Version Bump

* New feature: custom locations

* Custom locations: exteding config generator

* Custom locations: refactoring

* Fixing proxy_host table on small screens

* Custom locations: translations

* Custom locations bugfix

* Custom locations bugfix

* PR #74 fixes

Dockerfile

@@ -29,4 +29,11 @@ ADD knexfile.js         /app/knexfile.js
 VOLUME [ "/data", "/etc/letsencrypt" ]
 CMD [ "/init" ]
 
+# Ports
+EXPOSE 80
+EXPOSE 81
+EXPOSE 443
+EXPOSE 9876
+
 HEALTHCHECK --interval=15s --timeout=3s CMD curl -f http://localhost:9876/health || exit 1
+

Dockerfile.arm64

@@ -0,0 +1,38 @@
+FROM jc21/nginx-proxy-manager-base:arm64
+
+MAINTAINER Jamie Curnow <jc@jc21.com>
+LABEL maintainer="Jamie Curnow <jc@jc21.com>"
+
+ENV SUPPRESS_NO_CONFIG_WARNING=1
+ENV S6_FIX_ATTRS_HIDDEN=1
+RUN echo "fs.file-max = 65535" > /etc/sysctl.conf
+
+# Nginx, Node and required packages should already be installed from the base image
+
+# root filesystem
+COPY rootfs /
+
+# s6 overlay
+RUN curl -L -o /tmp/s6-overlay-aarch64.tar.gz "https://github.com/just-containers/s6-overlay/releases/download/v1.21.8.0/s6-overlay-aarch64.tar.gz" \
+    && tar xzf /tmp/s6-overlay-aarch64.tar.gz -C /
+
+# App
+ENV NODE_ENV=production
+
+ADD dist                /app/dist
+ADD node_modules        /app/node_modules
+ADD src/backend         /app/src/backend
+ADD package.json        /app/package.json
+ADD knexfile.js         /app/knexfile.js
+
+# Volumes
+VOLUME [ "/data", "/etc/letsencrypt" ]
+CMD [ "/init" ]
+
+# Ports
+EXPOSE 80
+EXPOSE 81
+EXPOSE 443
+EXPOSE 9876
+
+HEALTHCHECK --interval=15s --timeout=3s CMD curl -f http://localhost:9876/health || exit 1

Dockerfile.armhf

@@ -29,4 +29,10 @@ ADD knexfile.js         /app/knexfile.js
 VOLUME [ "/data", "/etc/letsencrypt" ]
 CMD [ "/init" ]
 
+# Ports
+EXPOSE 80
+EXPOSE 81
+EXPOSE 443
+EXPOSE 9876
+
 HEALTHCHECK --interval=15s --timeout=3s CMD curl -f http://localhost:9876/health || exit 1

Dockerfile.armv6

@@ -0,0 +1,38 @@
+FROM jc21/nginx-proxy-manager-base:armv6
+
+MAINTAINER Jamie Curnow <jc@jc21.com>
+LABEL maintainer="Jamie Curnow <jc@jc21.com>"
+
+ENV SUPPRESS_NO_CONFIG_WARNING=1
+ENV S6_FIX_ATTRS_HIDDEN=1
+RUN echo "fs.file-max = 65535" > /etc/sysctl.conf
+
+# Nginx, Node and required packages should already be installed from the base image
+
+# root filesystem
+COPY rootfs /
+
+# s6 overlay
+RUN curl -L -o /tmp/s6-overlay-arm.tar.gz "https://github.com/just-containers/s6-overlay/releases/download/v1.21.8.0/s6-overlay-arm.tar.gz" \
+    && tar xzf /tmp/s6-overlay-arm.tar.gz -C /
+
+# App
+ENV NODE_ENV=production
+
+ADD dist                /app/dist
+ADD node_modules        /app/node_modules
+ADD src/backend         /app/src/backend
+ADD package.json        /app/package.json
+ADD knexfile.js         /app/knexfile.js
+
+# Volumes
+VOLUME [ "/data", "/etc/letsencrypt" ]
+CMD [ "/init" ]
+
+# Ports
+EXPOSE 80
+EXPOSE 81
+EXPOSE 443
+EXPOSE 9876
+
+HEALTHCHECK --interval=15s --timeout=3s CMD curl -f http://localhost:9876/health || exit 1

Jenkinsfile

@@ -5,100 +5,213 @@ pipeline {
   }
   agent any
   environment {
-    IMAGE_NAME          = "nginx-proxy-manager"
-    BASE_IMAGE_NAME     = "jc21/nginx-proxy-manager-base:v2"
-    TEMP_IMAGE_NAME     = "nginx-proxy-manager-build_${BUILD_NUMBER}"
-    TEMP_IMAGE_NAME_ARM = "nginx-proxy-manager-arm-build_${BUILD_NUMBER}"
-    TAG_VERSION         = getPackageVersion()
-    MAJOR_VERSION       = "2"
+    IMAGE            = "nginx-proxy-manager"
+    BASE_IMAGE       = "jc21/nginx-proxy-manager-base"
+    TEMP_IMAGE       = "nginx-proxy-manager-build_${BUILD_NUMBER}"
+    TEMP_IMAGE_ARM   = "nginx-proxy-manager-arm-build_${BUILD_NUMBER}"
+    TEMP_IMAGE_ARM64 = "nginx-proxy-manager-arm64-build_${BUILD_NUMBER}"
+    TAG_VERSION      = getPackageVersion()
+    MAJOR_VERSION    = "2"
+    BRANCH_LOWER     = "${BRANCH_NAME.toLowerCase()}"
   }
   stages {
-    stage('Prepare') {
+    stage('Build PR') {
+      when {
+        changeRequest()
+      }
       steps {
-        sh 'docker pull $DOCKER_CI_TOOLS'
+        ansiColor('xterm') {
+          // Codebase
+          sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} yarn install'
+          sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} npm run-script build'
+          sh 'rm -rf node_modules'
+          sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} yarn install --prod'
+          sh 'docker run --rm -v $(pwd):/data ${DOCKER_CI_TOOLS} node-prune'
+
+          // Docker Build
+          sh 'docker build --pull --no-cache --squash --compress -t ${TEMP_IMAGE} .'
+
+          // Dockerhub
+          sh 'docker tag ${TEMP_IMAGE} docker.io/jc21/${IMAGE}:github-${BRANCH_LOWER}'
+          withCredentials([usernamePassword(credentialsId: 'jc21-dockerhub', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
+            sh "docker login -u '${duser}' -p '${dpass}'"
+            sh 'docker push docker.io/jc21/${IMAGE}:github-${BRANCH_LOWER}'
+          }
+
+          sh 'docker rmi ${TEMP_IMAGE}'
+
+          script {
+            def comment = pullRequest.comment("Docker Image for build ${BUILD_NUMBER} is available on [DockerHub](https://cloud.docker.com/repository/docker/jc21/${IMAGE}) as `jc21/${IMAGE}:github-${BRANCH_LOWER}`")
+          }
+        }
       }
     }
-    stage('Build') {
+    stage('Build Develop') {
+      when {
+        branch 'develop'
+      }
+      steps {
+        ansiColor('xterm') {
+          // Codebase
+          sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} yarn install'
+          sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} npm run-script build'
+          sh 'rm -rf node_modules'
+          sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} yarn install --prod'
+          sh 'docker run --rm -v $(pwd):/data ${DOCKER_CI_TOOLS} node-prune'
+
+          // Docker Build
+          sh 'docker build --pull --no-cache --squash --compress -t ${TEMP_IMAGE} .'
+
+          // Dockerhub
+          sh 'docker tag ${TEMP_IMAGE} docker.io/jc21/${IMAGE}:develop'
+          withCredentials([usernamePassword(credentialsId: 'jc21-dockerhub', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
+            sh "docker login -u '${duser}' -p '${dpass}'"
+            sh 'docker push docker.io/jc21/${IMAGE}:develop'
+          }
+
+          // Private Registry
+          sh 'docker tag ${TEMP_IMAGE} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:develop'
+          withCredentials([usernamePassword(credentialsId: 'jc21-private-registry', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
+            sh "docker login -u '${duser}' -p '${dpass}' ${DOCKER_PRIVATE_REGISTRY}"
+            sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:develop'
+          }
+
+          sh 'docker rmi ${TEMP_IMAGE}'
+        }
+      }
+    }
+    stage('Build Master') {
+      when {
+        branch 'master'
+      }
       parallel {
         stage('x86_64') {
-          when {
-            branch 'master'
-          }
           steps {
             ansiColor('xterm') {
               // Codebase
-              sh 'docker run --rm -v $(pwd):/app -w /app $BASE_IMAGE_NAME yarn --registry=$NPM_REGISTRY install'
-              sh 'docker run --rm -v $(pwd):/app -w /app $BASE_IMAGE_NAME npm run-script build'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} yarn install'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} npm run-script build'
               sh 'rm -rf node_modules'
-              sh 'docker run --rm -v $(pwd):/app -w /app $BASE_IMAGE_NAME yarn --registry=$NPM_REGISTRY install --prod'
-              sh 'docker run --rm -v $(pwd):/data $DOCKER_CI_TOOLS node-prune'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE} yarn install --prod'
+              sh 'docker run --rm -v $(pwd):/data ${DOCKER_CI_TOOLS} node-prune'
 
               // Docker Build
-              sh 'docker build --pull --no-cache --squash --compress -t $TEMP_IMAGE_NAME .'
-
-              // Private Registry
-              sh 'docker tag $TEMP_IMAGE_NAME $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$TAG_VERSION'
-              sh 'docker push $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$TAG_VERSION'
-              sh 'docker tag $TEMP_IMAGE_NAME $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$MAJOR_VERSION'
-              sh 'docker push $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$MAJOR_VERSION'
-              sh 'docker tag $TEMP_IMAGE_NAME $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:latest'
-              sh 'docker push $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:latest'
+              sh 'docker build --pull --no-cache --squash --compress -t ${TEMP_IMAGE} .'
 
               // Dockerhub
-              sh 'docker tag $TEMP_IMAGE_NAME docker.io/jc21/$IMAGE_NAME:$TAG_VERSION'
-              sh 'docker tag $TEMP_IMAGE_NAME docker.io/jc21/$IMAGE_NAME:$MAJOR_VERSION'
-              sh 'docker tag $TEMP_IMAGE_NAME docker.io/jc21/$IMAGE_NAME:latest'
+              sh 'docker tag ${TEMP_IMAGE} docker.io/jc21/${IMAGE}:${TAG_VERSION}'
+              sh 'docker tag ${TEMP_IMAGE} docker.io/jc21/${IMAGE}:${MAJOR_VERSION}'
+              sh 'docker tag ${TEMP_IMAGE} docker.io/jc21/${IMAGE}:latest'
 
               withCredentials([usernamePassword(credentialsId: 'jc21-dockerhub', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
-                sh "docker login -u '${duser}' -p '$dpass'"
-                sh 'docker push docker.io/jc21/$IMAGE_NAME:$TAG_VERSION'
-                sh 'docker push docker.io/jc21/$IMAGE_NAME:$MAJOR_VERSION'
-                sh 'docker push docker.io/jc21/$IMAGE_NAME:latest'
+                sh "docker login -u '${duser}' -p '${dpass}'"
+                sh 'docker push docker.io/jc21/${IMAGE}:${TAG_VERSION}'
+                sh 'docker push docker.io/jc21/${IMAGE}:${MAJOR_VERSION}'
+                sh 'docker push docker.io/jc21/${IMAGE}:latest'
               }
 
-              sh 'docker rmi $TEMP_IMAGE_NAME'
+              // Private Registry
+              sh 'docker tag ${TEMP_IMAGE} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${TAG_VERSION}'
+              sh 'docker tag ${TEMP_IMAGE} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${MAJOR_VERSION}'
+              sh 'docker tag ${TEMP_IMAGE} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:latest'
+
+              withCredentials([usernamePassword(credentialsId: 'jc21-private-registry', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
+                sh "docker login -u '${duser}' -p '${dpass}' ${DOCKER_PRIVATE_REGISTRY}"
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${TAG_VERSION}'
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${MAJOR_VERSION}'
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:latest'
+              }
+
+              sh 'docker rmi ${TEMP_IMAGE}'
             }
           }
         }
         stage('armhf') {
-          when {
-            branch 'master'
-          }
           agent {
             label 'armhf'
           }
           steps {
             ansiColor('xterm') {
               // Codebase
-              sh 'docker run --rm -v $(pwd):/app -w /app $BASE_IMAGE_NAME-armhf yarn --registry=$NPM_REGISTRY install'
-              sh 'docker run --rm -v $(pwd):/app -w /app $BASE_IMAGE_NAME-armhf npm run-script build'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE}:armhf yarn install'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE}:armhf npm run-script build'
               sh 'rm -rf node_modules'
-              sh 'docker run --rm -v $(pwd):/app -w /app $BASE_IMAGE_NAME-armhf yarn --registry=$NPM_REGISTRY install --prod'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE}:armhf yarn install --prod'
 
               // Docker Build
-              sh 'docker build --pull --no-cache --squash --compress -t $TEMP_IMAGE_NAME_ARM -f Dockerfile.armhf .'
-
-              // Private Registry
-              sh 'docker tag $TEMP_IMAGE_NAME_ARM $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$TAG_VERSION-armhf'
-              sh 'docker push $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$TAG_VERSION-armhf'
-              sh 'docker tag $TEMP_IMAGE_NAME_ARM $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$MAJOR_VERSION-armhf'
-              sh 'docker push $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:$MAJOR_VERSION-armhf'
-              sh 'docker tag $TEMP_IMAGE_NAME_ARM $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:latest-armhf'
-              sh 'docker push $DOCKER_PRIVATE_REGISTRY/$IMAGE_NAME:latest-armhf'
+              sh 'docker build --pull --no-cache --squash --compress -t ${TEMP_IMAGE_ARM} -f Dockerfile.armhf .'
 
               // Dockerhub
-              sh 'docker tag $TEMP_IMAGE_NAME_ARM docker.io/jc21/$IMAGE_NAME:$TAG_VERSION-armhf'
-              sh 'docker tag $TEMP_IMAGE_NAME_ARM docker.io/jc21/$IMAGE_NAME:$MAJOR_VERSION-armhf'
-              sh 'docker tag $TEMP_IMAGE_NAME_ARM docker.io/jc21/$IMAGE_NAME:latest-armhf'
+              sh 'docker tag ${TEMP_IMAGE_ARM} docker.io/jc21/${IMAGE}:${TAG_VERSION}-armhf'
+              sh 'docker tag ${TEMP_IMAGE_ARM} docker.io/jc21/${IMAGE}:${MAJOR_VERSION}-armhf'
+              sh 'docker tag ${TEMP_IMAGE_ARM} docker.io/jc21/${IMAGE}:latest-armhf'
 
               withCredentials([usernamePassword(credentialsId: 'jc21-dockerhub', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
-                sh "docker login -u '${duser}' -p '$dpass'"
-                sh 'docker push docker.io/jc21/$IMAGE_NAME:$TAG_VERSION-armhf'
-                sh 'docker push docker.io/jc21/$IMAGE_NAME:$MAJOR_VERSION-armhf'
-                sh 'docker push docker.io/jc21/$IMAGE_NAME:latest-armhf'
+                sh "docker login -u '${duser}' -p '${dpass}'"
+                sh 'docker push docker.io/jc21/${IMAGE}:${TAG_VERSION}-armhf'
+                sh 'docker push docker.io/jc21/${IMAGE}:${MAJOR_VERSION}-armhf'
+                sh 'docker push docker.io/jc21/${IMAGE}:latest-armhf'
               }
 
-              sh 'docker rmi $TEMP_IMAGE_NAME_ARM'
+              // Private Registry
+              sh 'docker tag ${TEMP_IMAGE_ARM} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${TAG_VERSION}-armhf'
+              sh 'docker tag ${TEMP_IMAGE_ARM} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${MAJOR_VERSION}-armhf'
+              sh 'docker tag ${TEMP_IMAGE_ARM} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:latest-armhf'
+
+              withCredentials([usernamePassword(credentialsId: 'jc21-private-registry', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
+                sh "docker login -u '${duser}' -p '${dpass}' ${DOCKER_PRIVATE_REGISTRY}"
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${TAG_VERSION}-armhf'
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${MAJOR_VERSION}-armhf'
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:latest-armhf'
+              }
+
+              sh 'docker rmi ${TEMP_IMAGE_ARM}'
+            }
+          }
+        }
+        stage('arm64') {
+          agent {
+            label 'arm64'
+          }
+          steps {
+            ansiColor('xterm') {
+              // Codebase
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE}:arm64 yarn install'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE}:arm64 npm run-script build'
+              sh 'sudo rm -rf node_modules'
+              sh 'docker run --rm -v $(pwd):/app -w /app ${BASE_IMAGE}:arm64 yarn install --prod'
+
+              // Docker Build
+              sh 'docker build --pull --no-cache --squash --compress -t ${TEMP_IMAGE_ARM64} -f Dockerfile.arm64 .'
+
+              // Dockerhub
+              sh 'docker tag ${TEMP_IMAGE_ARM64} docker.io/jc21/${IMAGE}:${TAG_VERSION}-arm64'
+              sh 'docker tag ${TEMP_IMAGE_ARM64} docker.io/jc21/${IMAGE}:${MAJOR_VERSION}-arm64'
+              sh 'docker tag ${TEMP_IMAGE_ARM64} docker.io/jc21/${IMAGE}:latest-arm64'
+
+              withCredentials([usernamePassword(credentialsId: 'jc21-dockerhub', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
+                sh "docker login -u '${duser}' -p '${dpass}'"
+                sh 'docker push docker.io/jc21/${IMAGE}:${TAG_VERSION}-arm64'
+                sh 'docker push docker.io/jc21/${IMAGE}:${MAJOR_VERSION}-arm64'
+                sh 'docker push docker.io/jc21/${IMAGE}:latest-arm64'
+              }
+
+              // Private Registry
+              sh 'docker tag ${TEMP_IMAGE_ARM64} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${TAG_VERSION}-arm64'
+              sh 'docker tag ${TEMP_IMAGE_ARM64} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${MAJOR_VERSION}-arm64'
+              sh 'docker tag ${TEMP_IMAGE_ARM64} ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:latest-arm64'
+
+              withCredentials([usernamePassword(credentialsId: 'jc21-private-registry', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
+                sh "docker login -u '${duser}' -p '${dpass}' ${DOCKER_PRIVATE_REGISTRY}"
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${TAG_VERSION}-arm64'
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:${MAJOR_VERSION}-arm64'
+                sh 'docker push ${DOCKER_PRIVATE_REGISTRY}/${IMAGE}:latest-arm64'
+              }
+
+              sh 'docker rmi ${TEMP_IMAGE_ARM64}'
+
+              // Hack to clean up ec2 instance for next build
+              sh 'sudo chown -R ec2-user:ec2-user *'
             }
           }
         }
@@ -118,7 +231,7 @@ pipeline {
 }
 
 def getPackageVersion() {
-  ver = sh(script: 'docker run --rm -v $(pwd):/data $DOCKER_CI_TOOLS bash -c "cat /data/package.json|jq -r \'.version\'"', returnStdout: true)
+  ver = sh(script: 'docker run --rm -v $(pwd):/data ${DOCKER_CI_TOOLS} bash -c "cat /data/package.json|jq -r \'.version\'"', returnStdout: true)
   return ver.trim()
 }
 

README.md

@@ -2,20 +2,22 @@
 
 # Nginx Proxy Manager
 
-![Version](https://img.shields.io/badge/version-2.0.2-green.svg?style=for-the-badge)
+![Version](https://img.shields.io/badge/version-2.0.11-green.svg?style=for-the-badge)
 ![Stars](https://img.shields.io/docker/stars/jc21/nginx-proxy-manager.svg?style=for-the-badge)
 ![Pulls](https://img.shields.io/docker/pulls/jc21/nginx-proxy-manager.svg?style=for-the-badge)
 
 This project comes as a pre-built docker image that enables you to easily forward to your websites
 running at home or otherwise, including free SSL, without having to know too much about Nginx or Letsencrypt.
 
-----------
-
-**WARNING: Version 2 a complete rewrite!** If you are using the `latest` docker tag and update to version 2
-without preparation, horrible things might happen. Refer to the [Importing Documentation](doc/IMPORTING.md). 
-
-----------
  
+## Project Goal
+
+I created this project to fill a personal need to provide users with a easy way to accomplish reverse
+proxying hosts with SSL termination and it had to be so easy that a monkey could do it. This goal hasn't changed.
+While there might be advanced options they are optional and the project should be as simple as possible
+so that the barrier for entry here is low.
+
+
 ## Features
 
 - Beautiful and Secure Admin Interface based on [Tabler](https://tabler.github.io/)
@@ -55,24 +57,6 @@ Please consult the [installation instructions](doc/INSTALL.md) for a complete gu
 if you just want to get up and running in the quickest time possible, grab all the files in the `doc/example/` folder and run `docker-compose up -d` 
 
 
-## Importing from Version 1?
-
-Here's a [guide for you to migrate your configuration](doc/IMPORTING.md). You should definitely read the [installation instructions](doc/INSTALL.md) first though.
-
-**Why should I?**
-
-Version 2 has the following improvements:
-
-- Management security and multiple user access
-- User permissions and visibility
-- Custom SSL certificate support
-- Audit log of changes
-- Broken nginx config detection
-- Multiple domains in Let's Encrypt certificates
-- Wildcard domain name support (not available with a Let's Encrypt certificate though)
-- It's super sexy
-
-
 ## Administration
 
 When your docker container is running, connect to it on port `81` for the admin interface.

TODO.md

@@ -1,17 +0,0 @@
-# TODO 
-
-- Dashboard stats are caching instead of querying
-
-Next version:
-
-- UI Log tail
-- Enable/Disable a config
-
-Testing:
-
-- Access Levels
-  - Adding a proxy host without access to read certs or access lists 
-- Visibility
-- Forwarding
-- Cert renewals
-- Custom certs

bin/migrate_create

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+if [ "$1" == "" ]; then
+    echo "Error: migrate name must be specified as first arg"
+    exit 1
+else
+    # Code path
+    SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+    if hash realpath 2>/dev/null; then
+        export CODEBASE=$(realpath $SCRIPT_DIR/..)
+    elif hash grealpath 2>/dev/null; then
+        export CODEBASE=$(grealpath $SCRIPT_DIR/..)
+    else
+        export CODEBASE=$(readlink -e $SCRIPT_DIR/..)
+    fi
+
+    if [ -z "$CODEBASE" ]; then
+        echo "Unable to determine absolute codebase directory"
+        exit 1
+    fi
+
+    cd "$CODEBASE"
+
+    sudo /usr/local/bin/docker-compose run --rm --no-deps app node node_modules/knex/bin/cli.js migrate:make "$1"
+    exit $?
+fi

doc/DOCKERHUB.md

@@ -2,7 +2,7 @@
 
 # Nginx Proxy Manager
 
-![Version](https://img.shields.io/badge/version-2.0.0-green.svg?style=for-the-badge)
+![Version](https://img.shields.io/badge/version-2.0.11-green.svg?style=for-the-badge)
 ![Stars](https://img.shields.io/docker/stars/jc21/nginx-proxy-manager.svg?style=for-the-badge)
 ![Pulls](https://img.shields.io/docker/pulls/jc21/nginx-proxy-manager.svg?style=for-the-badge)
 
@@ -16,6 +16,7 @@ running at home or otherwise, including free SSL, without having to know too muc
 
 * latest 2, 2.x.x ([Dockerfile](https://github.com/jc21/nginx-proxy-manager/blob/master/Dockerfile))
 * latest-armhf, 2-armhf, 2.x.x-armhf ([Dockerfile](https://github.com/jc21/nginx-proxy-manager/blob/master/Dockerfile.armhf))
+* latest-arm64, 2-arm64, 2.x.x-arm64 ([Dockerfile](https://github.com/jc21/nginx-proxy-manager/blob/master/Dockerfile.arm64))
 * 1, 1.x.x ([Dockerfile](https://github.com/jc21/nginx-proxy-manager/blob/1.1.2/Dockerfile))
 * 1-armhf, 1.x.x-armhf ([Dockerfile](https://github.com/jc21/nginx-proxy-manager/blob/1.1.2/Dockerfile.armhf))
 

doc/INSTALL.md

@@ -44,7 +44,7 @@ It's easy to use another docker container for your database also and link it as
 version: "3"
 services:
   app:
-    image: jc21/nginx-proxy-manager:2
+    image: jc21/nginx-proxy-manager:latest
     restart: always
     ports:
       - 80:80
@@ -57,7 +57,7 @@ services:
     depends_on:
       - db
   db:
-    image: mariadb
+    image: jc21/mariadb-aria
     restart: always
     environment:
       MYSQL_ROOT_PASSWORD: "password123"
@@ -77,7 +77,7 @@ Via `docker-compose`:
 version: "3"
 services:
   app:
-    image: jc21/nginx-proxy-manager:2
+    image: jc21/nginx-proxy-manager:latest
     restart: always
     ports:
       - 80:80
@@ -100,15 +100,17 @@ docker run -d \
     -v /path/to/config.json:/app/config/production.json \
     -v /path/to/data:/data \
     -v /path/to/letsencrypt:/etc/letsencrypt \
-    jc21/nginx-proxy-manager:2
+    jc21/nginx-proxy-manager:latest
 ```
 
 
 ### Running on Raspberry PI / `armhf`
 
-I have created a `armhf` docker container just for you. There may be issues with it,
+I have created `armhf` and `arm64` docker containers just for you. There may be issues with it,
 if you have issues please report them here.
 
+Note: Rpi v2 and below won't work with these images.
+
 ```bash
 docker run -d \
     --name nginx-proxy-manager-app \
@@ -118,7 +120,7 @@ docker run -d \
     -v /path/to/config.json:/app/config/production.json \
     -v /path/to/data:/data \
     -v /path/to/letsencrypt:/etc/letsencrypt \
-    jc21/nginx-proxy-manager:2-armhf
+    jc21/nginx-proxy-manager:latest-armhf
 ```
 
 
@@ -141,3 +143,23 @@ Password: changeme
 ```
 
 Immediately after logging in with this default user you will be asked to modify your details and change your password.
+
+
+### Advanced Options
+
+#### X-FRAME-OPTIONS Header
+
+You can configure the [`X-FRAME-OPTIONS`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) header
+value by specifying it as a Docker environment variable. The default if not specified is `deny`.
+
+```yml
+  ...
+  environment:
+    X_FRAME_OPTIONS: "sameorigin"
+  ...
+```
+
+```
+... -e "X_FRAME_OPTIONS=sameorigin" ...
+```
+

doc/example/docker-compose.yml

@@ -17,7 +17,7 @@ services:
     # if you want pretty colors in your docker logs:
     - FORCE_COLOR=1
   db:
-    image: mariadb
+    image: jc21/mariadb-aria
     restart: always
     environment:
       MYSQL_ROOT_PASSWORD: "password123"

docker-compose.yml

@@ -11,6 +11,7 @@ services:
       - NODE_ENV=development
       - FORCE_COLOR=1
     volumes:
+      - ./data:/data
       - ./data/letsencrypt:/etc/letsencrypt
       - .:/app
       - ./rootfs/etc/nginx:/etc/nginx

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nginx-proxy-manager",
-  "version": "2.0.2",
+  "version": "2.0.11",
   "description": "A beautiful interface for creating Nginx endpoints",
   "main": "src/backend/index.js",
   "devDependencies": {
@@ -30,8 +30,8 @@
     "style-loader": "^0.22.1",
     "tabler-ui": "git+https://github.com/tabler/tabler.git",
     "underscore": "^1.8.3",
-    "webpack": "^4.12.0",
-    "webpack-cli": "^3.0.8",
+    "webpack": "^4.25.1",
+    "webpack-cli": "^3.1.2",
     "webpack-visualizer-plugin": "^0.1.11"
   },
   "dependencies": {

rootfs/etc/nginx/conf.d/default.conf

@@ -8,8 +8,9 @@ server {
 
   include conf.d/include/block-exploits.conf;
 
-  set $server 127.0.0.1;
-  set $port   81;
+  set $forward_scheme http;
+  set $server         127.0.0.1;
+  set $port           81;
 
   location /health {
     access_log  off;
@@ -21,10 +22,10 @@ server {
   }
 }
 
-# Default 80 Host, which shows a "You are not configured" page
+# "You are not configured" page, which is the default if another default doesn't exist
 server {
-  listen 80 default;
-  server_name localhost;
+  listen 80;
+  server_name localhost-nginx-proxy-manager;
 
   access_log /data/logs/default.log proxy;
 
@@ -36,3 +37,17 @@ server {
     root /var/www/html;
   }
 }
+
+# First 443 Host, which is the default if another default doesn't exist
+server {
+  listen 443 ssl;
+  server_name localhost;
+
+  access_log /data/logs/default.log proxy;
+
+  ssl_certificate /data/nginx/dummycert.pem;
+  ssl_certificate_key /data/nginx/dummykey.pem;
+  ssl_ciphers aNULL;
+
+  return 444;
+}

rootfs/etc/nginx/conf.d/include/ip_ranges.conf

@@ -0,0 +1,2 @@
+# Intentionally left blank
+

rootfs/etc/nginx/conf.d/include/proxy.conf

@@ -1,6 +1,6 @@
 add_header       X-Served-By $host;
 proxy_set_header Host $host;
 proxy_set_header X-Forwarded-Scheme $scheme;
-proxy_set_header X-Forwarded-Protocol $scheme;
-proxy_set_header X-Forwarded-For $remote_addr;
-proxy_pass       http://$server:$port;
+proxy_set_header X-Forwarded-Proto  $scheme;
+proxy_set_header X-Forwarded-For    $remote_addr;
+proxy_pass       $forward_scheme://$server:$port;

rootfs/etc/nginx/conf.d/include/resolvers.conf

@@ -0,0 +1 @@
+# Intentionally blank

rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf

@@ -7,6 +7,3 @@ ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA
 ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AE
 S128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
 ssl_prefer_server_ciphers on;
-
-# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
-add_header Strict-Transport-Security max-age=15768000;

rootfs/etc/nginx/nginx.conf

@@ -51,7 +51,26 @@ http {
 
   access_log /data/logs/default.log proxy;
 
+  # Dynamically generated resolvers file
+  include /etc/nginx/conf.d/include/resolvers.conf;
+
+  # Default upstream scheme
+  map $host $forward_scheme {
+    default http;
+  }
+
+  # Real IP Determination
+  # Docker subnet:
+  set_real_ip_from 172.0.0.0/8;
+  # NPM generated CDN ip ranges:
+  include conf.d/include/ip_ranges.conf;
+  # always put the following 2 lines after ip subnets:
+  real_ip_header X-Forwarded-For;
+  real_ip_recursive on;
+
+  # Files generated by NPM
   include /etc/nginx/conf.d/*.conf;
+  include /data/nginx/default_host/*.conf;
   include /data/nginx/proxy_host/*.conf;
   include /data/nginx/redirection_host/*.conf;
   include /data/nginx/dead_host/*.conf;
@@ -59,6 +78,7 @@ http {
 }
 
 stream {
+    # Files generated by NPM
     include /data/nginx/stream/*.conf;
 }
 

rootfs/etc/services.d/manager/run

@@ -3,4 +3,9 @@
 mkdir -p /data/letsencrypt-acme-challenge
 
 cd /app
-node --abort_on_uncaught_exception --max_old_space_size=250 /app/src/backend/index.js
+
+while :
+do
+    node --abort_on_uncaught_exception --max_old_space_size=250 /app/src/backend/index.js
+    sleep 1
+done

rootfs/etc/services.d/nginx/run

@@ -1,20 +1,44 @@
 #!/usr/bin/with-contenv bash
 
+# Create required folders
 mkdir -p /tmp/nginx/body \
   /var/log/nginx \
   /data/nginx \
   /data/custom_ssl \
   /data/logs \
   /data/access \
+  /data/nginx/default_host \
+  /data/nginx/default_www \
   /data/nginx/proxy_host \
   /data/nginx/redirection_host \
   /data/nginx/stream \
   /data/nginx/dead_host \
   /data/nginx/temp \
   /var/lib/nginx/cache/public \
-  /var/lib/nginx/cache/private
+  /var/lib/nginx/cache/private \
+  /var/cache/nginx/proxy_temp
 
-touch /var/log/nginx/error.log && chmod 777 /var/log/nginx/error.log
+touch /var/log/nginx/error.log && chmod 777 /var/log/nginx/error.log && chmod -R 777 /var/cache/nginx
 chown root /tmp/nginx
 
+# Dynamically generate resolvers file
+echo resolver $(awk 'BEGIN{ORS=" "} $1=="nameserver" {print $2}' /etc/resolv.conf) ";" > /etc/nginx/conf.d/include/resolvers.conf
+
+# Generate dummy self-signed certificate.
+if [ ! -f /data/nginx/dummycert.pem ] || [ ! -f /data/nginx/dummykey.pem ]
+then
+  echo "Generating dummy SSL certificate..."
+  openssl req \
+    -new \
+    -newkey rsa:2048 \
+    -days 3650 \
+    -nodes \
+    -x509 \
+    -subj '/O=Nginx Proxy Manager/OU=Dummy Certificate/CN=localhost' \
+    -keyout /data/nginx/dummykey.pem \
+    -out /data/nginx/dummycert.pem
+  echo "Complete"
+fi
+
+# Run
 exec nginx

src/backend/app.js

@@ -40,11 +40,17 @@ app.use(require('./lib/express/cors'));
 
 // General security/cache related headers + server header
 app.use(function (req, res, next) {
+    let x_frame_options = 'DENY';
+
+    if (typeof process.env.X_FRAME_OPTIONS !== 'undefined' && process.env.X_FRAME_OPTIONS) {
+        x_frame_options = process.env.X_FRAME_OPTIONS;
+    }
+
     res.set({
         'Strict-Transport-Security': 'includeSubDomains; max-age=631138519; preload',
         'X-XSS-Protection':          '0',
         'X-Content-Type-Options':    'nosniff',
-        'X-Frame-Options':           'DENY',
+        'X-Frame-Options':           x_frame_options,
         'Cache-Control':             'no-cache, no-store, max-age=0, must-revalidate',
         Pragma:                      'no-cache',
         Expires:                     0

src/backend/importer.js

@@ -1,9 +1,10 @@
 'use strict';
 
-const fs        = require('fs');
-const logger    = require('./logger').import;
-const utils     = require('./lib/utils');
-const batchflow = require('batchflow');
+const fs         = require('fs');
+const logger     = require('./logger').import;
+const utils      = require('./lib/utils');
+const batchflow  = require('batchflow');
+const debug_mode = process.env.NODE_ENV !== 'production';
 
 const internalProxyHost       = require('./internal/proxy-host');
 const internalRedirectionHost = require('./internal/redirection-host');
@@ -353,7 +354,7 @@ module.exports = function () {
             .insertAndFetch({
                 owner_user_id:   1,
                 domain_names:    [host.hostname],
-                forward_ip:      host.forward_server,
+                forward_host:    host.forward_server,
                 forward_port:    host.forward_port,
                 access_list_id:  access_list_id,
                 certificate_id:  certificate_id,
@@ -534,6 +535,10 @@ module.exports = function () {
             );
 
         } else {
+            if (debug_mode) {
+                logger.debug('Importer skipped');
+            }
+
             resolve();
         }
     });

src/backend/index.js

@@ -1,7 +1,5 @@
 #!/usr/bin/env node
 
-'use strict';
-
 const logger = require('./logger').global;
 
 function appStart () {
@@ -11,6 +9,7 @@ function appStart () {
     const app                 = require('./app');
     const apiValidator        = require('./lib/validator/api');
     const internalCertificate = require('./internal/certificate');
+    const internalIpRanges    = require('./internal/ip_ranges');
 
     return migrate.latest()
         .then(setup)
@@ -18,9 +17,11 @@ function appStart () {
         .then(() => {
             return apiValidator.loadSchemas;
         })
+        .then(internalIpRanges.fetch)
         .then(() => {
 
             internalCertificate.initTimer();
+            internalIpRanges.initTimer();
 
             const server = app.listen(81, () => {
                 logger.info('PID ' + process.pid + ' listening on port 81 ...');

src/backend/internal/dead-host.js

@@ -47,6 +47,7 @@ const internalDeadHost = {
             .then(() => {
                 // At this point the domains should have been checked
                 data.owner_user_id = access.token.getUserId(1);
+                data               = internalHost.cleanSslHstsData(data);
 
                 return deadHostModel
                     .query()
@@ -89,11 +90,11 @@ const internalDeadHost = {
 
                 // Add to audit log
                 return internalAuditLog.add(access, {
-                    action:      'created',
-                    object_type: 'dead-host',
-                    object_id:   row.id,
-                    meta:        data
-                })
+                        action:      'created',
+                        object_type: 'dead-host',
+                        object_id:   row.id,
+                        meta:        data
+                    })
                     .then(() => {
                         return row;
                     });
@@ -103,7 +104,7 @@ const internalDeadHost = {
     /**
      * @param  {Access}  access
      * @param  {Object}  data
-     * @param  {Integer} data.id
+     * @param  {Number}  data.id
      * @return {Promise}
      */
     update: (access, data) => {
@@ -144,9 +145,9 @@ const internalDeadHost = {
 
                 if (create_certificate) {
                     return internalCertificate.createQuickCertificate(access, {
-                        domain_names: data.domain_names || row.domain_names,
-                        meta:         _.assign({}, row.meta, data.meta)
-                    })
+                            domain_names: data.domain_names || row.domain_names,
+                            meta:         _.assign({}, row.meta, data.meta)
+                        })
                         .then(cert => {
                             // update host with cert id
                             data.certificate_id = cert.id;
@@ -162,7 +163,9 @@ const internalDeadHost = {
                 // Add domain_names to the data in case it isn't there, so that the audit log renders correctly. The order is important here.
                 data = _.assign({}, {
                     domain_names: row.domain_names
-                },data);
+                }, data);
+
+                data = internalHost.cleanSslHstsData(data, row);
 
                 return deadHostModel
                     .query()
@@ -171,11 +174,11 @@ const internalDeadHost = {
                     .then(saved_row => {
                         // Add to audit log
                         return internalAuditLog.add(access, {
-                            action:      'updated',
-                            object_type: 'dead-host',
-                            object_id:   row.id,
-                            meta:        data
-                        })
+                                action:      'updated',
+                                object_type: 'dead-host',
+                                object_id:   row.id,
+                                meta:        data
+                            })
                             .then(() => {
                                 return _.omit(saved_row, omissions());
                             });
@@ -183,15 +186,15 @@ const internalDeadHost = {
             })
             .then(() => {
                 return internalDeadHost.get(access, {
-                    id:     data.id,
-                    expand: ['owner', 'certificate']
-                })
+                        id:     data.id,
+                        expand: ['owner', 'certificate']
+                    })
                     .then(row => {
                         // Configure nginx
                         return internalNginx.configure(deadHostModel, 'dead_host', row)
                             .then(new_meta => {
                                 row.meta = new_meta;
-                                row = internalHost.cleanRowCertificateMeta(row);
+                                row      = internalHost.cleanRowCertificateMeta(row);
                                 return _.omit(row, omissions());
                             });
                     });
@@ -201,7 +204,7 @@ const internalDeadHost = {
     /**
      * @param  {Access}   access
      * @param  {Object}   data
-     * @param  {Integer}  data.id
+     * @param  {Number}   data.id
      * @param  {Array}    [data.expand]
      * @param  {Array}    [data.omit]
      * @return {Promise}
@@ -248,7 +251,7 @@ const internalDeadHost = {
     /**
      * @param {Access}  access
      * @param {Object}  data
-     * @param {Integer} data.id
+     * @param {Number}  data.id
      * @param {String}  [data.reason]
      * @returns {Promise}
      */
@@ -290,6 +293,104 @@ const internalDeadHost = {
             });
     },
 
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    enable: (access, data) => {
+        return access.can('dead_hosts:update', data.id)
+            .then(() => {
+                return internalDeadHost.get(access, {
+                    id:     data.id,
+                    expand: ['certificate', 'owner']
+                });
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (row.enabled) {
+                    throw new error.ValidationError('Host is already enabled');
+                }
+
+                row.enabled = 1;
+
+                return deadHostModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 1
+                    })
+                    .then(() => {
+                        // Configure nginx
+                        return internalNginx.configure(deadHostModel, 'dead_host', row);
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'enabled',
+                            object_type: 'dead-host',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    disable: (access, data) => {
+        return access.can('dead_hosts:update', data.id)
+            .then(() => {
+                return internalDeadHost.get(access, {id: data.id});
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (!row.enabled) {
+                    throw new error.ValidationError('Host is already disabled');
+                }
+
+                row.enabled = 0;
+
+                return deadHostModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 0
+                    })
+                    .then(() => {
+                        // Delete Nginx Config
+                        return internalNginx.deleteConfig('dead_host', row)
+                            .then(() => {
+                                return internalNginx.reload();
+                            });
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'disabled',
+                            object_type: 'dead-host',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
     /**
      * All Hosts
      *
@@ -338,7 +439,7 @@ const internalDeadHost = {
     /**
      * Report use
      *
-     * @param   {Integer} user_id
+     * @param   {Number}  user_id
      * @param   {String}  visibility
      * @returns {Promise}
      */

src/backend/internal/host.js

@@ -1,11 +1,40 @@
-'use strict';
-
+const _                    = require('lodash');
 const proxyHostModel       = require('../models/proxy_host');
 const redirectionHostModel = require('../models/redirection_host');
 const deadHostModel        = require('../models/dead_host');
 
 const internalHost = {
 
+    /**
+     * Makes sure that the ssl_* and hsts_* fields play nicely together.
+     * ie: if there is no cert, then force_ssl is off.
+     *     if force_ssl is off, then hsts_enabled is definitely off.
+     *
+     * @param   {object} data
+     * @param   {object} [existing_data]
+     * @returns {object}
+     */
+    cleanSslHstsData: function (data, existing_data) {
+        existing_data = existing_data === undefined ? {} : existing_data;
+
+        let combined_data = _.assign({}, existing_data, data);
+
+        if (!combined_data.certificate_id) {
+            combined_data.ssl_forced    = false;
+            combined_data.http2_support = false;
+        }
+
+        if (!combined_data.ssl_forced) {
+            combined_data.hsts_enabled = false;
+        }
+
+        if (!combined_data.hsts_enabled) {
+            combined_data.hsts_subdomains = false;
+        }
+
+        return combined_data;
+    },
+
     /**
      * used by the getAll functions of hosts, this removes the certificate meta if present
      *

src/backend/internal/ip_ranges.js

@@ -0,0 +1,150 @@
+'use strict';
+
+const https         = require('https');
+const fs            = require('fs');
+const _             = require('lodash');
+const logger        = require('../logger').ip_ranges;
+const error         = require('../lib/error');
+const internalNginx = require('./nginx');
+const Liquid        = require('liquidjs');
+
+const CLOUDFRONT_URL   = 'https://ip-ranges.amazonaws.com/ip-ranges.json';
+const CLOUDFARE_V4_URL = 'https://www.cloudflare.com/ips-v4';
+const CLOUDFARE_V6_URL = 'https://www.cloudflare.com/ips-v6';
+
+const internalIpRanges = {
+
+    interval_timeout:    1000 * 60 * 60 * 6, // 6 hours
+    interval:            null,
+    interval_processing: false,
+    iteration_count:     0,
+
+    initTimer: () => {
+        logger.info('IP Ranges Renewal Timer initialized');
+        internalIpRanges.interval = setInterval(internalIpRanges.fetch, internalIpRanges.interval_timeout);
+    },
+
+    fetchUrl: url => {
+        return new Promise((resolve, reject) => {
+            logger.info('Fetching ' + url);
+            return https.get(url, res => {
+                res.setEncoding('utf8');
+                let raw_data = '';
+                res.on('data', chunk => {
+                    raw_data += chunk;
+                });
+
+                res.on('end', () => {
+                    resolve(raw_data);
+                });
+            }).on('error', err => {
+                reject(err);
+            });
+        });
+    },
+
+    /**
+     * Triggered at startup and then later by a timer, this will fetch the ip ranges from services and apply them to nginx.
+     */
+    fetch: () => {
+        if (!internalIpRanges.interval_processing) {
+            internalIpRanges.interval_processing = true;
+            logger.info('Fetching IP Ranges from online services...');
+
+            let ip_ranges = [];
+
+            return internalIpRanges.fetchUrl(CLOUDFRONT_URL)
+                .then(cloudfront_data => {
+                    let data = JSON.parse(cloudfront_data);
+
+                    if (data && typeof data.prefixes !== 'undefined') {
+                        data.prefixes.map(item => {
+                            if (item.service === 'CLOUDFRONT') {
+                                ip_ranges.push(item.ip_prefix);
+                            }
+                        });
+                    }
+
+                    if (data && typeof data.ipv6_prefixes !== 'undefined') {
+                        data.ipv6_prefixes.map(item => {
+                            if (item.service === 'CLOUDFRONT') {
+                                ip_ranges.push(item.ipv6_prefix);
+                            }
+                        });
+                    }
+                })
+                .then(() => {
+                    return internalIpRanges.fetchUrl(CLOUDFARE_V4_URL);
+                })
+                .then(cloudfare_data => {
+                    let items = cloudfare_data.split('\n');
+                    ip_ranges = [... ip_ranges, ... items];
+                })
+                .then(() => {
+                    return internalIpRanges.fetchUrl(CLOUDFARE_V6_URL);
+                })
+                .then(cloudfare_data => {
+                    let items = cloudfare_data.split('\n');
+                    ip_ranges = [... ip_ranges, ... items];
+                })
+                .then(() => {
+                    let clean_ip_ranges = [];
+                    ip_ranges.map(range => {
+                        if (range) {
+                            clean_ip_ranges.push(range);
+                        }
+                    });
+
+                    return internalIpRanges.generateConfig(clean_ip_ranges)
+                        .then(() => {
+                            if (internalIpRanges.iteration_count) {
+                                // Reload nginx
+                                return internalNginx.reload();
+                            }
+                        });
+                })
+                .then(() => {
+                    internalIpRanges.interval_processing = false;
+                    internalIpRanges.iteration_count++;
+                })
+                .catch(err => {
+                    logger.error(err.message);
+                    internalIpRanges.interval_processing = false;
+                });
+        }
+    },
+
+    /**
+     * @param   {Array}  ip_ranges
+     * @returns {Promise}
+     */
+    generateConfig: (ip_ranges) => {
+        let renderEngine = Liquid({
+            root: __dirname + '/../templates/'
+        });
+
+        return new Promise((resolve, reject) => {
+            let template = null;
+            let filename = '/etc/nginx/conf.d/include/ip_ranges.conf';
+            try {
+                template = fs.readFileSync(__dirname + '/../templates/ip_ranges.conf', {encoding: 'utf8'});
+            } catch (err) {
+                reject(new error.ConfigurationError(err.message));
+                return;
+            }
+
+            renderEngine
+                .parseAndRender(template, {ip_ranges: ip_ranges})
+                .then(config_text => {
+                    fs.writeFileSync(filename, config_text, {encoding: 'utf8'});
+                    resolve(true);
+                })
+                .catch(err => {
+                    logger.warn('Could not write ' + filename + ':', err.message);
+                    reject(new error.ConfigurationError(err.message));
+                });
+        });
+    }
+};
+
+module.exports = internalIpRanges;

src/backend/internal/nginx.js

@@ -1,5 +1,3 @@
-'use strict';
-
 const _          = require('lodash');
 const fs         = require('fs');
 const Liquid     = require('liquidjs');
@@ -19,9 +17,9 @@ const internalNginx = {
      * - IF BAD: update the meta with offline status and remove the config entirely
      * - then reload nginx
      *
-     * @param   {Object}  model
-     * @param   {String}  host_type
-     * @param   {Object}  host
+     * @param   {Object|String}  model
+     * @param   {String}         host_type
+     * @param   {Object}         host
      * @returns {Promise}
      */
     configure: (model, host_type, host) => {
@@ -92,7 +90,7 @@ const internalNginx = {
             })
             .then(() => {
                 return combined_meta;
-            })
+            });
     },
 
     /**
@@ -124,9 +122,43 @@ const internalNginx = {
      */
     getConfigName: (host_type, host_id) => {
         host_type = host_type.replace(new RegExp('-', 'g'), '_');
+
+        if (host_type === 'default') {
+            return '/data/nginx/default_host/site.conf';
+        }
+
         return '/data/nginx/' + host_type + '/' + host_id + '.conf';
     },
 
+    /**
+     * Generates custom locations
+     * @param   {Object}  host 
+     * @returns {Promise}
+     */
+    renderLocations: (host) => {
+        return new Promise((resolve, reject) => {
+            let template;
+
+            try {
+                template = fs.readFileSync(__dirname + '/../templates/_location.conf', {encoding: 'utf8'});
+            } catch (err) {
+                reject(new error.ConfigurationError(err.message));
+                return;
+            }
+
+            let renderer = new Liquid();
+            let renderedLocations = '';
+
+            const locationRendering = async () => {
+                for (let i = 0; i < host.locations.length; i++) {
+                    renderedLocations += await renderer.parseAndRender(template, host.locations[i]);
+                }
+            }
+
+            locationRendering().then(() => resolve(renderedLocations));
+        });
+    },
+
     /**
      * @param   {String}  host_type
      * @param   {Object}  host
@@ -146,6 +178,7 @@ const internalNginx = {
         return new Promise((resolve, reject) => {
             let template = null;
             let filename = internalNginx.getConfigName(host_type, host.id);
+
             try {
                 template = fs.readFileSync(__dirname + '/../templates/' + host_type + '.conf', {encoding: 'utf8'});
             } catch (err) {
@@ -153,24 +186,49 @@ const internalNginx = {
                 return;
             }
 
-            renderEngine
-                .parseAndRender(template, host)
-                .then(config_text => {
-                    fs.writeFileSync(filename, config_text, {encoding: 'utf8'});
+            let locationsPromise;
+            let origLocations;
 
-                    if (debug_mode) {
-                        logger.success('Wrote config:', filename, config_text);
-                    }
+            // Manipulate the data a bit before sending it to the template
+            if (host_type !== 'default') {
+                host.use_default_location = true;
+                if (typeof host.advanced_config !== 'undefined' && host.advanced_config) {
+                    host.use_default_location = !internalNginx.advancedConfigHasDefaultLocation(host.advanced_config);
+                }
+            }
 
-                    resolve(true);
-                })
-                .catch(err => {
-                    if (debug_mode) {
-                        logger.warn('Could not write ' + filename + ':', err.message);
-                    }
-
-                    reject(new error.ConfigurationError(err.message));
+            if (host.locations) {
+                origLocations = [].concat(host.locations);
+                locationsPromise = internalNginx.renderLocations(host).then((renderedLocations) => {
+                    host.locations = renderedLocations;
                 });
+            } else {
+                locationsPromise = Promise.resolve();
+            }
+
+            locationsPromise.then(() => {
+                renderEngine
+                    .parseAndRender(template, host)
+                    .then(config_text => {
+                        fs.writeFileSync(filename, config_text, {encoding: 'utf8'});
+
+                        if (debug_mode) {
+                            logger.success('Wrote config:', filename, config_text);
+                        }
+
+                        // Restore locations array
+                        host.locations = origLocations;
+
+                        resolve(true);
+                    })
+                    .catch(err => {
+                        if (debug_mode) {
+                            logger.warn('Could not write ' + filename + ':', err.message);
+                        }
+
+                        reject(new error.ConfigurationError(err.message));
+                    });
+            });
         });
     },
 
@@ -255,7 +313,7 @@ const internalNginx = {
 
     /**
      * @param   {String}  host_type
-     * @param   {Object}  host
+     * @param   {Object}  [host]
      * @param   {Boolean} [throw_errors]
      * @returns {Promise}
      */
@@ -264,7 +322,7 @@ const internalNginx = {
 
         return new Promise((resolve, reject) => {
             try {
-                let config_file = internalNginx.getConfigName(host_type, host.id);
+                let config_file = internalNginx.getConfigName(host_type, typeof host === 'undefined' ? 0 : host.id);
 
                 if (debug_mode) {
                     logger.warn('Deleting nginx config: ' + config_file);
@@ -312,6 +370,14 @@ const internalNginx = {
         });
 
         return Promise.all(promises);
+    },
+
+    /**
+     * @param   {string}  config
+     * @returns {boolean}
+     */
+    advancedConfigHasDefaultLocation: function (config) {
+        return !!config.match(/^(?:.*;)?\s*?location\s*?\/\s*?{/im);
     }
 };
 

src/backend/internal/proxy-host.js

@@ -1,5 +1,3 @@
-'use strict';
-
 const _                   = require('lodash');
 const error               = require('../lib/error');
 const proxyHostModel      = require('../models/proxy_host');
@@ -47,6 +45,7 @@ const internalProxyHost = {
             .then(() => {
                 // At this point the domains should have been checked
                 data.owner_user_id = access.token.getUserId(1);
+                data               = internalHost.cleanSslHstsData(data);
 
                 return proxyHostModel
                     .query()
@@ -90,11 +89,11 @@ const internalProxyHost = {
 
                 // Add to audit log
                 return internalAuditLog.add(access, {
-                    action:      'created',
-                    object_type: 'proxy-host',
-                    object_id:   row.id,
-                    meta:        data
-                })
+                        action:      'created',
+                        object_type: 'proxy-host',
+                        object_id:   row.id,
+                        meta:        data
+                    })
                     .then(() => {
                         return row;
                     });
@@ -104,7 +103,7 @@ const internalProxyHost = {
     /**
      * @param  {Access}  access
      * @param  {Object}  data
-     * @param  {Integer} data.id
+     * @param  {Number}  data.id
      * @return {Promise}
      */
     update: (access, data) => {
@@ -145,9 +144,9 @@ const internalProxyHost = {
 
                 if (create_certificate) {
                     return internalCertificate.createQuickCertificate(access, {
-                        domain_names: data.domain_names || row.domain_names,
-                        meta:         _.assign({}, row.meta, data.meta)
-                    })
+                            domain_names: data.domain_names || row.domain_names,
+                            meta:         _.assign({}, row.meta, data.meta)
+                        })
                         .then(cert => {
                             // update host with cert id
                             data.certificate_id = cert.id;
@@ -163,7 +162,9 @@ const internalProxyHost = {
                 // Add domain_names to the data in case it isn't there, so that the audit log renders correctly. The order is important here.
                 data = _.assign({}, {
                     domain_names: row.domain_names
-                },data);
+                }, data);
+
+                data = internalHost.cleanSslHstsData(data, row);
 
                 return proxyHostModel
                     .query()
@@ -172,11 +173,11 @@ const internalProxyHost = {
                     .then(saved_row => {
                         // Add to audit log
                         return internalAuditLog.add(access, {
-                            action:      'updated',
-                            object_type: 'proxy-host',
-                            object_id:   row.id,
-                            meta:        data
-                        })
+                                action:      'updated',
+                                object_type: 'proxy-host',
+                                object_id:   row.id,
+                                meta:        data
+                            })
                             .then(() => {
                                 return _.omit(saved_row, omissions());
                             });
@@ -184,15 +185,15 @@ const internalProxyHost = {
             })
             .then(() => {
                 return internalProxyHost.get(access, {
-                    id:     data.id,
-                    expand: ['owner', 'certificate', 'access_list']
-                })
+                        id:     data.id,
+                        expand: ['owner', 'certificate', 'access_list']
+                    })
                     .then(row => {
                         // Configure nginx
                         return internalNginx.configure(proxyHostModel, 'proxy_host', row)
                             .then(new_meta => {
                                 row.meta = new_meta;
-                                row = internalHost.cleanRowCertificateMeta(row);
+                                row      = internalHost.cleanRowCertificateMeta(row);
                                 return _.omit(row, omissions());
                             });
                     });
@@ -202,7 +203,7 @@ const internalProxyHost = {
     /**
      * @param  {Access}   access
      * @param  {Object}   data
-     * @param  {Integer}  data.id
+     * @param  {Number}   data.id
      * @param  {Array}    [data.expand]
      * @param  {Array}    [data.omit]
      * @return {Promise}
@@ -249,7 +250,7 @@ const internalProxyHost = {
     /**
      * @param {Access}  access
      * @param {Object}  data
-     * @param {Integer} data.id
+     * @param {Number}  data.id
      * @param {String}  [data.reason]
      * @returns {Promise}
      */
@@ -291,6 +292,104 @@ const internalProxyHost = {
             });
     },
 
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    enable: (access, data) => {
+        return access.can('proxy_hosts:update', data.id)
+            .then(() => {
+                return internalProxyHost.get(access, {
+                    id:     data.id,
+                    expand: ['certificate', 'owner', 'access_list']
+                });
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (row.enabled) {
+                    throw new error.ValidationError('Host is already enabled');
+                }
+
+                row.enabled = 1;
+
+                return proxyHostModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 1
+                    })
+                    .then(() => {
+                        // Configure nginx
+                        return internalNginx.configure(proxyHostModel, 'proxy_host', row);
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'enabled',
+                            object_type: 'proxy-host',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    disable: (access, data) => {
+        return access.can('proxy_hosts:update', data.id)
+            .then(() => {
+                return internalProxyHost.get(access, {id: data.id});
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (!row.enabled) {
+                    throw new error.ValidationError('Host is already disabled');
+                }
+
+                row.enabled = 0;
+
+                return proxyHostModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 0
+                    })
+                    .then(() => {
+                        // Delete Nginx Config
+                        return internalNginx.deleteConfig('proxy_host', row)
+                            .then(() => {
+                                return internalNginx.reload();
+                            });
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'disabled',
+                            object_type: 'proxy-host',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
     /**
      * All Hosts
      *
@@ -339,7 +438,7 @@ const internalProxyHost = {
     /**
      * Report use
      *
-     * @param   {Integer} user_id
+     * @param   {Number}  user_id
      * @param   {String}  visibility
      * @returns {Promise}
      */

src/backend/internal/redirection-host.js

@@ -47,6 +47,7 @@ const internalRedirectionHost = {
             .then(() => {
                 // At this point the domains should have been checked
                 data.owner_user_id = access.token.getUserId(1);
+                data               = internalHost.cleanSslHstsData(data);
 
                 return redirectionHostModel
                     .query()
@@ -89,11 +90,11 @@ const internalRedirectionHost = {
 
                 // Add to audit log
                 return internalAuditLog.add(access, {
-                    action:      'created',
-                    object_type: 'redirection-host',
-                    object_id:   row.id,
-                    meta:        data
-                })
+                        action:      'created',
+                        object_type: 'redirection-host',
+                        object_id:   row.id,
+                        meta:        data
+                    })
                     .then(() => {
                         return row;
                     });
@@ -103,7 +104,7 @@ const internalRedirectionHost = {
     /**
      * @param  {Access}  access
      * @param  {Object}  data
-     * @param  {Integer} data.id
+     * @param  {Number}  data.id
      * @return {Promise}
      */
     update: (access, data) => {
@@ -144,9 +145,9 @@ const internalRedirectionHost = {
 
                 if (create_certificate) {
                     return internalCertificate.createQuickCertificate(access, {
-                        domain_names: data.domain_names || row.domain_names,
-                        meta:         _.assign({}, row.meta, data.meta)
-                    })
+                            domain_names: data.domain_names || row.domain_names,
+                            meta:         _.assign({}, row.meta, data.meta)
+                        })
                         .then(cert => {
                             // update host with cert id
                             data.certificate_id = cert.id;
@@ -162,7 +163,9 @@ const internalRedirectionHost = {
                 // Add domain_names to the data in case it isn't there, so that the audit log renders correctly. The order is important here.
                 data = _.assign({}, {
                     domain_names: row.domain_names
-                },data);
+                }, data);
+
+                data = internalHost.cleanSslHstsData(data, row);
 
                 return redirectionHostModel
                     .query()
@@ -171,11 +174,11 @@ const internalRedirectionHost = {
                     .then(saved_row => {
                         // Add to audit log
                         return internalAuditLog.add(access, {
-                            action:      'updated',
-                            object_type: 'redirection-host',
-                            object_id:   row.id,
-                            meta:        data
-                        })
+                                action:      'updated',
+                                object_type: 'redirection-host',
+                                object_id:   row.id,
+                                meta:        data
+                            })
                             .then(() => {
                                 return _.omit(saved_row, omissions());
                             });
@@ -183,15 +186,15 @@ const internalRedirectionHost = {
             })
             .then(() => {
                 return internalRedirectionHost.get(access, {
-                    id:     data.id,
-                    expand: ['owner', 'certificate']
-                })
+                        id:     data.id,
+                        expand: ['owner', 'certificate']
+                    })
                     .then(row => {
                         // Configure nginx
                         return internalNginx.configure(redirectionHostModel, 'redirection_host', row)
                             .then(new_meta => {
                                 row.meta = new_meta;
-                                row = internalHost.cleanRowCertificateMeta(row);
+                                row      = internalHost.cleanRowCertificateMeta(row);
                                 return _.omit(row, omissions());
                             });
                     });
@@ -201,7 +204,7 @@ const internalRedirectionHost = {
     /**
      * @param  {Access}   access
      * @param  {Object}   data
-     * @param  {Integer}  data.id
+     * @param  {Number}   data.id
      * @param  {Array}    [data.expand]
      * @param  {Array}    [data.omit]
      * @return {Promise}
@@ -248,7 +251,7 @@ const internalRedirectionHost = {
     /**
      * @param {Access}  access
      * @param {Object}  data
-     * @param {Integer} data.id
+     * @param {Number}  data.id
      * @param {String}  [data.reason]
      * @returns {Promise}
      */
@@ -290,6 +293,104 @@ const internalRedirectionHost = {
             });
     },
 
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    enable: (access, data) => {
+        return access.can('redirection_hosts:update', data.id)
+            .then(() => {
+                return internalRedirectionHost.get(access, {
+                    id:     data.id,
+                    expand: ['certificate', 'owner']
+                });
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (row.enabled) {
+                    throw new error.ValidationError('Host is already enabled');
+                }
+
+                row.enabled = 1;
+
+                return redirectionHostModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 1
+                    })
+                    .then(() => {
+                        // Configure nginx
+                        return internalNginx.configure(redirectionHostModel, 'redirection_host', row);
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'enabled',
+                            object_type: 'redirection-host',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    disable: (access, data) => {
+        return access.can('redirection_hosts:update', data.id)
+            .then(() => {
+                return internalRedirectionHost.get(access, {id: data.id});
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (!row.enabled) {
+                    throw new error.ValidationError('Host is already disabled');
+                }
+
+                row.enabled = 0;
+
+                return redirectionHostModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 0
+                    })
+                    .then(() => {
+                        // Delete Nginx Config
+                        return internalNginx.deleteConfig('redirection_host', row)
+                            .then(() => {
+                                return internalNginx.reload();
+                            });
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'disabled',
+                            object_type: 'redirection-host',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
     /**
      * All Hosts
      *
@@ -338,7 +439,7 @@ const internalRedirectionHost = {
     /**
      * Report use
      *
-     * @param   {Integer} user_id
+     * @param   {Number}  user_id
      * @param   {String}  visibility
      * @returns {Promise}
      */

src/backend/internal/setting.js

@@ -0,0 +1,133 @@
+const fs            = require('fs');
+const error         = require('../lib/error');
+const settingModel  = require('../models/setting');
+const internalNginx = require('./nginx');
+
+const internalSetting = {
+
+    /**
+     * @param  {Access}  access
+     * @param  {Object}  data
+     * @param  {String}  data.id
+     * @return {Promise}
+     */
+    update: (access, data) => {
+        return access.can('settings:update', data.id)
+            .then(access_data => {
+                return internalSetting.get(access, {id: data.id});
+            })
+            .then(row => {
+                if (row.id !== data.id) {
+                    // Sanity check that something crazy hasn't happened
+                    throw new error.InternalValidationError('Setting could not be updated, IDs do not match: ' + row.id + ' !== ' + data.id);
+                }
+
+                return settingModel
+                    .query()
+                    .where({id: data.id})
+                    .patch(data);
+            })
+            .then(() => {
+                return internalSetting.get(access, {
+                    id: data.id
+                });
+            })
+            .then(row => {
+                if (row.id === 'default-site') {
+                    // write the html if we need to
+                    if (row.value === 'html') {
+                        fs.writeFileSync('/data/nginx/default_www/index.html', row.meta.html, {encoding: 'utf8'});
+                    }
+
+                    // Configure nginx
+                    return internalNginx.deleteConfig('default')
+                        .then(() => {
+                            return internalNginx.generateConfig('default', row);
+                        })
+                        .then(() => {
+                            return internalNginx.test();
+                        })
+                        .then(() => {
+                            return internalNginx.reload();
+                        })
+                        .then(() => {
+                            return row;
+                        })
+                        .catch((err) => {
+                            internalNginx.deleteConfig('default')
+                                .then(() => {
+                                    return internalNginx.test();
+                                })
+                                .then(() => {
+                                    return internalNginx.reload();
+                                })
+                                .then(() => {
+                                    // I'm being slack here I know..
+                                    throw new error.ValidationError('Could not reconfigure Nginx. Please check logs.');
+                                })
+                        });
+                } else {
+                    return row;
+                }
+            });
+    },
+
+    /**
+     * @param  {Access}   access
+     * @param  {Object}   data
+     * @param  {String}   data.id
+     * @return {Promise}
+     */
+    get: (access, data) => {
+        return access.can('settings:get', data.id)
+            .then(() => {
+                return settingModel
+                    .query()
+                    .where('id', data.id)
+                    .first();
+            })
+            .then(row => {
+                if (row) {
+                    return row;
+                } else {
+                    throw new error.ItemNotFoundError(data.id);
+                }
+            });
+    },
+
+    /**
+     * This will only count the settings
+     *
+     * @param   {Access}  access
+     * @returns {*}
+     */
+    getCount: (access) => {
+        return access.can('settings:list')
+            .then(() => {
+                return settingModel
+                    .query()
+                    .count('id as count')
+                    .first();
+            })
+            .then(row => {
+                return parseInt(row.count, 10);
+            });
+    },
+
+    /**
+     * All settings
+     *
+     * @param   {Access}  access
+     * @returns {Promise}
+     */
+    getAll: (access) => {
+        return access.can('settings:list')
+            .then(() => {
+                return settingModel
+                    .query()
+                    .orderBy('description', 'ASC');
+            });
+    }
+};
+
+module.exports = internalSetting;

src/backend/internal/stream.js

@@ -56,7 +56,7 @@ const internalStream = {
     /**
      * @param  {Access}  access
      * @param  {Object}  data
-     * @param  {Integer} data.id
+     * @param  {Number}  data.id
      * @return {Promise}
      */
     update: (access, data) => {
@@ -75,6 +75,12 @@ const internalStream = {
                     .query()
                     .omit(omissions())
                     .patchAndFetchById(row.id, data)
+                    .then(saved_row => {
+                        return internalNginx.configure(streamModel, 'stream', saved_row)
+                            .then(() => {
+                                return internalStream.get(access, {id: row.id, expand: ['owner']});
+                            });
+                    })
                     .then(saved_row => {
                         // Add to audit log
                         return internalAuditLog.add(access, {
@@ -93,7 +99,7 @@ const internalStream = {
     /**
      * @param  {Access}   access
      * @param  {Object}   data
-     * @param  {Integer}  data.id
+     * @param  {Number}   data.id
      * @param  {Array}    [data.expand]
      * @param  {Array}    [data.omit]
      * @return {Promise}
@@ -139,7 +145,7 @@ const internalStream = {
     /**
      * @param {Access}  access
      * @param {Object}  data
-     * @param {Integer} data.id
+     * @param {Number}  data.id
      * @param {String}  [data.reason]
      * @returns {Promise}
      */
@@ -181,6 +187,104 @@ const internalStream = {
             });
     },
 
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    enable: (access, data) => {
+        return access.can('streams:update', data.id)
+            .then(() => {
+                return internalStream.get(access, {
+                    id:     data.id,
+                    expand: ['owner']
+                });
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (row.enabled) {
+                    throw new error.ValidationError('Host is already enabled');
+                }
+
+                row.enabled = 1;
+
+                return streamModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 1
+                    })
+                    .then(() => {
+                        // Configure nginx
+                        return internalNginx.configure(streamModel, 'stream', row);
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'enabled',
+                            object_type: 'stream',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
+    /**
+     * @param {Access}  access
+     * @param {Object}  data
+     * @param {Number}  data.id
+     * @param {String}  [data.reason]
+     * @returns {Promise}
+     */
+    disable: (access, data) => {
+        return access.can('streams:update', data.id)
+            .then(() => {
+                return internalStream.get(access, {id: data.id});
+            })
+            .then(row => {
+                if (!row) {
+                    throw new error.ItemNotFoundError(data.id);
+                } else if (!row.enabled) {
+                    throw new error.ValidationError('Host is already disabled');
+                }
+
+                row.enabled = 0;
+
+                return streamModel
+                    .query()
+                    .where('id', row.id)
+                    .patch({
+                        enabled: 0
+                    })
+                    .then(() => {
+                        // Delete Nginx Config
+                        return internalNginx.deleteConfig('stream', row)
+                            .then(() => {
+                                return internalNginx.reload();
+                            });
+                    })
+                    .then(() => {
+                        // Add to audit log
+                        return internalAuditLog.add(access, {
+                            action:      'disabled',
+                            object_type: 'stream-host',
+                            object_id:   row.id,
+                            meta:        _.omit(row, omissions())
+                        });
+                    });
+            })
+            .then(() => {
+                return true;
+            });
+    },
+
     /**
      * All Streams
      *
@@ -222,7 +326,7 @@ const internalStream = {
     /**
      * Report use
      *
-     * @param   {Integer} user_id
+     * @param   {Number}  user_id
      * @param   {String}  visibility
      * @returns {Promise}
      */

src/backend/lib/access/settings-get.json

@@ -0,0 +1,7 @@
+{
+  "anyOf": [
+    {
+      "$ref": "roles#/definitions/admin"
+    }
+  ]
+}

src/backend/lib/access/settings-list.json

@@ -0,0 +1,7 @@
+{
+  "anyOf": [
+    {
+      "$ref": "roles#/definitions/admin"
+    }
+  ]
+}

src/backend/lib/access/settings-update.json

@@ -0,0 +1,7 @@
+{
+  "anyOf": [
+    {
+      "$ref": "roles#/definitions/admin"
+    }
+  ]
+}

src/backend/logger.js

@@ -1,11 +1,13 @@
 const {Signale} = require('signale');
 
 module.exports = {
-    global:  new Signale({scope: 'Global  '}),
-    migrate: new Signale({scope: 'Migrate '}),
-    express: new Signale({scope: 'Express '}),
-    access:  new Signale({scope: 'Access  '}),
-    nginx:   new Signale({scope: 'Nginx   '}),
-    ssl:     new Signale({scope: 'SSL     '}),
-    import:  new Signale({scope: 'Importer'}),
+    global:    new Signale({scope: 'Global   '}),
+    migrate:   new Signale({scope: 'Migrate  '}),
+    express:   new Signale({scope: 'Express  '}),
+    access:    new Signale({scope: 'Access   '}),
+    nginx:     new Signale({scope: 'Nginx    '}),
+    ssl:       new Signale({scope: 'SSL      '}),
+    import:    new Signale({scope: 'Importer '}),
+    setup:     new Signale({scope: 'Setup    '}),
+    ip_ranges: new Signale({scope: 'IP Ranges'})
 };

src/backend/migrations/20180929054513_websockets.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const migrate_name = 'websockets';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.table('proxy_host', function (proxy_host) {
+        proxy_host.integer('allow_websocket_upgrade').notNull().unsigned().defaultTo(0);
+    })
+        .then(() => {
+            logger.info('[' + migrate_name + '] proxy_host Table altered');
+        });
+
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+    return Promise.resolve(true);
+};

src/backend/migrations/20181019052346_forward_host.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const migrate_name = 'forward_host';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.table('proxy_host', function (proxy_host) {
+        proxy_host.renameColumn('forward_ip', 'forward_host');
+    })
+        .then(() => {
+            logger.info('[' + migrate_name + '] proxy_host Table altered');
+        });
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+    return Promise.resolve(true);
+};

src/backend/migrations/20181113041458_http2_support.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const migrate_name = 'http2_support';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.table('proxy_host', function (proxy_host) {
+        proxy_host.integer('http2_support').notNull().unsigned().defaultTo(0);
+    })
+        .then(() => {
+            logger.info('[' + migrate_name + '] proxy_host Table altered');
+
+            return knex.schema.table('redirection_host', function (redirection_host) {
+                redirection_host.integer('http2_support').notNull().unsigned().defaultTo(0);
+            });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] redirection_host Table altered');
+
+            return knex.schema.table('dead_host', function (dead_host) {
+                dead_host.integer('http2_support').notNull().unsigned().defaultTo(0);
+            });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] dead_host Table altered');
+        });
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+    return Promise.resolve(true);
+};
+

src/backend/migrations/20181213013211_forward_scheme.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const migrate_name = 'forward_scheme';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.table('proxy_host', function (proxy_host) {
+        proxy_host.string('forward_scheme').notNull().defaultTo('http');
+    })
+        .then(() => {
+            logger.info('[' + migrate_name + '] proxy_host Table altered');
+        });
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+    return Promise.resolve(true);
+};

src/backend/migrations/20190104035154_disabled.js

@@ -0,0 +1,57 @@
+'use strict';
+
+const migrate_name = 'disabled';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.table('proxy_host', function (proxy_host) {
+        proxy_host.integer('enabled').notNull().unsigned().defaultTo(1);
+    })
+        .then(() => {
+            logger.info('[' + migrate_name + '] proxy_host Table altered');
+
+            return knex.schema.table('redirection_host', function (redirection_host) {
+                redirection_host.integer('enabled').notNull().unsigned().defaultTo(1);
+            });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] redirection_host Table altered');
+
+            return knex.schema.table('dead_host', function (dead_host) {
+                dead_host.integer('enabled').notNull().unsigned().defaultTo(1);
+            });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] dead_host Table altered');
+
+            return knex.schema.table('stream', function (stream) {
+                stream.integer('enabled').notNull().unsigned().defaultTo(1);
+            });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] stream Table altered');
+        });
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+    return Promise.resolve(true);
+};

src/backend/migrations/20190215115310_customlocations.js

@@ -0,0 +1,37 @@
+'use strict';
+
+const migrate_name = 'custom_locations';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ * Extends proxy_host table with locations field
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.table('proxy_host', function (proxy_host) {
+        proxy_host.json('locations');
+    })
+        .then(() => {
+            logger.info('[' + migrate_name + '] proxy_host Table altered');
+        })
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+    return Promise.resolve(true);
+};

src/backend/migrations/20190218060101_hsts.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const migrate_name = 'hsts';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.table('proxy_host', function (proxy_host) {
+            proxy_host.integer('hsts_enabled').notNull().unsigned().defaultTo(0);
+            proxy_host.integer('hsts_subdomains').notNull().unsigned().defaultTo(0);
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] proxy_host Table altered');
+
+            return knex.schema.table('redirection_host', function (redirection_host) {
+                redirection_host.integer('hsts_enabled').notNull().unsigned().defaultTo(0);
+                redirection_host.integer('hsts_subdomains').notNull().unsigned().defaultTo(0);
+            });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] redirection_host Table altered');
+
+            return knex.schema.table('dead_host', function (dead_host) {
+                dead_host.integer('hsts_enabled').notNull().unsigned().defaultTo(0);
+                dead_host.integer('hsts_subdomains').notNull().unsigned().defaultTo(0);
+            });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] dead_host Table altered');
+        });
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down this one.');
+    return Promise.resolve(true);
+};

src/backend/migrations/20190227065017_settings.js

@@ -0,0 +1,54 @@
+const migrate_name = 'settings';
+const logger       = require('../logger').migrate;
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.up = function (knex/*, Promise*/) {
+    logger.info('[' + migrate_name + '] Migrating Up...');
+
+    return knex.schema.createTable('setting', table => {
+            table.string('id').notNull().primary();
+            table.string('name', 100).notNull();
+            table.string('description', 255).notNull();
+            table.string('value', 255).notNull();
+            table.json('meta').notNull();
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] setting Table created');
+
+            // TODO: add settings
+            let settingModel = require('../models/setting');
+
+            return settingModel
+                .query()
+                .insert({
+                    id:          'default-site',
+                    name:        'Default Site',
+                    description: 'What to show when Nginx is hit with an unknown Host',
+                    value:       'congratulations',
+                    meta:        {}
+                });
+        })
+        .then(() => {
+            logger.info('[' + migrate_name + '] Default settings added');
+        });
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object}  knex
+ * @param   {Promise} Promise
+ * @returns {Promise}
+ */
+exports.down = function (knex, Promise) {
+    logger.warn('[' + migrate_name + '] You can\'t migrate down the initial data.');
+    return Promise.resolve(true);
+};

src/backend/models/proxy_host.js

@@ -47,7 +47,7 @@ class ProxyHost extends Model {
     }
 
     static get jsonAttributes () {
-        return ['domain_names', 'meta'];
+        return ['domain_names', 'meta', 'locations'];
     }
 
     static get relationMappings () {

src/backend/models/setting.js

@@ -0,0 +1,30 @@
+// Objection Docs:
+// http://vincit.github.io/objection.js/
+
+const db    = require('../db');
+const Model = require('objection').Model;
+
+Model.knex(db);
+
+class Setting extends Model {
+    $beforeInsert () {
+        // Default for meta
+        if (typeof this.meta === 'undefined') {
+            this.meta = {};
+        }
+    }
+
+    static get name () {
+        return 'Setting';
+    }
+
+    static get tableName () {
+        return 'setting';
+    }
+
+    static get jsonAttributes () {
+        return ['meta'];
+    }
+}
+
+module.exports = Setting;

src/backend/routes/api/main.js

@@ -31,6 +31,7 @@ router.use('/tokens', require('./tokens'));
 router.use('/users', require('./users'));
 router.use('/audit-log', require('./audit-log'));
 router.use('/reports', require('./reports'));
+router.use('/settings', require('./settings'));
 router.use('/nginx/proxy-hosts', require('./nginx/proxy_hosts'));
 router.use('/nginx/redirection-hosts', require('./nginx/redirection_hosts'));
 router.use('/nginx/dead-hosts', require('./nginx/dead_hosts'));

src/backend/routes/api/nginx/access_lists.js

@@ -20,7 +20,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/access-lists
@@ -79,7 +79,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/access-lists/123

src/backend/routes/api/nginx/certificates.js

@@ -20,7 +20,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/certificates
@@ -79,7 +79,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/certificates/123
@@ -157,7 +157,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * POST /api/nginx/certificates/123/upload
@@ -191,7 +191,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * POST /api/nginx/certificates/validate

src/backend/routes/api/nginx/dead_hosts.js

@@ -20,7 +20,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/dead-hosts
@@ -79,7 +79,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/dead-hosts/123
@@ -147,4 +147,52 @@ router
             .catch(next);
     });
 
+/**
+ * Enable dead-host
+ *
+ * /api/nginx/dead-hosts/123/enable
+ */
+router
+    .route('/:host_id/enable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/dead-hosts/123/enable
+     */
+    .post((req, res, next) => {
+        internalDeadHost.enable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
+/**
+ * Disable dead-host
+ *
+ * /api/nginx/dead-hosts/123/disable
+ */
+router
+    .route('/:host_id/disable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/dead-hosts/123/disable
+     */
+    .post((req, res, next) => {
+        internalDeadHost.disable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
 module.exports = router;

src/backend/routes/api/nginx/proxy_hosts.js

@@ -20,7 +20,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/proxy-hosts
@@ -79,7 +79,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/proxy-hosts/123
@@ -147,4 +147,52 @@ router
             .catch(next);
     });
 
+/**
+ * Enable proxy-host
+ *
+ * /api/nginx/proxy-hosts/123/enable
+ */
+router
+    .route('/:host_id/enable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/proxy-hosts/123/enable
+     */
+    .post((req, res, next) => {
+        internalProxyHost.enable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
+/**
+ * Disable proxy-host
+ *
+ * /api/nginx/proxy-hosts/123/disable
+ */
+router
+    .route('/:host_id/disable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/proxy-hosts/123/disable
+     */
+    .post((req, res, next) => {
+        internalProxyHost.disable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
 module.exports = router;

src/backend/routes/api/nginx/redirection_hosts.js

@@ -20,7 +20,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/redirection-hosts
@@ -79,7 +79,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/nginx/redirection-hosts/123
@@ -147,4 +147,52 @@ router
             .catch(next);
     });
 
+/**
+ * Enable redirection-host
+ *
+ * /api/nginx/redirection-hosts/123/enable
+ */
+router
+    .route('/:host_id/enable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/redirection-hosts/123/enable
+     */
+    .post((req, res, next) => {
+        internalRedirectionHost.enable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
+/**
+ * Disable redirection-host
+ *
+ * /api/nginx/redirection-hosts/123/disable
+ */
+router
+    .route('/:host_id/disable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/redirection-hosts/123/disable
+     */
+    .post((req, res, next) => {
+        internalRedirectionHost.disable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
 module.exports = router;

src/backend/routes/api/nginx/streams.js

@@ -147,4 +147,52 @@ router
             .catch(next);
     });
 
+/**
+ * Enable stream
+ *
+ * /api/nginx/streams/123/enable
+ */
+router
+    .route('/:host_id/enable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/streams/123/enable
+     */
+    .post((req, res, next) => {
+        internalStream.enable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
+/**
+ * Disable stream
+ *
+ * /api/nginx/streams/123/disable
+ */
+router
+    .route('/:host_id/disable')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * POST /api/nginx/streams/123/disable
+     */
+    .post((req, res, next) => {
+        internalStream.disable(res.locals.access, {id: parseInt(req.params.host_id, 10)})
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
 module.exports = router;

src/backend/routes/api/settings.js

@@ -0,0 +1,96 @@
+const express         = require('express');
+const validator       = require('../../lib/validator');
+const jwtdecode       = require('../../lib/express/jwt-decode');
+const internalSetting = require('../../internal/setting');
+const apiValidator    = require('../../lib/validator/api');
+
+let router = express.Router({
+    caseSensitive: true,
+    strict:        true,
+    mergeParams:   true
+});
+
+/**
+ * /api/settings
+ */
+router
+    .route('/')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * GET /api/settings
+     *
+     * Retrieve all settings
+     */
+    .get((req, res, next) => {
+        internalSetting.getAll(res.locals.access)
+            .then(rows => {
+                res.status(200)
+                    .send(rows);
+            })
+            .catch(next);
+    });
+
+/**
+ * Specific setting
+ *
+ * /api/settings/something
+ */
+router
+    .route('/:setting_id')
+    .options((req, res) => {
+        res.sendStatus(204);
+    })
+    .all(jwtdecode())
+
+    /**
+     * GET /settings/something
+     *
+     * Retrieve a specific setting
+     */
+    .get((req, res, next) => {
+        validator({
+            required:             ['setting_id'],
+            additionalProperties: false,
+            properties:           {
+                setting_id: {
+                    $ref: 'definitions#/definitions/setting_id'
+                }
+            }
+        }, {
+            setting_id: req.params.setting_id
+        })
+            .then(data => {
+                return internalSetting.get(res.locals.access, {
+                    id: data.setting_id
+                });
+            })
+            .then(row => {
+                res.status(200)
+                    .send(row);
+            })
+            .catch(next);
+    })
+
+    /**
+     * PUT /api/settings/something
+     *
+     * Update and existing setting
+     */
+    .put((req, res, next) => {
+        apiValidator({$ref: 'endpoints/settings#/links/1/schema'}, req.body)
+            .then(payload => {
+                payload.id = req.params.setting_id;
+                return internalSetting.update(res.locals.access, payload);
+            })
+            .then(result => {
+                res.status(200)
+                    .send(result);
+            })
+            .catch(next);
+    });
+
+module.exports = router;

src/backend/routes/api/users.js

@@ -21,7 +21,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * GET /api/users
@@ -80,7 +80,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
     .all(userIdFromMe)
 
     /**
@@ -160,7 +160,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
     .all(userIdFromMe)
 
     /**
@@ -191,7 +191,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
     .all(userIdFromMe)
 
     /**
@@ -222,7 +222,7 @@ router
     .options((req, res) => {
         res.sendStatus(204);
     })
-    .all(jwtdecode()) // preferred so it doesn't apply to nonexistent routes
+    .all(jwtdecode())
 
     /**
      * POST /api/users/123/login

src/backend/schema/definitions.json

@@ -9,6 +9,13 @@
       "type": "integer",
       "minimum": 1
     },
+    "setting_id": {
+      "description": "Unique identifier for a Setting",
+      "example": "default-site",
+      "readOnly": true,
+      "type": "string",
+      "minLength": 2
+    },
     "token": {
       "type": "string",
       "minLength": 10
@@ -172,6 +179,11 @@
         "pattern": "^(?:\\*\\.)?(?:[^.*]+\\.?)+[^.]$"
       }
     },
+    "enabled": {
+      "description": "Is Enabled",
+      "example": true,
+      "type": "boolean"
+    },
     "ssl_enabled": {
       "description": "Is SSL Enabled",
       "example": true,
@@ -182,10 +194,25 @@
       "example": false,
       "type": "boolean"
     },
+    "hsts_enabled": {
+      "description": "Is HSTS Enabled",
+      "example": false,
+      "type": "boolean"
+    },
+    "hsts_subdomains": {
+      "description": "Is HSTS applicable to all subdomains",
+      "example": false,
+      "type": "boolean"
+    },
     "ssl_provider": {
       "type": "string",
       "pattern": "^(letsencrypt|other)$"
     },
+    "http2_support": {
+      "description": "HTTP2 Protocol Support",
+      "example": false,
+      "type": "boolean"
+    },
     "block_exploits": {
       "description": "Should we block common exploits",
       "example": true,

src/backend/schema/endpoints/dead-hosts.json

@@ -24,9 +24,21 @@
     "ssl_forced": {
       "$ref": "../definitions.json#/definitions/ssl_forced"
     },
+    "hsts_enabled": {
+      "$ref": "../definitions.json#/definitions/hsts_enabled"
+    },
+    "hsts_subdomains": {
+      "$ref": "../definitions.json#/definitions/hsts_subdomains"
+    },
+    "http2_support": {
+      "$ref": "../definitions.json#/definitions/http2_support"
+    },
     "advanced_config": {
       "type": "string"
     },
+    "enabled": {
+      "$ref": "../definitions.json#/definitions/enabled"
+    },
     "meta": {
       "type": "object"
     }
@@ -50,9 +62,21 @@
     "ssl_forced": {
       "$ref": "#/definitions/ssl_forced"
     },
+    "hsts_enabled": {
+      "$ref": "#/definitions/hsts_enabled"
+    },
+    "hsts_subdomains": {
+      "$ref": "#/definitions/hsts_subdomains"
+    },
+    "http2_support": {
+      "$ref": "#/definitions/http2_support"
+    },
     "advanced_config": {
       "$ref": "#/definitions/advanced_config"
     },
+    "enabled": {
+      "$ref": "#/definitions/enabled"
+    },
     "meta": {
       "$ref": "#/definitions/meta"
     }
@@ -101,6 +125,15 @@
           "ssl_forced": {
             "$ref": "#/definitions/ssl_forced"
           },
+          "hsts_enabled": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "hsts_subdomains": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "http2_support": {
+            "$ref": "#/definitions/http2_support"
+          },
           "advanced_config": {
             "$ref": "#/definitions/advanced_config"
           },
@@ -138,6 +171,15 @@
           "ssl_forced": {
             "$ref": "#/definitions/ssl_forced"
           },
+          "hsts_enabled": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "hsts_subdomains": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "http2_support": {
+            "$ref": "#/definitions/http2_support"
+          },
           "advanced_config": {
             "$ref": "#/definitions/advanced_config"
           },
@@ -165,6 +207,34 @@
       "targetSchema": {
         "type": "boolean"
       }
+    },
+    {
+      "title": "Enable",
+      "description": "Enables a existing 404 Host",
+      "href": "/nginx/dead-hosts/{definitions.identity.example}/enable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
+    },
+    {
+      "title": "Disable",
+      "description": "Disables a existing 404 Host",
+      "href": "/nginx/dead-hosts/{definitions.identity.example}/disable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
     }
   ]
 }

src/backend/schema/endpoints/proxy-hosts.json

@@ -18,9 +18,14 @@
     "domain_names": {
       "$ref": "../definitions.json#/definitions/domain_names"
     },
-    "forward_ip": {
+    "forward_scheme": {
       "type": "string",
-      "format": "ipv4"
+      "enum": ["http", "https"]
+    },
+    "forward_host": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 50
     },
     "forward_port": {
       "type": "integer",
@@ -33,20 +38,72 @@
     "ssl_forced": {
       "$ref": "../definitions.json#/definitions/ssl_forced"
     },
+    "hsts_enabled": {
+      "$ref": "../definitions.json#/definitions/hsts_enabled"
+    },
+    "hsts_subdomains": {
+      "$ref": "../definitions.json#/definitions/hsts_subdomains"
+    },
+    "http2_support": {
+      "$ref": "../definitions.json#/definitions/http2_support"
+    },
     "block_exploits": {
       "$ref": "../definitions.json#/definitions/block_exploits"
     },
     "caching_enabled": {
       "$ref": "../definitions.json#/definitions/caching_enabled"
     },
+    "allow_websocket_upgrade": {
+      "description": "Allow Websocket Upgrade for all paths",
+      "example": true,
+      "type": "boolean"
+    },
     "access_list_id": {
       "$ref": "../definitions.json#/definitions/access_list_id"
     },
     "advanced_config": {
       "type": "string"
     },
+    "enabled": {
+      "$ref": "../definitions.json#/definitions/enabled"
+    },
     "meta": {
       "type": "object"
+    },
+    "locations": {
+      "type": "array",
+      "minItems": 0,
+      "items": {
+        "type": "object",
+        "required": [
+          "forward_scheme",
+          "forward_host",
+          "forward_port",
+          "path"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "id": {
+            "type": ["integer", "null"]
+          },
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "forward_scheme": {
+            "$ref": "#/definitions/forward_scheme"
+          },
+          "forward_host": {
+            "$ref": "#/definitions/forward_host"
+          },
+          "forward_port": {
+            "$ref": "#/definitions/forward_port"
+          },
+          "advanced_config": {
+            "type": "string"
+          }
+        }
+      }
     }
   },
   "properties": {
@@ -62,8 +119,11 @@
     "domain_names": {
       "$ref": "#/definitions/domain_names"
     },
-    "forward_ip": {
-      "$ref": "#/definitions/forward_ip"
+    "forward_scheme": {
+      "$ref": "#/definitions/forward_scheme"
+    },
+    "forward_host": {
+      "$ref": "#/definitions/forward_host"
     },
     "forward_port": {
       "$ref": "#/definitions/forward_port"
@@ -74,20 +134,38 @@
     "ssl_forced": {
       "$ref": "#/definitions/ssl_forced"
     },
+    "hsts_enabled": {
+      "$ref": "#/definitions/hsts_enabled"
+    },
+    "hsts_subdomains": {
+      "$ref": "#/definitions/hsts_subdomains"
+    },
+    "http2_support": {
+      "$ref": "#/definitions/http2_support"
+    },
     "block_exploits": {
       "$ref": "#/definitions/block_exploits"
     },
     "caching_enabled": {
       "$ref": "#/definitions/caching_enabled"
     },
+    "allow_websocket_upgrade": {
+      "$ref": "#/definitions/allow_websocket_upgrade"
+    },
     "access_list_id": {
       "$ref": "#/definitions/access_list_id"
     },
     "advanced_config": {
       "$ref": "#/definitions/advanced_config"
     },
+    "enabled": {
+      "$ref": "#/definitions/enabled"
+    },
     "meta": {
       "$ref": "#/definitions/meta"
+    },
+    "locations": {
+      "$ref": "#/definitions/locations"
     }
   },
   "links": [
@@ -123,15 +201,19 @@
         "additionalProperties": false,
         "required": [
           "domain_names",
-          "forward_ip",
+          "forward_scheme",
+          "forward_host",
           "forward_port"
         ],
         "properties": {
           "domain_names": {
             "$ref": "#/definitions/domain_names"
           },
-          "forward_ip": {
-            "$ref": "#/definitions/forward_ip"
+          "forward_scheme": {
+            "$ref": "#/definitions/forward_scheme"
+          },
+          "forward_host": {
+            "$ref": "#/definitions/forward_host"
           },
           "forward_port": {
             "$ref": "#/definitions/forward_port"
@@ -142,20 +224,38 @@
           "ssl_forced": {
             "$ref": "#/definitions/ssl_forced"
           },
+          "hsts_enabled": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "hsts_subdomains": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "http2_support": {
+            "$ref": "#/definitions/http2_support"
+          },
           "block_exploits": {
             "$ref": "#/definitions/block_exploits"
           },
           "caching_enabled": {
             "$ref": "#/definitions/caching_enabled"
           },
+          "allow_websocket_upgrade": {
+            "$ref": "#/definitions/allow_websocket_upgrade"
+          },
           "access_list_id": {
             "$ref": "#/definitions/access_list_id"
           },
           "advanced_config": {
             "$ref": "#/definitions/advanced_config"
           },
+          "enabled": {
+            "$ref": "#/definitions/enabled"
+          },
           "meta": {
             "$ref": "#/definitions/meta"
+          },
+          "locations": {
+            "$ref": "#/definitions/locations"
           }
         }
       },
@@ -182,8 +282,11 @@
           "domain_names": {
             "$ref": "#/definitions/domain_names"
           },
-          "forward_ip": {
-            "$ref": "#/definitions/forward_ip"
+          "forward_scheme": {
+            "$ref": "#/definitions/forward_scheme"
+          },
+          "forward_host": {
+            "$ref": "#/definitions/forward_host"
           },
           "forward_port": {
             "$ref": "#/definitions/forward_port"
@@ -194,20 +297,38 @@
           "ssl_forced": {
             "$ref": "#/definitions/ssl_forced"
           },
+          "hsts_enabled": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "hsts_subdomains": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "http2_support": {
+            "$ref": "#/definitions/http2_support"
+          },
           "block_exploits": {
             "$ref": "#/definitions/block_exploits"
           },
           "caching_enabled": {
             "$ref": "#/definitions/caching_enabled"
           },
+          "allow_websocket_upgrade": {
+            "$ref": "#/definitions/allow_websocket_upgrade"
+          },
           "access_list_id": {
             "$ref": "#/definitions/access_list_id"
           },
           "advanced_config": {
             "$ref": "#/definitions/advanced_config"
           },
+          "enabled": {
+            "$ref": "#/definitions/enabled"
+          },
           "meta": {
             "$ref": "#/definitions/meta"
+          },
+          "locations": {
+            "$ref": "#/definitions/locations"
           }
         }
       },
@@ -230,6 +351,34 @@
       "targetSchema": {
         "type": "boolean"
       }
+    },
+    {
+      "title": "Enable",
+      "description": "Enables a existing Proxy Host",
+      "href": "/nginx/proxy-hosts/{definitions.identity.example}/enable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
+    },
+    {
+      "title": "Disable",
+      "description": "Disables a existing Proxy Host",
+      "href": "/nginx/proxy-hosts/{definitions.identity.example}/disable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
     }
   ]
 }

src/backend/schema/endpoints/redirection-hosts.json

@@ -32,12 +32,24 @@
     "ssl_forced": {
       "$ref": "../definitions.json#/definitions/ssl_forced"
     },
+    "hsts_enabled": {
+      "$ref": "../definitions.json#/definitions/hsts_enabled"
+    },
+    "hsts_subdomains": {
+      "$ref": "../definitions.json#/definitions/hsts_subdomains"
+    },
+    "http2_support": {
+      "$ref": "../definitions.json#/definitions/http2_support"
+    },
     "block_exploits": {
       "$ref": "../definitions.json#/definitions/block_exploits"
     },
     "advanced_config": {
       "type": "string"
     },
+    "enabled": {
+      "$ref": "../definitions.json#/definitions/enabled"
+    },
     "meta": {
       "type": "object"
     }
@@ -67,12 +79,24 @@
     "ssl_forced": {
       "$ref": "#/definitions/ssl_forced"
     },
+    "hsts_enabled": {
+      "$ref": "#/definitions/hsts_enabled"
+    },
+    "hsts_subdomains": {
+      "$ref": "#/definitions/hsts_subdomains"
+    },
+    "http2_support": {
+      "$ref": "#/definitions/http2_support"
+    },
     "block_exploits": {
       "$ref": "#/definitions/block_exploits"
     },
     "advanced_config": {
       "$ref": "#/definitions/advanced_config"
     },
+    "enabled": {
+      "$ref": "#/definitions/enabled"
+    },
     "meta": {
       "$ref": "#/definitions/meta"
     }
@@ -128,6 +152,15 @@
           "ssl_forced": {
             "$ref": "#/definitions/ssl_forced"
           },
+          "hsts_enabled": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "hsts_subdomains": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "http2_support": {
+            "$ref": "#/definitions/http2_support"
+          },
           "block_exploits": {
             "$ref": "#/definitions/block_exploits"
           },
@@ -174,6 +207,15 @@
           "ssl_forced": {
             "$ref": "#/definitions/ssl_forced"
           },
+          "hsts_enabled": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "hsts_subdomains": {
+            "$ref": "#/definitions/hsts_enabled"
+          },
+          "http2_support": {
+            "$ref": "#/definitions/http2_support"
+          },
           "block_exploits": {
             "$ref": "#/definitions/block_exploits"
           },
@@ -204,6 +246,34 @@
       "targetSchema": {
         "type": "boolean"
       }
+    },
+    {
+      "title": "Enable",
+      "description": "Enables a existing Redirection Host",
+      "href": "/nginx/redirection-hosts/{definitions.identity.example}/enable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
+    },
+    {
+      "title": "Disable",
+      "description": "Disables a existing Redirection Host",
+      "href": "/nginx/redirection-hosts/{definitions.identity.example}/disable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
     }
   ]
 }

src/backend/schema/endpoints/settings.json

@@ -0,0 +1,99 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "endpoints/settings",
+  "title": "Settings",
+  "description": "Endpoints relating to Settings",
+  "stability": "stable",
+  "type": "object",
+  "definitions": {
+    "id": {
+      "$ref": "../definitions.json#/definitions/setting_id"
+    },
+    "name": {
+      "description": "Name",
+      "example": "Default Site",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 100
+    },
+    "description": {
+      "description": "Description",
+      "example": "Default Site",
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 255
+    },
+    "value": {
+      "description": "Value",
+      "example": "404",
+      "type": "string",
+      "maxLength": 255
+    },
+    "meta": {
+      "type": "object"
+    }
+  },
+  "links": [
+    {
+      "title": "List",
+      "description": "Returns a list of Settings",
+      "href": "/settings",
+      "access": "private",
+      "method": "GET",
+      "rel": "self",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "array",
+        "items": {
+          "$ref": "#/properties"
+        }
+      }
+    },
+    {
+      "title": "Update",
+      "description": "Updates a existing Setting",
+      "href": "/settings/{definitions.identity.example}",
+      "access": "private",
+      "method": "PUT",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "schema": {
+        "type": "object",
+        "properties": {
+          "value": {
+            "$ref": "#/definitions/value"
+          },
+          "meta": {
+            "$ref": "#/definitions/meta"
+          }
+        }
+      },
+      "targetSchema": {
+        "properties": {
+          "$ref": "#/properties"
+        }
+      }
+    }
+  ],
+  "properties": {
+    "id": {
+      "$ref": "#/definitions/id"
+    },
+    "name": {
+      "$ref": "#/definitions/description"
+    },
+    "description": {
+      "$ref": "#/definitions/description"
+    },
+    "value": {
+      "$ref": "#/definitions/value"
+    },
+    "meta": {
+      "$ref": "#/definitions/meta"
+    }
+  }
+}

src/backend/schema/endpoints/streams.json

@@ -35,6 +35,9 @@
     "udp_forwarding": {
       "type": "boolean"
     },
+    "enabled": {
+      "$ref": "../definitions.json#/definitions/enabled"
+    },
     "meta": {
       "type": "object"
     }
@@ -64,6 +67,9 @@
     "udp_forwarding": {
       "$ref": "#/definitions/udp_forwarding"
     },
+    "enabled": {
+      "$ref": "#/definitions/enabled"
+    },
     "meta": {
       "$ref": "#/definitions/meta"
     }
@@ -184,6 +190,34 @@
       "targetSchema": {
         "type": "boolean"
       }
+    },
+    {
+      "title": "Enable",
+      "description": "Enables a existing Stream",
+      "href": "/nginx/streams/{definitions.identity.example}/enable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
+    },
+    {
+      "title": "Disable",
+      "description": "Disables a existing Stream",
+      "href": "/nginx/streams/{definitions.identity.example}/disable",
+      "access": "private",
+      "method": "POST",
+      "rel": "update",
+      "http_header": {
+        "$ref": "../examples.json#/definitions/auth_header"
+      },
+      "targetSchema": {
+        "type": "boolean"
+      }
     }
   ]
 }

src/backend/schema/index.json

@@ -34,6 +34,9 @@
     },
     "access-lists": {
       "$ref": "endpoints/access-lists.json"
+    },
+    "settings": {
+      "$ref": "endpoints/settings.json"
     }
   }
 }

src/backend/setup.js

@@ -3,10 +3,11 @@
 const fs                  = require('fs');
 const NodeRSA             = require('node-rsa');
 const config              = require('config');
-const logger              = require('./logger').global;
+const logger              = require('./logger').setup;
 const userModel           = require('./models/user');
 const userPermissionModel = require('./models/user_permission');
 const authModel           = require('./models/auth');
+const debug_mode          = process.env.NODE_ENV !== 'production';
 
 module.exports = function () {
     return new Promise((resolve, reject) => {
@@ -22,6 +23,9 @@ module.exports = function () {
                 config_data = require(filename);
             } catch (err) {
                 // do nothing
+                if (debug_mode) {
+                    logger.debug(filename + ' config file could not be required');
+                }
             }
 
             // Now create the keys and save them in the config.
@@ -40,12 +44,18 @@ module.exports = function () {
                     reject(err);
                 } else {
                     logger.info('Wrote JWT key pair to config file: ' + filename);
-                    config.util.loadFileConfigs();
-                    resolve();
+
+                    logger.warn('Restarting interface to apply new configuration');
+                    process.exit(0);
                 }
             });
+
         } else {
             // JWT key pair exists
+            if (debug_mode) {
+                logger.debug('JWT Keypair already exists');
+            }
+
             resolve();
         }
     })
@@ -54,49 +64,54 @@ module.exports = function () {
                 .query()
                 .select(userModel.raw('COUNT(`id`) as `count`'))
                 .where('is_deleted', 0)
-                .first('count')
-                .then(row => {
-                    if (!row.count) {
-                        // Create a new user and set password
-                        logger.info('Creating a new user: admin@example.com with password: changeme');
+                .first();
+        })
+        .then(row => {
+            if (!row.count) {
+                // Create a new user and set password
+                logger.info('Creating a new user: admin@example.com with password: changeme');
 
-                        let data = {
-                            is_deleted: 0,
-                            email:      'admin@example.com',
-                            name:       'Administrator',
-                            nickname:   'Admin',
-                            avatar:     '',
-                            roles:      ['admin']
-                        };
+                let data = {
+                    is_deleted: 0,
+                    email:      'admin@example.com',
+                    name:       'Administrator',
+                    nickname:   'Admin',
+                    avatar:     '',
+                    roles:      ['admin']
+                };
 
-                        return userModel
+                return userModel
+                    .query()
+                    .insertAndFetch(data)
+                    .then(user => {
+                        return authModel
                             .query()
-                            .insertAndFetch(data)
-                            .then(user => {
-                                return authModel
+                            .insert({
+                                user_id: user.id,
+                                type:    'password',
+                                secret:  'changeme',
+                                meta:    {}
+                            })
+                            .then(() => {
+                                return userPermissionModel
                                     .query()
                                     .insert({
-                                        user_id: user.id,
-                                        type:    'password',
-                                        secret:  'changeme',
-                                        meta:    {}
-                                    })
-                                    .then(() => {
-                                        return userPermissionModel
-                                            .query()
-                                            .insert({
-                                                user_id:           user.id,
-                                                visibility:        'all',
-                                                proxy_hosts:       'manage',
-                                                redirection_hosts: 'manage',
-                                                dead_hosts:        'manage',
-                                                streams:           'manage',
-                                                access_lists:      'manage',
-                                                certificates:      'manage'
-                                            });
+                                        user_id:           user.id,
+                                        visibility:        'all',
+                                        proxy_hosts:       'manage',
+                                        redirection_hosts: 'manage',
+                                        dead_hosts:        'manage',
+                                        streams:           'manage',
+                                        access_lists:      'manage',
+                                        certificates:      'manage'
                                     });
                             });
-                    }
-                });
+                    })
+                    .then(() => {
+                        logger.info('Initial setup completed');
+                    });
+            } else if (debug_mode) {
+                logger.debug('Admin user setup not required');
+            }
         });
 };

src/backend/templates/_hsts.conf

@@ -0,0 +1,8 @@
+{% if certificate and certificate_id > 0 -%}
+{% if ssl_forced == 1 or ssl_forced == true %}
+{% if hsts_enabled == 1 or hsts_enabled == true %}
+  # HSTS (ngx_http_headers_module is required) (31536000 seconds = 1 year)
+  add_header Strict-Transport-Security "max-age=31536000;{% if hsts_subdomains == 1 or hsts_subdomains == true -%} includeSubDomains;{% endif %} preload" always;
+{% endif %}
+{% endif %}
+{% endif %}

src/backend/templates/_listen.conf

@@ -1,5 +1,5 @@
   listen 80;
 {% if certificate -%}
-  listen 443 ssl;
+  listen 443 ssl{% if http2_support %} http2{% endif %};
 {% endif %}
-  server_name {{ domain_names | join: " " }};
+  server_name {{ domain_names | join: " " }};

src/backend/templates/_location.conf

@@ -0,0 +1,9 @@
+  location {{ path }} {
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Scheme $scheme;
+    proxy_set_header X-Forwarded-Proto  $scheme;
+    proxy_set_header X-Forwarded-For    $remote_addr;
+    proxy_pass       {{ forward_scheme }}://{{ forward_host }}:{{ forward_port }};
+    {{ advanced_config }}
+  }
+

src/backend/templates/dead_host.conf

@@ -1,12 +1,22 @@
 {% include "_header_comment.conf" %}
 
+{% if enabled %}
 server {
 {% include "_listen.conf" %}
 {% include "_certificates.conf" %}
+{% include "_hsts.conf" %}
 
   access_log /data/logs/dead_host-{{ id }}.log standard;
 
 {{ advanced_config }}
 
-  return 404;
+{% if use_default_location %}
+  location / {
+{% include "_forced_ssl.conf" %}
+{% include "_hsts.conf" %}
+    return 404;
+  }
+{% endif %}
+
 }
+{% endif %}

src/backend/templates/default.conf

@@ -0,0 +1,32 @@
+# ------------------------------------------------------------
+# Default Site
+# ------------------------------------------------------------
+{% if value == "congratulations" %}
+# Skipping output, congratulations page configration is baked in.
+{%- else %}
+server {
+  listen 80 default;
+  server_name default-host.localhost;
+  access_log /data/logs/default_host.log combined;
+{% include "_exploits.conf" %}
+
+{%- if value == "404" %}
+  location / {
+    return 404;
+  }
+{% endif %}
+
+{%- if value == "redirect" %}
+  location / {
+    return 301 {{ meta.redirect }};
+  }
+{%- endif %}
+
+{%- if value == "html" %}
+  root /data/nginx/default_www;
+  location / {
+    try_files $uri /index.html;
+  }
+{%- endif %}
+}
+{% endif %}

src/backend/templates/ip_ranges.conf

@@ -0,0 +1,3 @@
+{% for range in ip_ranges %}
+set_real_ip_from {{ range }};
+{% endfor %}

src/backend/templates/proxy_host.conf

@@ -1,18 +1,25 @@
 {% include "_header_comment.conf" %}
 
+{% if enabled %}
 server {
-  set $server {{ forward_ip }};
-  set $port   {{ forward_port }};
+  set $forward_scheme {{ forward_scheme }};
+  set $server         "{{ forward_host }}";
+  set $port           {{ forward_port }};
 
 {% include "_listen.conf" %}
 {% include "_certificates.conf" %}
 {% include "_assets.conf" %}
 {% include "_exploits.conf" %}
+{% include "_hsts.conf" %}
 
   access_log /data/logs/proxy_host-{{ id }}.log proxy;
 
 {{ advanced_config }}
 
+{{ locations }}
+
+{% if use_default_location %}
+
   location / {
     {%- if access_list_id > 0 -%}
     # Access List
@@ -21,8 +28,18 @@ server {
     {%- endif %}
 
 {% include "_forced_ssl.conf" %}
+{% include "_hsts.conf" %}
+
+    {% if allow_websocket_upgrade == 1 or allow_websocket_upgrade == true %}
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_http_version 1.1;
+    {% endif %}
 
     # Proxy!
     include conf.d/include/proxy.conf;
   }
+{% endif %}
+
 }
+{% endif %}

src/backend/templates/redirection_host.conf

@@ -1,19 +1,21 @@
 {% include "_header_comment.conf" %}
 
+{% if enabled %}
 server {
 {% include "_listen.conf" %}
 {% include "_certificates.conf" %}
 {% include "_assets.conf" %}
 {% include "_exploits.conf" %}
+{% include "_hsts.conf" %}
 
   access_log /data/logs/redirection_host-{{ id }}.log standard;
 
 {{ advanced_config }}
 
-  # TODO: Preserve Path Option
-
+{% if use_default_location %}
   location / {
 {% include "_forced_ssl.conf" %}
+{% include "_hsts.conf" %}
 
     {% if preserve_path == 1 or preserve_path == true %}
         return 301 $scheme://{{ forward_domain_name }}$request_uri;
@@ -21,4 +23,7 @@ server {
         return 301 $scheme://{{ forward_domain_name }};
     {% endif %}
   }
+{% endif %}
+
 }
+{% endif %}

src/backend/templates/stream.conf

@@ -2,6 +2,7 @@
 # {{ incoming_port }} TCP: {{ tcp_forwarding }} UDP: {{ udp_forwarding }}
 # ------------------------------------------------------------
 
+{% if enabled %}
 {% if tcp_forwarding == 1 or tcp_forwarding == true -%}
 server {
   listen {{ incoming_port }};
@@ -14,3 +15,4 @@ server {
   proxy_pass {{ forward_ip }}:{{ forwarding_port }};
 }
 {% endif %}
+{% endif %}

src/backend/views/index.ejs

@@ -5,5 +5,5 @@
     <span class="loader"></span>
 </div>
 
-<script type="text/javascript" src="/js/main.js?v=<%= version %>"></script>
+<script type="text/javascript" src="/js/main.bundle.js?v=<%= version %>"></script>
 <%- include partials/footer.ejs %>

src/backend/views/login.ejs

@@ -5,5 +5,5 @@
     <span class="loader"></span>
 </div>
 
-<script type="text/javascript" src="/js/login.js?v=<%= version %>"></script>
+<script type="text/javascript" src="/js/login.bundle.js?v=<%= version %>"></script>
 <%- include partials/footer.ejs %>

src/frontend/js/app/api.js

@@ -7,7 +7,7 @@ const Tokens = require('./tokens');
 /**
  * @param {String}  message
  * @param {*}       debug
- * @param {Integer} code
+ * @param {Number} code
  * @constructor
  */
 const ApiError = function (message, debug, code) {
@@ -129,7 +129,7 @@ function getAllObjects (path, expand, query) {
 }
 
 /**
- * @param   {String}  path
+ * @param   {String}    path
  * @param   {FormData}  form_data
  * @returns {Promise}
  */
@@ -241,7 +241,7 @@ module.exports = {
 
         /**
          * @param   {Object}   data
-         * @param   {Integer}  data.id
+         * @param   {Number}   data.id
          * @returns {Promise}
          */
         update: function (data) {
@@ -251,7 +251,7 @@ module.exports = {
         },
 
         /**
-         * @param   {Integer}  id
+         * @param   {Number}  id
          * @returns {Promise}
          */
         delete: function (id) {
@@ -260,7 +260,7 @@ module.exports = {
 
         /**
          *
-         * @param   {Integer}  id
+         * @param   {Number}   id
          * @param   {Object}   auth
          * @returns {Promise}
          */
@@ -269,7 +269,7 @@ module.exports = {
         },
 
         /**
-         * @param   {Integer}  id
+         * @param   {Number}  id
          * @returns {Promise}
          */
         loginAs: function (id) {
@@ -278,7 +278,7 @@ module.exports = {
 
         /**
          *
-         * @param   {Integer}  id
+         * @param   {Number}   id
          * @param   {Object}   perms
          * @returns {Promise}
          */
@@ -308,7 +308,7 @@ module.exports = {
 
             /**
              * @param   {Object}   data
-             * @param   {Integer}  data.id
+             * @param   {Number}  data.id
              * @returns {Promise}
              */
             update: function (data) {
@@ -318,11 +318,35 @@ module.exports = {
             },
 
             /**
-             * @param   {Integer}  id
+             * @param   {Number}  id
              * @returns {Promise}
              */
             delete: function (id) {
                 return fetch('delete', 'nginx/proxy-hosts/' + id);
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            get: function (id) {
+                return fetch('get', 'nginx/proxy-hosts/' + id);
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            enable: function (id) {
+                return fetch('post', 'nginx/proxy-hosts/' + id + '/enable');
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            disable: function (id) {
+                return fetch('post', 'nginx/proxy-hosts/' + id + '/disable');
             }
         },
 
@@ -345,7 +369,7 @@ module.exports = {
 
             /**
              * @param   {Object}   data
-             * @param   {Integer}  data.id
+             * @param   {Number}   data.id
              * @returns {Promise}
              */
             update: function (data) {
@@ -355,7 +379,7 @@ module.exports = {
             },
 
             /**
-             * @param   {Integer}  id
+             * @param   {Number}  id
              * @returns {Promise}
              */
             delete: function (id) {
@@ -363,12 +387,36 @@ module.exports = {
             },
 
             /**
-             * @param  {Integer}  id
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            get: function (id) {
+                return fetch('get', 'nginx/redirection-hosts/' + id);
+            },
+
+            /**
+             * @param  {Number}   id
              * @param  {FormData} form_data
              * @params {Promise}
              */
             setCerts: function (id, form_data) {
                 return FileUpload('nginx/redirection-hosts/' + id + '/certificates', form_data);
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            enable: function (id) {
+                return fetch('post', 'nginx/redirection-hosts/' + id + '/enable');
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            disable: function (id) {
+                return fetch('post', 'nginx/redirection-hosts/' + id + '/disable');
             }
         },
 
@@ -391,7 +439,7 @@ module.exports = {
 
             /**
              * @param   {Object}   data
-             * @param   {Integer}  data.id
+             * @param   {Number}   data.id
              * @returns {Promise}
              */
             update: function (data) {
@@ -401,11 +449,35 @@ module.exports = {
             },
 
             /**
-             * @param   {Integer}  id
+             * @param   {Number}  id
              * @returns {Promise}
              */
             delete: function (id) {
                 return fetch('delete', 'nginx/streams/' + id);
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            get: function (id) {
+                return fetch('get', 'nginx/streams/' + id);
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            enable: function (id) {
+                return fetch('post', 'nginx/streams/' + id + '/enable');
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            disable: function (id) {
+                return fetch('post', 'nginx/streams/' + id + '/disable');
             }
         },
 
@@ -428,7 +500,7 @@ module.exports = {
 
             /**
              * @param   {Object}   data
-             * @param   {Integer}  data.id
+             * @param   {Number}   data.id
              * @returns {Promise}
              */
             update: function (data) {
@@ -438,7 +510,7 @@ module.exports = {
             },
 
             /**
-             * @param   {Integer}  id
+             * @param   {Number}  id
              * @returns {Promise}
              */
             delete: function (id) {
@@ -446,12 +518,36 @@ module.exports = {
             },
 
             /**
-             * @param  {Integer}  id
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            get: function (id) {
+                return fetch('get', 'nginx/dead-hosts/' + id);
+            },
+
+            /**
+             * @param  {Number}   id
              * @param  {FormData} form_data
              * @params {Promise}
              */
             setCerts: function (id, form_data) {
                 return FileUpload('nginx/dead-hosts/' + id + '/certificates', form_data);
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            enable: function (id) {
+                return fetch('post', 'nginx/dead-hosts/' + id + '/enable');
+            },
+
+            /**
+             * @param   {Number}  id
+             * @returns {Promise}
+             */
+            disable: function (id) {
+                return fetch('post', 'nginx/dead-hosts/' + id + '/disable');
             }
         },
 
@@ -474,7 +570,7 @@ module.exports = {
 
             /**
              * @param   {Object}   data
-             * @param   {Integer}  data.id
+             * @param   {Number}   data.id
              * @returns {Promise}
              */
             update: function (data) {
@@ -484,7 +580,7 @@ module.exports = {
             },
 
             /**
-             * @param   {Integer}  id
+             * @param   {Number}  id
              * @returns {Promise}
              */
             delete: function (id) {
@@ -511,7 +607,7 @@ module.exports = {
 
             /**
              * @param   {Object}   data
-             * @param   {Integer}  data.id
+             * @param   {Number}   data.id
              * @returns {Promise}
              */
             update: function (data) {
@@ -521,7 +617,7 @@ module.exports = {
             },
 
             /**
-             * @param   {Integer}  id
+             * @param   {Number}  id
              * @returns {Promise}
              */
             delete: function (id) {
@@ -529,7 +625,7 @@ module.exports = {
             },
 
             /**
-             * @param  {Integer}  id
+             * @param  {Number}  id
              * @param  {FormData} form_data
              * @params {Promise}
              */
@@ -566,5 +662,34 @@ module.exports = {
         getHostStats: function () {
             return fetch('get', 'reports/hosts');
         }
+    },
+
+    Settings: {
+
+        /**
+         * @param   {String}  setting_id
+         * @returns {Promise}
+         */
+        getById: function (setting_id) {
+            return fetch('get', 'settings/' + setting_id);
+        },
+
+        /**
+         * @returns {Promise}
+         */
+        getAll: function () {
+            return getAllObjects('settings');
+        },
+
+        /**
+         * @param   {Object}   data
+         * @param   {Number}   data.id
+         * @returns {Promise}
+         */
+        update: function (data) {
+            let id = data.id;
+            delete data.id;
+            return fetch('put', 'settings/' + id, data);
+        }
     }
 };

src/frontend/js/app/controller.js

@@ -383,6 +383,36 @@ module.exports = {
         }
     },
 
+    /**
+     * Settings
+     */
+    showSettings: function () {
+        let controller = this;
+        if (Cache.User.isAdmin()) {
+            require(['./main', './settings/main'], (App, View) => {
+                controller.navigate('/settings');
+                App.UI.showAppContent(new View());
+            });
+        } else {
+            this.showDashboard();
+        }
+    },
+
+    /**
+     * Settings Item Form
+     *
+     * @param model
+     */
+    showSettingForm: function (model) {
+        if (Cache.User.isAdmin()) {
+            if (model.get('id') === 'default-site') {
+                require(['./main', './settings/default-site/main'], function (App, View) {
+                    App.UI.showModalDialog(new View({model: model}));
+                });
+            }
+        }
+    },
+
     /**
      * Logout
      */

src/frontend/js/app/nginx/certificates/form.js

@@ -12,7 +12,7 @@ require('selectize');
 module.exports = Mn.View.extend({
     template:      template,
     className:     'modal-dialog',
-    max_file_size: 5120,
+    max_file_size: 102400,
 
     ui: {
         form:                           'form',
@@ -56,7 +56,7 @@ module.exports = Mn.View.extend({
                     return;
                 } else {
                     if (this.ui.other_certificate[0].files[0].size > this.max_file_size) {
-                        alert('Certificate file is too large (> 5kb)');
+                        alert('Certificate file is too large (> 100kb)');
                         return;
                     }
                     ssl_files.push({name: 'certificate', file: this.ui.other_certificate[0].files[0]});
@@ -67,7 +67,7 @@ module.exports = Mn.View.extend({
                     return;
                 } else {
                     if (this.ui.other_certificate_key[0].files[0].size > this.max_file_size) {
-                        alert('Certificate key file is too large (> 5kb)');
+                        alert('Certificate key file is too large (> 100kb)');
                         return;
                     }
                     ssl_files.push({name: 'certificate_key', file: this.ui.other_certificate_key[0].files[0]});
@@ -75,7 +75,7 @@ module.exports = Mn.View.extend({
 
                 if (this.ui.other_intermediate_certificate[0].files.length && this.ui.other_intermediate_certificate[0].files[0].size) {
                     if (this.ui.other_intermediate_certificate[0].files[0].size > this.max_file_size) {
-                        alert('Intermediate Certificate file is too large (> 5kb)');
+                        alert('Intermediate Certificate file is too large (> 100kb)');
                         return;
                     }
                     ssl_files.push({name: 'intermediate_certificate', file: this.ui.other_intermediate_certificate[0].files[0]});

src/frontend/js/app/nginx/dead/form.ejs

@@ -36,7 +36,7 @@
                                 </select>
                             </div>
                         </div>
-                        <div class="col-sm-12 col-md-12">
+                        <div class="col-sm-6 col-md-6">
                             <div class="form-group">
                                 <label class="custom-switch">
                                     <input type="checkbox" class="custom-switch-input" name="ssl_forced" value="1"<%- ssl_forced ? ' checked' : '' %><%- certificate_id ? '' : ' disabled' %>>
@@ -45,6 +45,33 @@
                                 </label>
                             </div>
                         </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="http2_support" value="1"<%- http2_support ? ' checked' : '' %><%- certificate_id ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'http2-support') %></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="hsts_enabled" value="1"<%- hsts_enabled ? ' checked' : '' %><%- certificate_id && ssl_forced ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'hsts-enabled') %> <a href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank"><i class="fe fe-help-circle"></i></a></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="hsts_subdomains" value="1"<%- hsts_subdomains ? ' checked' : '' %><%- certificate_id && ssl_forced && hsts_enabled ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'hsts-subdomains') %></span>
+                                </label>
+                            </div>
+                        </div>
 
                         <!-- Lets encrypt -->
                         <div class="col-sm-12 col-md-12 letsencrypt">

src/frontend/js/app/nginx/dead/form.js

@@ -22,6 +22,9 @@ module.exports = Mn.View.extend({
         save:               'button.save',
         certificate_select: 'select[name="certificate_id"]',
         ssl_forced:         'input[name="ssl_forced"]',
+        hsts_enabled:       'input[name="hsts_enabled"]',
+        hsts_subdomains:    'input[name="hsts_subdomains"]',
+        http2_support:      'input[name="http2_support"]',
         letsencrypt:        '.letsencrypt'
     },
 
@@ -35,7 +38,44 @@ module.exports = Mn.View.extend({
             }
 
             let enabled = id === 'new' || parseInt(id, 10) > 0;
-            this.ui.ssl_forced.prop('disabled', !enabled).parents('.form-group').css('opacity', enabled ? 1 : 0.5);
+
+            let inputs = this.ui.ssl_forced.add(this.ui.http2_support);
+            inputs
+                .prop('disabled', !enabled)
+                .parents('.form-group')
+                .css('opacity', enabled ? 1 : 0.5);
+
+            if (!enabled) {
+                inputs.prop('checked', false);
+            }
+
+            inputs.trigger('change');
+        },
+
+        'change @ui.ssl_forced': function () {
+            let checked = this.ui.ssl_forced.prop('checked');
+            this.ui.hsts_enabled
+                .prop('disabled', !checked)
+                .parents('.form-group')
+                .css('opacity', checked ? 1 : 0.5);
+
+            if (!checked) {
+                this.ui.hsts_enabled.prop('checked', false);
+            }
+
+            this.ui.hsts_enabled.trigger('change');
+        },
+
+        'change @ui.hsts_enabled': function () {
+            let checked = this.ui.hsts_enabled.prop('checked');
+            this.ui.hsts_subdomains
+                .prop('disabled', !checked)
+                .parents('.form-group')
+                .css('opacity', checked ? 1 : 0.5);
+
+            if (!checked) {
+                this.ui.hsts_subdomains.prop('checked', false);
+            }
         },
 
         'click @ui.save': function (e) {
@@ -50,9 +90,10 @@ module.exports = Mn.View.extend({
             let data = this.ui.form.serializeJSON();
 
             // Manipulate
-            if (typeof data.ssl_forced !== 'undefined' && data.ssl_forced === '1') {
-                data.ssl_forced = true;
-            }
+            data.hsts_enabled    = !!data.hsts_enabled;
+            data.hsts_subdomains = !!data.hsts_subdomains;
+            data.http2_support   = !!data.http2_support;
+            data.ssl_forced      = !!data.ssl_forced;
 
             if (typeof data.domain_names === 'string' && data.domain_names) {
                 data.domain_names = data.domain_names.split(',');
@@ -74,7 +115,7 @@ module.exports = Mn.View.extend({
 
                 data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';
             } else {
-                data.certificate_id = parseInt(data.certificate_id, 0);
+                data.certificate_id = parseInt(data.certificate_id, 10);
             }
 
             let method = App.Api.Nginx.DeadHosts.create;

src/frontend/js/app/nginx/dead/list/item.ejs

@@ -6,9 +6,15 @@
 <td>
     <div>
         <% domain_names.map(function(host) {
-            %>
-            <span class="tag"><%- host %></span>
-            <%
+            if (host.indexOf('*') === -1) {
+                %>
+                <span class="tag host-link hover-red" rel="http<%- certificate_id ? 's' : '' %>://<%- host %>"><%- host %></span>
+                <%
+            } else {
+                %>
+                <span class="tag"><%- host %></span>
+                <%
+            }
         });
         %>
     </div>
@@ -22,7 +28,9 @@
 <td>
     <%
     var o = isOnline();
-    if (o === true) { %>
+    if (!enabled) { %>
+        <span class="status-icon bg-warning"></span> <%- i18n('str', 'disabled') %>
+    <% } else if (o === true) { %>
         <span class="status-icon bg-success"></span> <%- i18n('str', 'online') %>
     <% } else if (o === false) { %>
         <span title="<%- getOfflineError() %>"><span class="status-icon bg-danger"></span> <%- i18n('str', 'offline') %></span>
@@ -36,7 +44,7 @@
         <a href="#" data-toggle="dropdown" class="icon"><i class="fe fe-more-vertical"></i></a>
         <div class="dropdown-menu dropdown-menu-right">
             <a href="#" class="edit dropdown-item"><i class="dropdown-icon fe fe-edit"></i> <%- i18n('str', 'edit') %></a>
-            <!--<a href="#" class="logs dropdown-item"><i class="dropdown-icon fe fe-book"></i> <%- i18n('str', 'logs') %></a>-->
+            <a href="#" class="able dropdown-item"><i class="dropdown-icon fe fe-power"></i> <%- i18n('str', enabled ? 'disable' : 'enable') %></a>
             <div class="dropdown-divider"></div>
             <a href="#" class="delete dropdown-item"><i class="dropdown-icon fe fe-trash-2"></i> <%- i18n('str', 'delete') %></a>
         </div>

src/frontend/js/app/nginx/dead/list/item.js

@@ -9,11 +9,25 @@ module.exports = Mn.View.extend({
     tagName:  'tr',
 
     ui: {
-        edit:   'a.edit',
-        delete: 'a.delete'
+        able:      'a.able',
+        edit:      'a.edit',
+        delete:    'a.delete',
+        host_link: '.host-link'
     },
 
     events: {
+        'click @ui.able': function (e) {
+            e.preventDefault();
+            let id = this.model.get('id');
+            App.Api.Nginx.DeadHosts[this.model.get('enabled') ? 'disable' : 'enable'](id)
+                .then(() => {
+                    return App.Api.Nginx.DeadHosts.get(id)
+                        .then(row => {
+                            this.model.set(row);
+                        });
+                });
+        },
+
         'click @ui.edit': function (e) {
             e.preventDefault();
             App.Controller.showNginxDeadForm(this.model);
@@ -22,6 +36,12 @@ module.exports = Mn.View.extend({
         'click @ui.delete': function (e) {
             e.preventDefault();
             App.Controller.showNginxDeadDeleteConfirm(this.model);
+        },
+
+        'click @ui.host_link': function (e) {
+            e.preventDefault();
+            let win = window.open($(e.currentTarget).attr('rel'), '_blank');
+            win.focus();
         }
     },
 

src/frontend/js/app/nginx/proxy/form.ejs

@@ -7,10 +7,22 @@
         <form>
             <ul class="nav nav-tabs" role="tablist">
                 <li role="presentation" class="nav-item"><a href="#details" aria-controls="tab1" role="tab" data-toggle="tab" class="nav-link active"><i class="fe fe-zap"></i> <%- i18n('all-hosts', 'details') %></a></li>
+                <li role="presentation" class="nav-item"><a href="#locations" aria-controls="tab4" role="tab" data-toggle="tab" class="nav-link"><i class="fe fe-layers"></i> <%- i18n('all-hosts', 'locations') %></a></li>
                 <li role="presentation" class="nav-item"><a href="#ssl-options" aria-controls="tab2" role="tab" data-toggle="tab" class="nav-link"><i class="fe fe-shield"></i> <%- i18n('str', 'ssl') %></a></li>
                 <li role="presentation" class="nav-item"><a href="#advanced" aria-controls="tab3" role="tab" data-toggle="tab" class="nav-link"><i class="fe fe-settings"></i> <%- i18n('all-hosts', 'advanced') %></a></li>
             </ul>
             <div class="tab-content">
+
+                <!-- Locations -->
+                <div class="tab-pane" id="locations">
+                    <div class="row">
+                        <div class="col-sm-12">
+                            <button type="button" class="btn btn-secondary add_location"><%- i18n('locations', 'new_location') %></button>
+                            <div class="locations_container mt-3"></div>
+                        </div>
+                    </div>
+                </div>
+
                 <!-- Details -->
                 <div role="tabpanel" class="tab-pane active" id="details">
                     <div class="row">
@@ -20,10 +32,19 @@
                                 <input type="text" name="domain_names" class="form-control" id="input-domains" value="<%- domain_names.join(',') %>" required>
                             </div>
                         </div>
-                        <div class="col-sm-8 col-md-8">
+                        <div class="col-sm-3 col-md-3">
                             <div class="form-group">
-                                <label class="form-label"><%- i18n('proxy-hosts', 'forward-ip') %><span class="form-required">*</span></label>
-                                <input type="text" name="forward_ip" class="form-control text-monospace" placeholder="000.000.000.000" value="<%- forward_ip %>" autocomplete="off" maxlength="15" required>
+                                <label class="form-label"><%- i18n('proxy-hosts', 'forward-scheme') %><span class="form-required">*</span></label>
+                                <select name="forward_scheme" class="form-control custom-select" placeholder="http">
+                                    <option value="http" <%- forward_scheme === 'http' ? 'selected' : '' %>>http</option>
+                                    <option value="https" <%- forward_scheme === 'https' ? 'selected' : '' %>>https</option>
+                                </select>
+                            </div>
+                        </div>
+                        <div class="col-sm-5 col-md-5">
+                            <div class="form-group">
+                                <label class="form-label"><%- i18n('proxy-hosts', 'forward-host') %><span class="form-required">*</span></label>
+                                <input type="text" name="forward_host" class="form-control text-monospace" placeholder="" value="<%- forward_host %>" autocomplete="off" maxlength="50" required>
                             </div>
                         </div>
                         <div class="col-sm-4 col-md-4">
@@ -50,6 +71,16 @@
                                 </label>
                             </div>
                         </div>
+                        <div class="col-sm-12 col-md-12">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="allow_websocket_upgrade" value="1"<%- allow_websocket_upgrade ? ' checked' : '' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('proxy-hosts', 'allow-websocket-upgrade') %></span>
+                                </label>
+                            </div>
+                        </div>
+
                         <div class="col-sm-12 col-md-12">
                             <div class="form-group">
                                 <label class="form-label"><%- i18n('proxy-hosts', 'access-list') %></label>
@@ -73,7 +104,7 @@
                                 </select>
                             </div>
                         </div>
-                        <div class="col-sm-12 col-md-12">
+                        <div class="col-sm-6 col-md-6">
                             <div class="form-group">
                                 <label class="custom-switch">
                                     <input type="checkbox" class="custom-switch-input" name="ssl_forced" value="1"<%- ssl_forced ? ' checked' : '' %><%- certificate_id ? '' : ' disabled' %>>
@@ -82,6 +113,33 @@
                                 </label>
                             </div>
                         </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="http2_support" value="1"<%- http2_support ? ' checked' : '' %><%- certificate_id ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'http2-support') %></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="hsts_enabled" value="1"<%- hsts_enabled ? ' checked' : '' %><%- certificate_id && ssl_forced ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'hsts-enabled') %> <a href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank"><i class="fe fe-help-circle"></i></a></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="hsts_subdomains" value="1"<%- hsts_subdomains ? ' checked' : '' %><%- certificate_id && ssl_forced && hsts_enabled ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'hsts-subdomains') %></span>
+                                </label>
+                            </div>
+                        </div>
 
                         <!-- Lets encrypt -->
                         <div class="col-sm-12 col-md-12 letsencrypt">
@@ -106,6 +164,12 @@
                 <div role="tabpanel" class="tab-pane" id="advanced">
                     <div class="row">
                         <div class="col-md-12">
+                            <p>Nginx variables available to you are:</p>
+                            <ul class="text-monospace">
+                                <li>$server          # Host/IP</li>
+                                <li>$port            # Port Number</li>
+                                <li>$forward_scheme  # http or https</li>
+                            </ul>
                             <div class="form-group mb-0">
                                 <label class="form-label"><%- i18n('all-hosts', 'advanced-config') %></label>
                                 <textarea name="advanced_config" rows="8" class="form-control text-monospace" placeholder="# <%- i18n('all-hosts', 'advanced-warning') %>"><%- advanced_config %></textarea>

src/frontend/js/app/nginx/proxy/form.js

@@ -3,32 +3,46 @@
 const Mn                     = require('backbone.marionette');
 const App                    = require('../../main');
 const ProxyHostModel         = require('../../../models/proxy-host');
+const ProxyLocationModel     = require('../../../models/proxy-host-location');
 const template               = require('./form.ejs');
 const certListItemTemplate   = require('../certificates-list-item.ejs');
 const accessListItemTemplate = require('./access-list-item.ejs');
+const CustomLocation         = require('./location');
 const Helpers                = require('../../../lib/helpers');
 
+
 require('jquery-serializejson');
-require('jquery-mask-plugin');
 require('selectize');
 
 module.exports = Mn.View.extend({
     template:  template,
     className: 'modal-dialog',
 
+    locationsCollection: new ProxyLocationModel.Collection(),
+
     ui: {
         form:               'form',
         domain_names:       'input[name="domain_names"]',
-        forward_ip:         'input[name="forward_ip"]',
+        forward_host:       'input[name="forward_host"]',
         buttons:            '.modal-footer button',
         cancel:             'button.cancel',
         save:               'button.save',
+        add_location_btn:   'button.add_location',
+        locations_container:'.locations_container',
         certificate_select: 'select[name="certificate_id"]',
         access_list_select: 'select[name="access_list_id"]',
         ssl_forced:         'input[name="ssl_forced"]',
+        hsts_enabled:       'input[name="hsts_enabled"]',
+        hsts_subdomains:    'input[name="hsts_subdomains"]',
+        http2_support:      'input[name="http2_support"]',
+        forward_scheme:     'select[name="forward_scheme"]',
         letsencrypt:        '.letsencrypt'
     },
 
+    regions: {
+        locations_regions: '@ui.locations_container'
+    },
+
     events: {
         'change @ui.certificate_select': function () {
             let id = this.ui.certificate_select.val();
@@ -39,7 +53,51 @@ module.exports = Mn.View.extend({
             }
 
             let enabled = id === 'new' || parseInt(id, 10) > 0;
-            this.ui.ssl_forced.prop('disabled', !enabled).parents('.form-group').css('opacity', enabled ? 1 : 0.5);
+
+            let inputs = this.ui.ssl_forced.add(this.ui.http2_support);
+            inputs
+                .prop('disabled', !enabled)
+                .parents('.form-group')
+                .css('opacity', enabled ? 1 : 0.5);
+
+            if (!enabled) {
+                inputs.prop('checked', false);
+            }
+
+            inputs.trigger('change');
+        },
+
+        'change @ui.ssl_forced': function () {
+            let checked = this.ui.ssl_forced.prop('checked');
+            this.ui.hsts_enabled
+                .prop('disabled', !checked)
+                .parents('.form-group')
+                .css('opacity', checked ? 1 : 0.5);
+
+            if (!checked) {
+                this.ui.hsts_enabled.prop('checked', false);
+            }
+
+            this.ui.hsts_enabled.trigger('change');
+        },
+
+        'change @ui.hsts_enabled': function () {
+            let checked = this.ui.hsts_enabled.prop('checked');
+            this.ui.hsts_subdomains
+                .prop('disabled', !checked)
+                .parents('.form-group')
+                .css('opacity', checked ? 1 : 0.5);
+
+            if (!checked) {
+                this.ui.hsts_subdomains.prop('checked', false);
+            }
+        },
+
+        'click @ui.add_location_btn': function (e) {
+            e.preventDefault();
+            
+            const model = new ProxyLocationModel.Model();
+            this.locationsCollection.add(model);
         },
 
         'click @ui.save': function (e) {
@@ -53,14 +111,25 @@ module.exports = Mn.View.extend({
             let view = this;
             let data = this.ui.form.serializeJSON();
 
-            // Manipulate
-            data.forward_port    = parseInt(data.forward_port, 10);
-            data.block_exploits  = !!data.block_exploits;
-            data.caching_enabled = !!data.caching_enabled;
+            // Add locations
+            data.locations = [];
+            this.locationsCollection.models.forEach((location) => {
+                data.locations.push(location.toJSON());
+            });
 
-            if (typeof data.ssl_forced !== 'undefined' && data.ssl_forced === '1') {
-                data.ssl_forced = true;
-            }
+            // Serialize collects path from custom locations
+            // This field must be removed from root object
+            delete data.path;
+
+            // Manipulate
+            data.forward_port            = parseInt(data.forward_port, 10);
+            data.block_exploits          = !!data.block_exploits;
+            data.caching_enabled         = !!data.caching_enabled;
+            data.allow_websocket_upgrade = !!data.allow_websocket_upgrade;
+            data.http2_support           = !!data.http2_support;
+            data.hsts_enabled            = !!data.hsts_enabled;
+            data.hsts_subdomains         = !!data.hsts_subdomains;
+            data.ssl_forced              = !!data.ssl_forced;
 
             if (typeof data.domain_names === 'string' && data.domain_names) {
                 data.domain_names = data.domain_names.split(',');
@@ -82,7 +151,7 @@ module.exports = Mn.View.extend({
 
                 data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';
             } else {
-                data.certificate_id = parseInt(data.certificate_id, 0);
+                data.certificate_id = parseInt(data.certificate_id, 10);
             }
 
             let method = App.Api.Nginx.ProxyHosts.create;
@@ -122,11 +191,8 @@ module.exports = Mn.View.extend({
     onRender: function () {
         let view = this;
 
-        // IP Address
-        this.ui.forward_ip.mask('099.099.099.099', {
-            clearIfNotMatch: true,
-            placeholder:     '000.000.000.000'
-        });
+        this.ui.ssl_forced.trigger('change');
+        this.ui.hsts_enabled.trigger('change');
 
         // Domain names
         this.ui.domain_names.selectize({
@@ -143,7 +209,6 @@ module.exports = Mn.View.extend({
         });
 
         // Access Lists
-        this.ui.letsencrypt.hide();
         this.ui.access_list_select.selectize({
             valueField:       'id',
             labelField:       'name',
@@ -209,5 +274,20 @@ module.exports = Mn.View.extend({
         if (typeof options.model === 'undefined' || !options.model) {
             this.model = new ProxyHostModel.Model();
         }
+
+        this.locationsCollection = new ProxyLocationModel.Collection();
+
+        // Custom locations
+        this.showChildView('locations_regions', new CustomLocation.LocationCollectionView({
+            collection: this.locationsCollection
+        }));
+
+        // Check wether there are any location defined
+        if (options.model && Array.isArray(options.model.attributes.locations)) {
+            options.model.attributes.locations.forEach((location) => {
+                let m = new ProxyLocationModel.Model(location);
+                this.locationsCollection.add(m);
+            });
+        }
     }
 });

src/frontend/js/app/nginx/proxy/list/item.ejs

@@ -6,9 +6,15 @@
 <td>
     <div>
         <% domain_names.map(function(host) {
-            %>
-            <span class="tag"><%- host %></span>
-            <%
+            if (host.indexOf('*') === -1) {
+                %>
+                <span class="tag host-link hover-green" rel="http<%- certificate_id ? 's' : '' %>://<%- host %>"><%- host %></span>
+                <%
+            } else {
+                %>
+                <span class="tag"><%- host %></span>
+                <%
+            }
         });
         %>
     </div>
@@ -17,7 +23,7 @@
     </div>
 </td>
 <td>
-    <div class="text-monospace"><%- forward_ip %>:<%- forward_port %></div>
+    <div class="text-monospace"><%- forward_scheme %>://<%- forward_host %>:<%- forward_port %></div>
 </td>
 <td>
     <div><%- certificate && certificate_id ? i18n('ssl', certificate.provider) : i18n('ssl', 'none') %></div>
@@ -28,7 +34,9 @@
 <td>
     <%
     var o = isOnline();
-    if (o === true) { %>
+    if (!enabled) { %>
+        <span class="status-icon bg-warning"></span> <%- i18n('str', 'disabled') %>
+    <% } else if (o === true) { %>
         <span class="status-icon bg-success"></span> <%- i18n('str', 'online') %>
     <% } else if (o === false) { %>
         <span title="<%- getOfflineError() %>"><span class="status-icon bg-danger"></span> <%- i18n('str', 'offline') %></span>
@@ -42,7 +50,7 @@
         <a href="#" data-toggle="dropdown" class="icon"><i class="fe fe-more-vertical"></i></a>
         <div class="dropdown-menu dropdown-menu-right">
             <a href="#" class="edit dropdown-item"><i class="dropdown-icon fe fe-edit"></i> <%- i18n('str', 'edit') %></a>
-            <!--<a href="#" class="logs dropdown-item"><i class="dropdown-icon fe fe-book"></i> <%- i18n('str', 'logs') %></a>-->
+            <a href="#" class="able dropdown-item"><i class="dropdown-icon fe fe-power"></i> <%- i18n('str', enabled ? 'disable' : 'enable') %></a>
             <div class="dropdown-divider"></div>
             <a href="#" class="delete dropdown-item"><i class="dropdown-icon fe fe-trash-2"></i> <%- i18n('str', 'delete') %></a>
         </div>

src/frontend/js/app/nginx/proxy/list/item.js

@@ -9,11 +9,25 @@ module.exports = Mn.View.extend({
     tagName:  'tr',
 
     ui: {
-        edit:   'a.edit',
-        delete: 'a.delete'
+        able:      'a.able',
+        edit:      'a.edit',
+        delete:    'a.delete',
+        host_link: '.host-link'
     },
 
     events: {
+        'click @ui.able': function (e) {
+            e.preventDefault();
+            let id = this.model.get('id');
+            App.Api.Nginx.ProxyHosts[this.model.get('enabled') ? 'disable' : 'enable'](id)
+                .then(() => {
+                    return App.Api.Nginx.ProxyHosts.get(id)
+                        .then(row => {
+                            this.model.set(row);
+                        });
+                });
+        },
+
         'click @ui.edit': function (e) {
             e.preventDefault();
             App.Controller.showNginxProxyForm(this.model);
@@ -22,6 +36,12 @@ module.exports = Mn.View.extend({
         'click @ui.delete': function (e) {
             e.preventDefault();
             App.Controller.showNginxProxyDeleteConfirm(this.model);
+        },
+
+        'click @ui.host_link': function (e) {
+            e.preventDefault();
+            let win = window.open($(e.currentTarget).attr('rel'), '_blank');
+            win.focus();
         }
     },
 

src/frontend/js/app/nginx/proxy/location-item.ejs

@@ -0,0 +1,63 @@
+<div class="location-block card">
+    <div class="card-body">
+        <div class="row">
+            <div class="col-sm-12">
+                <div class="form-group">
+                    <label class="form-label"><%- i18n('locations', 'location_label') %> <span class="form-required">*</span></label>
+                    <div class="row gutter-xs">
+                        <div class="col">
+                            <div class="input-group">
+                                <span class="input-group-prepend">
+                                    <span class="input-group-text">location</span>
+                                </span>
+                                <input type="text" name="path" class="form-control model" value="<%- path %>" placeholder="<%- i18n('locations', 'path') %>" required>
+                            </div>
+                        </div>
+                        <div class="col-auto">
+                            <div class="selectgroup">
+                                <label class="selectgroup-item">
+                                    <input type="checkbox" class="selectgroup-input">
+                                    <span class="selectgroup-button">
+                                        <i class="fe fe-settings"></i>
+                                    </span>
+                                </label>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
+            <div class="col-sm-3 col-md-3">
+                <div class="form-group">
+                    <label class="form-label"><%- i18n('proxy-hosts', 'forward-scheme') %><span class="form-required">*</span></label>
+                    <select name="forward_scheme" class="form-control custom-select model" placeholder="http">
+                        <option value="http" <%- forward_scheme === 'http' ? 'selected' : '' %>>http</option>
+                        <option value="https" <%- forward_scheme === 'https' ? 'selected' : '' %>>https</option>
+                    </select>
+                </div>
+            </div>
+            <div class="col-sm-5 col-md-5">
+                <div class="form-group">
+                    <label class="form-label"><%- i18n('proxy-hosts', 'forward-host') %><span class="form-required">*</span></label>
+                    <input type="text" name="forward_host" class="form-control text-monospace model" placeholder="" value="<%- forward_host %>" autocomplete="off" maxlength="50" required>
+                </div>
+            </div>
+            <div class="col-sm-4 col-md-4">
+                <div class="form-group">
+                    <label class="form-label"><%- i18n('proxy-hosts', 'forward-port') %> <span class="form-required">*</span></label>
+                    <input name="forward_port" type="number" class="form-control text-monospace model" placeholder="80" value="<%- forward_port %>" required>
+                </div>
+            </div>
+        </div>
+        <div class="row config">
+            <div class="col-md-12">
+                <div class="form-group">
+                    <textarea name="advanced_config" rows="8" class="form-control text-monospace model" placeholder="# <%- i18n('all-hosts', 'advanced-warning') %>"><%- advanced_config %></textarea>
+                </div>
+            </div>
+        </div>
+
+        <a href="#" class="card-link location-delete">
+            <i class="fa fa-trash"></i> <%- i18n('locations', 'delete') %>
+        </a>
+    </div>
+</div>    

src/frontend/js/app/nginx/proxy/location.js

@@ -0,0 +1,54 @@
+const locationItemTemplate   = require('./location-item.ejs');
+const Mn                     = require('backbone.marionette');
+const App                    = require('../../main');
+
+const LocationView = Mn.View.extend({
+    template: locationItemTemplate,
+    className: 'location_block',
+
+    ui: {
+        toggle:     'input[type="checkbox"]',
+        config:     '.config',
+        delete:     '.location-delete'
+    },
+
+    events: {
+        'change @ui.toggle': function(el) {
+            if (el.target.checked) {
+                this.ui.config.show();
+            } else {
+                this.ui.config.hide();
+            }
+        },
+
+        'change .model': function (e) {
+            const map = {};
+            map[e.target.name] = e.target.value;
+            this.model.set(map);
+        },
+
+        'click @ui.delete': function () {
+            this.model.destroy();
+        }
+    },
+
+    onRender: function() {
+        $(this.ui.config).hide();
+    },
+
+    templateContext: function() {
+        return {
+            i18n: App.i18n
+        }
+    }
+});
+
+const LocationCollectionView = Mn.CollectionView.extend({
+    className: 'locations_container',
+    childView: LocationView
+});
+
+module.exports = {
+    LocationCollectionView,
+    LocationView
+}

src/frontend/js/app/nginx/redirection/form.ejs

@@ -60,7 +60,7 @@
                                 </select>
                             </div>
                         </div>
-                        <div class="col-sm-12 col-md-12">
+                        <div class="col-sm-6 col-md-6">
                             <div class="form-group">
                                 <label class="custom-switch">
                                     <input type="checkbox" class="custom-switch-input" name="ssl_forced" value="1"<%- ssl_forced ? ' checked' : '' %><%- certificate_id ? '' : ' disabled' %>>
@@ -69,6 +69,33 @@
                                 </label>
                             </div>
                         </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="http2_support" value="1"<%- http2_support ? ' checked' : '' %><%- certificate_id ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'http2-support') %></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="hsts_enabled" value="1"<%- hsts_enabled ? ' checked' : '' %><%- certificate_id && ssl_forced ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'hsts-enabled') %> <a href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security" target="_blank"><i class="fe fe-help-circle"></i></a></span>
+                                </label>
+                            </div>
+                        </div>
+                        <div class="col-sm-6 col-md-6">
+                            <div class="form-group">
+                                <label class="custom-switch">
+                                    <input type="checkbox" class="custom-switch-input" name="hsts_subdomains" value="1"<%- hsts_subdomains ? ' checked' : '' %><%- certificate_id && ssl_forced && hsts_enabled ? '' : ' disabled' %>>
+                                    <span class="custom-switch-indicator"></span>
+                                    <span class="custom-switch-description"><%- i18n('all-hosts', 'hsts-subdomains') %></span>
+                                </label>
+                            </div>
+                        </div>
 
                         <!-- Lets encrypt -->
                         <div class="col-sm-12 col-md-12 letsencrypt">

src/frontend/js/app/nginx/redirection/form.js

@@ -22,6 +22,9 @@ module.exports = Mn.View.extend({
         save:               'button.save',
         certificate_select: 'select[name="certificate_id"]',
         ssl_forced:         'input[name="ssl_forced"]',
+        hsts_enabled:       'input[name="hsts_enabled"]',
+        hsts_subdomains:    'input[name="hsts_subdomains"]',
+        http2_support:      'input[name="http2_support"]',
         letsencrypt:        '.letsencrypt'
     },
 
@@ -35,7 +38,44 @@ module.exports = Mn.View.extend({
             }
 
             let enabled = id === 'new' || parseInt(id, 10) > 0;
-            this.ui.ssl_forced.prop('disabled', !enabled).parents('.form-group').css('opacity', enabled ? 1 : 0.5);
+
+            let inputs = this.ui.ssl_forced.add(this.ui.http2_support);
+            inputs
+                .prop('disabled', !enabled)
+                .parents('.form-group')
+                .css('opacity', enabled ? 1 : 0.5);
+
+            if (!enabled) {
+                inputs.prop('checked', false);
+            }
+
+            inputs.trigger('change');
+        },
+
+        'change @ui.ssl_forced': function () {
+            let checked = this.ui.ssl_forced.prop('checked');
+            this.ui.hsts_enabled
+                .prop('disabled', !checked)
+                .parents('.form-group')
+                .css('opacity', checked ? 1 : 0.5);
+
+            if (!checked) {
+                this.ui.hsts_enabled.prop('checked', false);
+            }
+
+            this.ui.hsts_enabled.trigger('change');
+        },
+
+        'change @ui.hsts_enabled': function () {
+            let checked = this.ui.hsts_enabled.prop('checked');
+            this.ui.hsts_subdomains
+                .prop('disabled', !checked)
+                .parents('.form-group')
+                .css('opacity', checked ? 1 : 0.5);
+
+            if (!checked) {
+                this.ui.hsts_subdomains.prop('checked', false);
+            }
         },
 
         'click @ui.save': function (e) {
@@ -50,12 +90,12 @@ module.exports = Mn.View.extend({
             let data = this.ui.form.serializeJSON();
 
             // Manipulate
-            data.block_exploits = !!data.block_exploits;
-            data.preserve_path  = !!data.preserve_path;
-
-            if (typeof data.ssl_forced !== 'undefined' && data.ssl_forced === '1') {
-                data.ssl_forced = true;
-            }
+            data.block_exploits  = !!data.block_exploits;
+            data.preserve_path   = !!data.preserve_path;
+            data.http2_support   = !!data.http2_support;
+            data.hsts_enabled    = !!data.hsts_enabled;
+            data.hsts_subdomains = !!data.hsts_subdomains;
+            data.ssl_forced      = !!data.ssl_forced;
 
             if (typeof data.domain_names === 'string' && data.domain_names) {
                 data.domain_names = data.domain_names.split(',');
@@ -77,7 +117,7 @@ module.exports = Mn.View.extend({
 
                 data.meta.letsencrypt_agree = data.meta.letsencrypt_agree === '1';
             } else {
-                data.certificate_id = parseInt(data.certificate_id, 0);
+                data.certificate_id = parseInt(data.certificate_id, 10);
             }
 
             let method = App.Api.Nginx.RedirectionHosts.create;

src/frontend/js/app/nginx/redirection/list/item.ejs

@@ -6,9 +6,15 @@
 <td>
     <div>
         <% domain_names.map(function(host) {
-            %>
-            <span class="tag"><%- host %></span>
-            <%
+            if (host.indexOf('*') === -1) {
+                %>
+                <span class="tag host-link hover-yellow" rel="http<%- certificate_id ? 's' : '' %>://<%- host %>"><%- host %></span>
+                <%
+            } else {
+                %>
+                <span class="tag"><%- host %></span>
+                <%
+            }
         });
         %>
     </div>
@@ -25,7 +31,9 @@
 <td>
     <%
     var o = isOnline();
-    if (o === true) { %>
+    if (!enabled) { %>
+        <span class="status-icon bg-warning"></span> <%- i18n('str', 'disabled') %>
+    <% } else if (o === true) { %>
         <span class="status-icon bg-success"></span> <%- i18n('str', 'online') %>
     <% } else if (o === false) { %>
         <span title="<%- getOfflineError() %>"><span class="status-icon bg-danger"></span> <%- i18n('str', 'offline') %></span>
@@ -39,7 +47,7 @@
         <a href="#" data-toggle="dropdown" class="icon"><i class="fe fe-more-vertical"></i></a>
         <div class="dropdown-menu dropdown-menu-right">
             <a href="#" class="edit dropdown-item"><i class="dropdown-icon fe fe-edit"></i> <%- i18n('str', 'edit') %></a>
-            <!--<a href="#" class="logs dropdown-item"><i class="dropdown-icon fe fe-book"></i> <%- i18n('str', 'logs') %></a>-->
+            <a href="#" class="able dropdown-item"><i class="dropdown-icon fe fe-power"></i> <%- i18n('str', enabled ? 'disable' : 'enable') %></a>
             <div class="dropdown-divider"></div>
             <a href="#" class="delete dropdown-item"><i class="dropdown-icon fe fe-trash-2"></i> <%- i18n('str', 'delete') %></a>
         </div>

src/frontend/js/app/nginx/redirection/list/item.js

@@ -9,11 +9,25 @@ module.exports = Mn.View.extend({
     tagName:  'tr',
 
     ui: {
-        edit:   'a.edit',
-        delete: 'a.delete'
+        able:      'a.able',
+        edit:      'a.edit',
+        delete:    'a.delete',
+        host_link: '.host-link'
     },
 
     events: {
+        'click @ui.able': function (e) {
+            e.preventDefault();
+            let id = this.model.get('id');
+            App.Api.Nginx.RedirectionHosts[this.model.get('enabled') ? 'disable' : 'enable'](id)
+                .then(() => {
+                    return App.Api.Nginx.RedirectionHosts.get(id)
+                        .then(row => {
+                            this.model.set(row);
+                        });
+                });
+        },
+
         'click @ui.edit': function (e) {
             e.preventDefault();
             App.Controller.showNginxRedirectionForm(this.model);
@@ -22,6 +36,12 @@ module.exports = Mn.View.extend({
         'click @ui.delete': function (e) {
             e.preventDefault();
             App.Controller.showNginxRedirectionDeleteConfirm(this.model);
+        },
+
+        'click @ui.host_link': function (e) {
+            e.preventDefault();
+            let win = window.open($(e.currentTarget).attr('rel'), '_blank');
+            win.focus();
         }
     },
 

src/frontend/js/app/nginx/stream/list/item.ejs

@@ -27,7 +27,9 @@
 <td>
     <%
     var o = isOnline();
-    if (o === true) { %>
+    if (!enabled) { %>
+        <span class="status-icon bg-warning"></span> <%- i18n('str', 'disabled') %>
+    <% } else if (o === true) { %>
         <span class="status-icon bg-success"></span> <%- i18n('str', 'online') %>
     <% } else if (o === false) { %>
         <span title="<%- getOfflineError() %>"><span class="status-icon bg-danger"></span> <%- i18n('str', 'offline') %></span>
@@ -41,6 +43,7 @@
         <a href="#" data-toggle="dropdown" class="icon"><i class="fe fe-more-vertical"></i></a>
         <div class="dropdown-menu dropdown-menu-right">
             <a href="#" class="edit dropdown-item"><i class="dropdown-icon fe fe-edit"></i> <%- i18n('str', 'edit') %></a>
+            <a href="#" class="able dropdown-item"><i class="dropdown-icon fe fe-power"></i> <%- i18n('str', enabled ? 'disable' : 'enable') %></a>
             <div class="dropdown-divider"></div>
             <a href="#" class="delete dropdown-item"><i class="dropdown-icon fe fe-trash-2"></i> <%- i18n('str', 'delete') %></a>
         </div>

src/frontend/js/app/nginx/stream/list/item.js

@@ -9,11 +9,24 @@ module.exports = Mn.View.extend({
     tagName:  'tr',
 
     ui: {
+        able:   'a.able',
         edit:   'a.edit',
         delete: 'a.delete'
     },
 
     events: {
+        'click @ui.able': function (e) {
+            e.preventDefault();
+            let id = this.model.get('id');
+            App.Api.Nginx.Streams[this.model.get('enabled') ? 'disable' : 'enable'](id)
+                .then(() => {
+                    return App.Api.Nginx.Streams.get(id)
+                        .then(row => {
+                            this.model.set(row);
+                        });
+                });
+        },
+
         'click @ui.edit': function (e) {
             e.preventDefault();
             App.Controller.showNginxStreamForm(this.model);

src/frontend/js/app/router.js

@@ -15,6 +15,7 @@ module.exports = AppRouter.default.extend({
         'nginx/access':       'showNginxAccess',
         'nginx/certificates': 'showNginxCertificates',
         'audit-log':          'showAuditLog',
+        'settings':           'showSettings',
         '*default':           'showDashboard'
     }
 });

src/frontend/js/app/settings/default-site/main.ejs

@@ -0,0 +1,53 @@
+<div class="modal-content">
+    <div class="modal-header">
+        <h5 class="modal-title"><%- i18n('settings', id) %></h5>
+        <button type="button" class="close cancel" aria-label="Close" data-dismiss="modal">&nbsp;</button>
+    </div>
+    <div class="modal-body">
+        <form>
+            <div class="row">
+                <div class="col-sm-12 col-md-12">
+                    <div class="form-group">
+                        <div class="form-label"><%- description %></div>
+                        <div class="custom-controls-stacked">
+                            <label class="custom-control custom-radio">
+                                <input class="custom-control-input" name="value" value="congratulations" type="radio" required <%- value === 'congratulations' ? 'checked' : '' %>>
+                                <div class="custom-control-label"><%- i18n('settings', 'default-site-congratulations') %></div>
+                            </label>
+                            <label class="custom-control custom-radio">
+                                <input class="custom-control-input" name="value" value="404" type="radio" required <%- value === '404' ? 'checked' : '' %>>
+                                <div class="custom-control-label"><%- i18n('settings', 'default-site-404') %></div>
+                            </label>
+                            <label class="custom-control custom-radio">
+                                <input class="custom-control-input" name="value" value="redirect" type="radio" required <%- value === 'redirect' ? 'checked' : '' %>>
+                                <div class="custom-control-label"><%- i18n('settings', 'default-site-redirect') %></div>
+                            </label>
+                            <label class="custom-control custom-radio">
+                                <input class="custom-control-input" name="value" value="html" type="radio" required <%- value === 'html' ? 'checked' : '' %>>
+                                <div class="custom-control-label"><%- i18n('settings', 'default-site-html') %></div>
+                            </label>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="col-sm-12 col-md-12 option-item option-redirect">
+                    <div class="form-group">
+                        <div class="form-label">Redirect to</div>
+                        <input class="form-control redirect-input" name="meta[redirect]" placeholder="https://" type="url" value="<%- meta && typeof meta.redirect !== 'undefined' ? meta.redirect : '' %>">
+                    </div>
+                </div>
+
+                <div class="col-sm-12 col-md-12 option-item option-html">
+                    <div class="form-group">
+                        <div class="form-label">HTML Content</div>
+                        <textarea class="form-control text-monospace html-content" name="meta[html]" rows="6" placeholder="<!-- Enter your HTML here -->"><%- meta && typeof meta.html !== 'undefined' ? meta.html : '' %></textarea>
+                    </div>
+                </div>
+            </div>
+        </form>
+    </div>
+    <div class="modal-footer">
+        <button type="button" class="btn btn-secondary cancel" data-dismiss="modal"><%- i18n('str', 'cancel') %></button>
+        <button type="button" class="btn btn-teal save"><%- i18n('str', 'save') %></button>
+    </div>
+</div>

src/frontend/js/app/settings/default-site/main.js

@@ -0,0 +1,71 @@
+'use strict';
+
+const Mn       = require('backbone.marionette');
+const App      = require('../../main');
+const template = require('./main.ejs');
+
+require('jquery-serializejson');
+require('selectize');
+
+module.exports = Mn.View.extend({
+    template:  template,
+    className: 'modal-dialog',
+
+    ui: {
+        form:     'form',
+        buttons:  '.modal-footer button',
+        cancel:   'button.cancel',
+        save:     'button.save',
+        options:  '.option-item',
+        value:    'input[name="value"]',
+        redirect: '.redirect-input',
+        html:     '.html-content'
+    },
+
+    events: {
+        'change @ui.value': function (e) {
+            let val = this.ui.value.filter(':checked').val();
+            this.ui.options.hide();
+            this.ui.options.filter('.option-' + val).show();
+        },
+
+        'click @ui.save': function (e) {
+            e.preventDefault();
+
+            let val = this.ui.value.filter(':checked').val();
+
+            // Clear redirect field before validation
+            if (val !== 'redirect') {
+                this.ui.redirect.val('').attr('required', false);
+            } else {
+                this.ui.redirect.attr('required', true);
+            }
+
+            this.ui.html.attr('required', val === 'html');
+
+            if (!this.ui.form[0].checkValidity()) {
+                $('<input type="submit">').hide().appendTo(this.ui.form).click().remove();
+                return;
+            }
+
+            let view = this;
+            let data = this.ui.form.serializeJSON();
+            data.id  = this.model.get('id');
+
+            this.ui.buttons.prop('disabled', true).addClass('btn-disabled');
+            App.Api.Settings.update(data)
+                .then(result => {
+                    view.model.set(result);
+                    App.UI.closeModal();
+                })
+                .catch(err => {
+                    alert(err.message);
+                    this.ui.buttons.prop('disabled', false).removeClass('btn-disabled');
+                });
+        }
+    },
+
+    onRender: function () {
+        this.ui.value.trigger('change');
+    }
+});

src/frontend/js/app/settings/list/item.ejs

@@ -0,0 +1,21 @@
+<td>
+    <div><%- name %></div>
+    <div class="small text-muted">
+        <%- description %>
+    </div>
+</td>
+<td>
+    <div>
+        <% if (id === 'default-site') { %>
+            <%- i18n('settings', 'default-site-' + value) %>
+        <% } %>
+    </div>
+</td>
+<td class="text-right">
+    <div class="item-action dropdown">
+        <a href="#" data-toggle="dropdown" class="icon"><i class="fe fe-more-vertical"></i></a>
+        <div class="dropdown-menu dropdown-menu-right">
+            <a href="#" class="edit dropdown-item"><i class="dropdown-icon fe fe-edit"></i> <%- i18n('str', 'edit') %></a>
+        </div>
+    </div>
+</td>

src/frontend/js/app/settings/list/item.js

@@ -0,0 +1,25 @@
+'use strict';
+
+const Mn       = require('backbone.marionette');
+const App      = require('../../main');
+const template = require('./item.ejs');
+
+module.exports = Mn.View.extend({
+    template: template,
+    tagName:  'tr',
+
+    ui: {
+        edit: 'a.edit'
+    },
+
+    events: {
+        'click @ui.edit': function (e) {
+            e.preventDefault();
+            App.Controller.showSettingForm(this.model);
+        }
+    },
+
+    initialize: function () {
+        this.listenTo(this.model, 'change', this.render);
+    }
+});

src/frontend/js/app/settings/list/main.ejs

@@ -0,0 +1,8 @@
+<thead>
+    <th><%- i18n('str', 'name') %></th>
+    <th><%- i18n('str', 'value') %></th>
+    <th>&nbsp;</th>
+</thead>
+<tbody>
+    <!-- items -->
+</tbody>

src/frontend/js/app/settings/list/main.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const Mn       = require('backbone.marionette');
+const ItemView = require('./item');
+const template = require('./main.ejs');
+
+const TableBody = Mn.CollectionView.extend({
+    tagName:   'tbody',
+    childView: ItemView
+});
+
+module.exports = Mn.View.extend({
+    tagName:   'table',
+    className: 'table table-hover table-outline table-vcenter text-nowrap card-table',
+    template:  template,
+
+    regions: {
+        body: {
+            el:             'tbody',
+            replaceElement: true
+        }
+    },
+
+    onRender: function () {
+        this.showChildView('body', new TableBody({
+            collection: this.collection
+        }));
+    }
+});