Download Demon") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~ "Go-Ahead-Got-It") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~ "TurnitinBot") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($http_user_agent ~ "GrabNet") {
|
||||
set $block_user_agents 1;
|
||||
}
|
||||
|
||||
if ($block_user_agents = 1) {
|
||||
return 403;
|
||||
}
|
||||
3
docker/rootfs/etc/nginx/conf.d/include/force-ssl.conf
Normal file
3
docker/rootfs/etc/nginx/conf.d/include/force-ssl.conf
Normal file
@ -0,0 +1,3 @@
|
||||
if ($scheme = "http") {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
196
docker/rootfs/etc/nginx/conf.d/include/ip_ranges.conf
Normal file
196
docker/rootfs/etc/nginx/conf.d/include/ip_ranges.conf
Normal file
@ -0,0 +1,196 @@
|
||||
|
||||
set_real_ip_from 144.220.0.0/16;
|
||||
|
||||
set_real_ip_from 52.124.128.0/17;
|
||||
|
||||
set_real_ip_from 54.230.0.0/16;
|
||||
|
||||
set_real_ip_from 54.239.128.0/18;
|
||||
|
||||
set_real_ip_from 52.82.128.0/19;
|
||||
|
||||
set_real_ip_from 99.84.0.0/16;
|
||||
|
||||
set_real_ip_from 204.246.172.0/24;
|
||||
|
||||
set_real_ip_from 205.251.192.0/19;
|
||||
|
||||
set_real_ip_from 54.239.192.0/19;
|
||||
|
||||
set_real_ip_from 70.132.0.0/18;
|
||||
|
||||
set_real_ip_from 13.32.0.0/15;
|
||||
|
||||
set_real_ip_from 13.224.0.0/14;
|
||||
|
||||
set_real_ip_from 13.35.0.0/16;
|
||||
|
||||
set_real_ip_from 204.246.164.0/22;
|
||||
|
||||
set_real_ip_from 204.246.168.0/22;
|
||||
|
||||
set_real_ip_from 71.152.0.0/17;
|
||||
|
||||
set_real_ip_from 216.137.32.0/19;
|
||||
|
||||
set_real_ip_from 205.251.249.0/24;
|
||||
|
||||
set_real_ip_from 99.86.0.0/16;
|
||||
|
||||
set_real_ip_from 52.46.0.0/18;
|
||||
|
||||
set_real_ip_from 52.84.0.0/15;
|
||||
|
||||
set_real_ip_from 204.246.173.0/24;
|
||||
|
||||
set_real_ip_from 130.176.0.0/16;
|
||||
|
||||
set_real_ip_from 64.252.64.0/18;
|
||||
|
||||
set_real_ip_from 204.246.174.0/23;
|
||||
|
||||
set_real_ip_from 64.252.128.0/18;
|
||||
|
||||
set_real_ip_from 205.251.254.0/24;
|
||||
|
||||
set_real_ip_from 143.204.0.0/16;
|
||||
|
||||
set_real_ip_from 205.251.252.0/23;
|
||||
|
||||
set_real_ip_from 204.246.176.0/20;
|
||||
|
||||
set_real_ip_from 13.249.0.0/16;
|
||||
|
||||
set_real_ip_from 54.240.128.0/18;
|
||||
|
||||
set_real_ip_from 205.251.250.0/23;
|
||||
|
||||
set_real_ip_from 52.222.128.0/17;
|
||||
|
||||
set_real_ip_from 54.182.0.0/16;
|
||||
|
||||
set_real_ip_from 54.192.0.0/16;
|
||||
|
||||
set_real_ip_from 13.124.199.0/24;
|
||||
|
||||
set_real_ip_from 34.226.14.0/24;
|
||||
|
||||
set_real_ip_from 52.15.127.128/26;
|
||||
|
||||
set_real_ip_from 35.158.136.0/24;
|
||||
|
||||
set_real_ip_from 52.57.254.0/24;
|
||||
|
||||
set_real_ip_from 18.216.170.128/25;
|
||||
|
||||
set_real_ip_from 13.52.204.0/23;
|
||||
|
||||
set_real_ip_from 13.54.63.128/26;
|
||||
|
||||
set_real_ip_from 13.59.250.0/26;
|
||||
|
||||
set_real_ip_from 13.210.67.128/26;
|
||||
|
||||
set_real_ip_from 35.167.191.128/26;
|
||||
|
||||
set_real_ip_from 52.47.139.0/24;
|
||||
|
||||
set_real_ip_from 52.199.127.192/26;
|
||||
|
||||
set_real_ip_from 52.212.248.0/26;
|
||||
|
||||
set_real_ip_from 52.66.194.128/26;
|
||||
|
||||
set_real_ip_from 13.113.203.0/24;
|
||||
|
||||
set_real_ip_from 99.79.168.0/23;
|
||||
|
||||
set_real_ip_from 34.195.252.0/24;
|
||||
|
||||
set_real_ip_from 35.162.63.192/26;
|
||||
|
||||
set_real_ip_from 34.223.12.224/27;
|
||||
|
||||
set_real_ip_from 52.56.127.0/25;
|
||||
|
||||
set_real_ip_from 34.223.80.192/26;
|
||||
|
||||
set_real_ip_from 13.228.69.0/24;
|
||||
|
||||
set_real_ip_from 34.216.51.0/25;
|
||||
|
||||
set_real_ip_from 3.231.2.0/25;
|
||||
|
||||
set_real_ip_from 54.233.255.128/26;
|
||||
|
||||
set_real_ip_from 18.200.212.0/23;
|
||||
|
||||
set_real_ip_from 52.52.191.128/26;
|
||||
|
||||
set_real_ip_from 3.234.232.224/27;
|
||||
|
||||
set_real_ip_from 52.78.247.128/26;
|
||||
|
||||
set_real_ip_from 52.220.191.0/26;
|
||||
|
||||
set_real_ip_from 34.232.163.208/29;
|
||||
|
||||
set_real_ip_from 2600:9000:eee::/48;
|
||||
|
||||
set_real_ip_from 2600:9000:4000::/36;
|
||||
|
||||
set_real_ip_from 2600:9000:3000::/36;
|
||||
|
||||
set_real_ip_from 2600:9000:f000::/36;
|
||||
|
||||
set_real_ip_from 2600:9000:fff::/48;
|
||||
|
||||
set_real_ip_from 2600:9000:2000::/36;
|
||||
|
||||
set_real_ip_from 2600:9000:1000::/36;
|
||||
|
||||
set_real_ip_from 2600:9000:ddd::/48;
|
||||
|
||||
set_real_ip_from 2600:9000:5300::/40;
|
||||
|
||||
set_real_ip_from 173.245.48.0/20;
|
||||
|
||||
set_real_ip_from 103.21.244.0/22;
|
||||
|
||||
set_real_ip_from 103.22.200.0/22;
|
||||
|
||||
set_real_ip_from 103.31.4.0/22;
|
||||
|
||||
set_real_ip_from 141.101.64.0/18;
|
||||
|
||||
set_real_ip_from 108.162.192.0/18;
|
||||
|
||||
set_real_ip_from 190.93.240.0/20;
|
||||
|
||||
set_real_ip_from 188.114.96.0/20;
|
||||
|
||||
set_real_ip_from 197.234.240.0/22;
|
||||
|
||||
set_real_ip_from 198.41.128.0/17;
|
||||
|
||||
set_real_ip_from 162.158.0.0/15;
|
||||
|
||||
set_real_ip_from 104.16.0.0/12;
|
||||
|
||||
set_real_ip_from 172.64.0.0/13;
|
||||
|
||||
set_real_ip_from 131.0.72.0/22;
|
||||
|
||||
set_real_ip_from 2400:cb00::/32;
|
||||
|
||||
set_real_ip_from 2606:4700::/32;
|
||||
|
||||
set_real_ip_from 2803:f800::/32;
|
||||
|
||||
set_real_ip_from 2405:b500::/32;
|
||||
|
||||
set_real_ip_from 2405:8100::/32;
|
||||
|
||||
set_real_ip_from 2a06:98c0::/29;
|
||||
|
||||
set_real_ip_from 2c0f:f248::/32;
|
||||
@ -0,0 +1,29 @@
|
||||
# Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
|
||||
# We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel
|
||||
# other regex checks, because in our other config files have regex rule that denies access to files with dotted names.
|
||||
location ^~ /.well-known/acme-challenge/ {
|
||||
# Since this is for letsencrypt authentication of a domain and they do not give IP ranges of their infrastructure
|
||||
# we need to open up access by turning off auth and IP ACL for this location.
|
||||
auth_basic off;
|
||||
allow all;
|
||||
|
||||
# Set correct content type. According to this:
|
||||
# https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29
|
||||
# Current specification requires "text/plain" or no content header at all.
|
||||
# It seems that "text/plain" is a safe option.
|
||||
default_type "text/plain";
|
||||
|
||||
# This directory must be the same as in /etc/letsencrypt/cli.ini
|
||||
# as "webroot-path" parameter. Also don't forget to set "authenticator" parameter
|
||||
# there to "webroot".
|
||||
# Do NOT use alias, use root! Target directory is located here:
|
||||
# /var/www/common/letsencrypt/.well-known/acme-challenge/
|
||||
root /data/letsencrypt-acme-challenge;
|
||||
}
|
||||
|
||||
# Hide /acme-challenge subdirectory and return 404 on all requests.
|
||||
# It is somewhat more secure than letting Nginx return 403.
|
||||
# Ending slash is important!
|
||||
location = /.well-known/acme-challenge/ {
|
||||
return 404;
|
||||
}
|
||||
6
docker/rootfs/etc/nginx/conf.d/include/proxy.conf
Normal file
6
docker/rootfs/etc/nginx/conf.d/include/proxy.conf
Normal file
@ -0,0 +1,6 @@
|
||||
add_header X-Served-By $host;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-Scheme $scheme;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_pass $forward_scheme://$server:$port;
|
||||
9
docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf
Normal file
9
docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf
Normal file
@ -0,0 +1,9 @@
|
||||
ssl_session_timeout 5m;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
# intermediate configuration. tweak to your needs.
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers 'EECDH+AESGCM:AES256+EECDH:AES256+EDH:EDH+AESGCM:ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-
|
||||
ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AE
|
||||
S128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES';
|
||||
ssl_prefer_server_ciphers on;
|
||||
Reference in New Issue
Block a user