51 lines
1.5 KiB
Plaintext
51 lines
1.5 KiB
Plaintext
# Local proxy of the contest firewall (separate from the nginx of the image).
|
|
# The firewall redirects every outgoing connection on port 443 to this proxy,
|
|
# which reads the site name sent by the browser (TLS SNI), refuses names that
|
|
# are not in allowed_domains.txt and connects to the allowed sites itself.
|
|
# The proxy resolves the names on its own, so a program that forces the
|
|
# address of an allowed site for another name gets nowhere. Port 80 only
|
|
# answers with a redirect to HTTPS.
|
|
|
|
load_module /usr/lib/nginx/modules/ngx_stream_module.so;
|
|
|
|
user contest-proxy;
|
|
pid /run/contest-proxy.pid;
|
|
worker_processes 2;
|
|
worker_rlimit_nofile 8192;
|
|
error_log stderr warn;
|
|
|
|
events {
|
|
worker_connections 2048;
|
|
}
|
|
|
|
stream {
|
|
# resolver line (the local DNS filter), written by /firewall.sh
|
|
include /run/contest-firewall/proxy_resolver.conf;
|
|
|
|
map $ssl_preread_server_name $upstream {
|
|
hostnames;
|
|
# one "<name> <name>:443;" line per allowed domain, written by /firewall.sh
|
|
include /run/contest-firewall/proxy_names.conf;
|
|
default "";
|
|
}
|
|
|
|
log_format sni '$remote_addr "$ssl_preread_server_name" $status $upstream_addr';
|
|
access_log syslog:server=unix:/dev/log,tag=contest_proxy,nohostname sni;
|
|
|
|
server {
|
|
listen 127.0.0.1:8443;
|
|
ssl_preread on;
|
|
preread_timeout 10s;
|
|
proxy_connect_timeout 10s;
|
|
proxy_pass $upstream;
|
|
}
|
|
}
|
|
|
|
http {
|
|
access_log off;
|
|
server {
|
|
listen 127.0.0.1:8080;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|