Skip to content

Commit 4b6b276

Browse files
jc21jc21
authored
Merge pull request #1195 from jc21/develop
v2.9.4
2 parents 92eec95 + 0373daa commit 4b6b276

File tree

16 files changed

+159
-90
lines changed

16 files changed

+159
-90
lines changed

‎.version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.9.3
1+
2.9.4

‎README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<p align="center">
22
<img src="https://nginxproxymanager.com/github.png">
33
<br><br>
4-
<img src="https://img.shields.io/badge/version-2.9.3-green.svg?style=for-the-badge">
4+
<img src="https://img.shields.io/badge/version-2.9.4-green.svg?style=for-the-badge">
55
<a href="https://hub.docker.com/repository/docker/jc21/nginx-proxy-manager">
66
<img src="https://img.shields.io/docker/stars/jc21/nginx-proxy-manager.svg?style=for-the-badge">
77
</a>
@@ -14,6 +14,10 @@
1414
<a href="https://gitter.im/nginx-proxy-manager/community">
1515
<img alt="Gitter" src="https://img.shields.io/gitter/room/nginx-proxy-manager/community?style=for-the-badge">
1616
</a>
17+
<a href="https://reddit.com/r/nginxproxymanager">
18+
<img alt="Reddit" src="https://img.shields.io/reddit/subreddit-subscribers/nginxproxymanager?label=Reddit%20Community&style=for-the-badge">
19+
</a>
20+
1721
</p>
1822

1923
This project comes as a pre-built docker image that enables you to easily forward to your websites
@@ -66,6 +70,7 @@ version: '3'
6670
services:
6771
app:
6872
image: 'jc21/nginx-proxy-manager:latest'
73+
restart: unless-stopped
6974
ports:
7075
- '80:80'
7176
- '81:81'
@@ -81,6 +86,7 @@ services:
8186
- ./letsencrypt:/etc/letsencrypt
8287
db:
8388
image: 'jc21/mariadb-aria:latest'
89+
restart: unless-stopped
8490
environment:
8591
MYSQL_ROOT_PASSWORD: 'npm'
8692
MYSQL_DATABASE: 'npm'

‎backend/index.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,8 @@ async function createDbConfigFromEnvironment() {
9595
client: 'sqlite3',
9696
connection: {
9797
filename: envSqliteFile
98-
}
98+
},
99+
useNullAsDefault: true
99100
}
100101
};
101102
if (JSON.stringify(configData.database) === JSON.stringify(newConfig)) {

‎backend/internal/certificate.js‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ const debug_mode = process.env.NODE_ENV !== 'production' || !!process.env.
1111
const le_staging = process.env.NODE_ENV !== 'production';
1212
const internalNginx = require('./nginx');
1313
const internalHost = require('./host');
14-
const certbot_command = '/opt/certbot/bin/certbot';
14+
const certbot_command = 'certbot';
1515
const le_config = '/etc/letsencrypt.ini';
1616
const dns_plugins = require('../global/certbot-dns-plugins');
1717

@@ -808,7 +808,7 @@ const internalCertificate = {
808808
const prepare_cmd = 'pip install ' + dns_plugin.package_name + '==' + dns_plugin.package_version + ' ' + dns_plugin.dependencies;
809809

810810
// Whether the plugin has a --<name>-credentials argument
811-
const has_config_arg = certificate.meta.dns_provider !== 'route53' && certificate.meta.dns_provider !== 'duckdns';
811+
const has_config_arg = certificate.meta.dns_provider !== 'route53';
812812

813813
let main_cmd =
814814
certbot_command + ' certonly --non-interactive ' +
@@ -834,10 +834,6 @@ const internalCertificate = {
834834
main_cmd = 'AWS_CONFIG_FILE=\'' + credentials_loc + '\' ' + main_cmd;
835835
}
836836

837-
if (certificate.meta.dns_provider === 'duckdns') {
838-
main_cmd = main_cmd + ' --' + dns_plugin.full_plugin_name + '-token ' + certificate.meta.dns_provider_credentials;
839-
}
840-
841837
if (debug_mode) {
842838
logger.info('Command:', `${credentials_cmd} && ${prepare_cmd} && ${main_cmd}`);
843839
}

‎backend/internal/nginx.js‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,8 @@ const internalNginx = {
136136
* @returns {Promise}
137137
*/
138138
renderLocations: (host) => {
139+
140+
//logger.info('host = ' + JSON.stringify(host, null, 2));
139141
return new Promise((resolve, reject) => {
140142
let template;
141143

@@ -146,26 +148,36 @@ const internalNginx = {
146148
return;
147149
}
148150

149-
let renderer = new Liquid();
151+
let renderer = new Liquid({
152+
root: __dirname + '/../templates/'
153+
});
150154
let renderedLocations = '';
151155

152156
const locationRendering = async () => {
153157
for (let i = 0; i < host.locations.length; i++) {
154-
let locationCopy = Object.assign({}, host.locations[i]);
155-
158+
let locationCopy = Object.assign({}, {access_list_id: host.access_list_id}, {certificate_id: host.certificate_id},
159+
{ssl_forced: host.ssl_forced}, {caching_enabled: host.caching_enabled}, {block_exploits: host.block_exploits},
160+
{allow_websocket_upgrade: host.allow_websocket_upgrade}, {http2_support: host.http2_support},
161+
{hsts_enabled: host.hsts_enabled}, {hsts_subdomains: host.hsts_subdomains}, {access_list: host.access_list},
162+
{certificate: host.certificate}, host.locations[i]);
163+
156164
if (locationCopy.forward_host.indexOf('/') > -1) {
157165
const splitted = locationCopy.forward_host.split('/');
158166

159167
locationCopy.forward_host = splitted.shift();
160168
locationCopy.forward_path = `/${splitted.join('/')}`;
161169
}
162170

171+
//logger.info('locationCopy = ' + JSON.stringify(locationCopy, null, 2));
172+
163173
// eslint-disable-next-line
164174
renderedLocations += await renderer.parseAndRender(template, locationCopy);
165175
}
176+
166177
};
167178

168179
locationRendering().then(() => resolve(renderedLocations));
180+
169181
});
170182
},
171183

@@ -181,6 +193,8 @@ const internalNginx = {
181193
logger.info('Generating ' + host_type + ' Config:', host);
182194
}
183195

196+
// logger.info('host = ' + JSON.stringify(host, null, 2));
197+
184198
let renderEngine = new Liquid({
185199
root: __dirname + '/../templates/'
186200
});
@@ -208,6 +222,7 @@ const internalNginx = {
208222
}
209223

210224
if (host.locations) {
225+
//logger.info ('host.locations = ' + JSON.stringify(host.locations, null, 2));
211226
origLocations = [].concat(host.locations);
212227
locationsPromise = internalNginx.renderLocations(host).then((renderedLocations) => {
213228
host.locations = renderedLocations;

‎backend/templates/_location.conf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,43 @@
33
proxy_set_header X-Forwarded-Scheme $scheme;
44
proxy_set_header X-Forwarded-Proto $scheme;
55
proxy_set_header X-Forwarded-For $remote_addr;
6+
proxy_set_header X-Real-IP $remote_addr;
67
proxy_pass {{ forward_scheme }}://{{ forward_host }}:{{ forward_port }}{{ forward_path }};
8+
9+
{% if access_list_id > 0 %}
10+
{% if access_list.items.length > 0 %}
11+
# Authorization
12+
auth_basic "Authorization required";
13+
auth_basic_user_file /data/access/{{ access_list_id }};
14+
15+
{{ access_list.passauth }}
16+
{% endif %}
17+
18+
# Access Rules
19+
{% for client in access_list.clients %}
20+
{{- client.rule -}};
21+
{% endfor %}deny all;
22+
23+
# Access checks must...
24+
{% if access_list.satisfy %}
25+
{{ access_list.satisfy }};
26+
{% endif %}
27+
28+
{% endif %}
29+
30+
{% include "_assets.conf" %}
31+
{% include "_exploits.conf" %}
32+
33+
{% include "_forced_ssl.conf" %}
34+
{% include "_hsts.conf" %}
35+
36+
{% if allow_websocket_upgrade == 1 or allow_websocket_upgrade == true %}
37+
proxy_set_header Upgrade $http_upgrade;
38+
proxy_set_header Connection $http_connection;
39+
proxy_http_version 1.1;
40+
{% endif %}
41+
42+
743
{{ advanced_config }}
844
}
945

‎docker/rootfs/etc/nginx/conf.d/include/ssl-ciphers.conf‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,5 @@ ssl_session_cache shared:SSL:50m;
33

44
# intermediate configuration. tweak to your needs.
55
ssl_protocols TLSv1.2 TLSv1.3;
6-
ssl_ciphers 'EECDH+AESGCM:AES256+EECDH:AES256+EDH:EDH+AESGCM:ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-
7-
ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AE
8-
S128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES';
9-
ssl_prefer_server_ciphers on;
6+
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
7+
ssl_prefer_server_ciphers off;

‎docker/rootfs/etc/nginx/nginx.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,11 @@ http {
5858
}
5959

6060
# Real IP Determination
61-
# Docker subnet:
62-
set_real_ip_from 172.0.0.0/8;
61+
6362
# Local subnets:
6463
set_real_ip_from 10.0.0.0/8;
65-
set_real_ip_from 192.0.0.0/8;
64+
set_real_ip_from 172.16.0.0/12; # Includes Docker subnet
65+
set_real_ip_from 192.168.0.0/16;
6666
# NPM generated CDN ip ranges:
6767
include conf.d/include/ip_ranges.conf;
6868
# always put the following 2 lines after ip subnets:

‎docs/advanced-config/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ services:
3434
volumes:
3535
- './data:/data'
3636
- '/var/run/docker.sock:/var/run/docker.sock'
37-
restart: always
37+
restart: unless-stopped
3838

3939
networks:
4040
default:
@@ -68,7 +68,7 @@ secrets:
6868
services:
6969
app:
7070
image: 'jc21/nginx-proxy-manager:latest'
71-
restart: always
71+
restart: unless-stopped
7272
ports:
7373
# Public HTTP Port:
7474
- '80:80'
@@ -98,7 +98,7 @@ services:
9898
- db
9999
db:
100100
image: jc21/mariadb-aria
101-
restart: always
101+
restart: unless-stopped
102102
environment:
103103
# MYSQL_ROOT_PASSWORD: "npm" # use secret instead
104104
MYSQL_ROOT_PASSWORD__FILE: /run/secrets/DB_ROOT_PWD

‎docs/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@
143143
"css-select-base-adapter": "^0.1.1",
144144
"css-tree": "^1.0.0-alpha.39",
145145
"css-unit-converter": "^1.1.2",
146-
"css-what": "^3.3.0",
146+
"css-what": "^5.0.1",
147147
"cssesc": "^3.0.0",
148148
"cssnano": "^4.1.10",
149149
"cssnano-preset-default": "^4.0.7",

0 commit comments

Comments
 (0)