First version

files/contest-proxy.conf

@@ -0,0 +1,50 @@
+# Local proxy of the contest firewall (separate from the nginx of the image).
+# The firewall redirects every outgoing connection on port 443 to this proxy,
+# which reads the site name sent by the browser (TLS SNI), refuses names that
+# are not in allowed_domains.txt and connects to the allowed sites itself.
+# The proxy resolves the names on its own, so a program that forces the
+# address of an allowed site for another name gets nowhere. Port 80 only
+# answers with a redirect to HTTPS.
+
+load_module /usr/lib/nginx/modules/ngx_stream_module.so;
+
+user contest-proxy;
+pid /run/contest-proxy.pid;
+worker_processes 2;
+worker_rlimit_nofile 8192;
+error_log stderr warn;
+
+events {
+    worker_connections 2048;
+}
+
+stream {
+    # resolver line (the local DNS filter), written by /firewall.sh
+    include /run/contest-firewall/proxy_resolver.conf;
+
+    map $ssl_preread_server_name $upstream {
+        hostnames;
+        # one "<name> <name>:443;" line per allowed domain, written by /firewall.sh
+        include /run/contest-firewall/proxy_names.conf;
+        default "";
+    }
+
+    log_format sni '$remote_addr "$ssl_preread_server_name" $status $upstream_addr';
+    access_log syslog:server=unix:/dev/log,tag=contest_proxy,nohostname sni;
+
+    server {
+        listen 127.0.0.1:8443;
+        ssl_preread on;
+        preread_timeout 10s;
+        proxy_connect_timeout 10s;
+        proxy_pass $upstream;
+    }
+}
+
+http {
+    access_log off;
+    server {
+        listen 127.0.0.1:8080;
+        return 301 https://$host$request_uri;
+    }
+}