nginx.conf

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

load_module modules/ngx_http_perl_module.so;
load_module modules/ngx_http_js_module.so;
load_module modules/ngx_http_headers_more_filter_module.so;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    server {
        listen       80;
        server_name  revproxy-service;
        resolver 127.0.0.11;

        listen 443 ssl;

        ssl_certificate /etc/nginx/ssl/nginx.crt;
        ssl_certificate_key /etc/nginx/ssl/nginx.key;

        set $access_token "";
        set $csrf_check "ok-tokenauth";
        if ($cookie_access_token) {
            set $access_token "bearer $cookie_access_token";
            # cookie auth requires csrf check
            set $csrf_check "fail";
        }
        if ($http_authorization) {
            # Authorization header is present - prefer that token over cookie token
            set $access_token "$http_authorization";
        }

        proxy_set_header   Authorization "$access_token";
        # proxy_set_header   X-Forwarded-For "$realip";
        # proxy_set_header   X-UserId "$userid";

        #
        # Accomodate large jwt token headers
        # * http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size
        # * https://ma.ttias.be/nginx-proxy-upstream-sent-big-header-reading-response-header-upstream/
        #
        proxy_buffer_size          16k;
        proxy_buffers              8 16k;
        proxy_busy_buffers_size    32k;
        #
        # also incoming from client:
        # * https://fullvalence.com/2016/07/05/cookie-size-in-nginx/
        # * https://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
        large_client_header_buffers 4 8k;
        client_header_buffer_size 4k;

        #
        # CSRF check
        # This block requires a csrftoken for all POST requests.
        #
        if ($cookie_csrftoken = $http_x_csrf_token) {
          # this will fail further below if cookie_csrftoken is empty
          set $csrf_check "ok-$cookie_csrftoken";
        }
        if ($request_method != "POST") {
          set $csrf_check "ok-$request_method";
        }
        if ($cookie_access_token = "") {
          # do this again here b/c empty cookie_csrftoken == empty http_x_csrf_token - ugh
          set $csrf_check "ok-tokenauth";
        }

        location / {
            proxy_pass http://portal-service/;
        }

        location /user/ {
            proxy_pass http://fence-service/;
        }

        location /api/ {
            proxy_pass http://sheepdog-service/;
        }

        location /mds/ {
            proxy_pass http://metadata-service/;
        }

        location /mds-admin/ {
            rewrite ^/mds-admin/(.*) /$1 break;
            proxy_pass http://metadata-service;
            proxy_redirect http://$host/ https://$host/mds-admin/;
        }

        location /coremetadata/ {
            # redirect to coremetadata landing page if header does not specify otherwise
            if ($http_accept !~ (application/json|x-bibtex|application/vnd\.schemaorg\.ld\+json)) {
              rewrite ^/coremetadata/(.*) /files/$1 redirect;
            }

            rewrite ^/coremetadata/(.*) /$1 break;
            proxy_pass http://pidgin-service;
        }

        location /index/ {
            proxy_pass http://indexd-service/;
        }

        location = /_status {
            default_type application/json;
            return 200 "{ \"message\": \"Feelin good!\" }\n";
        }

        location /peregrine/_status {
            proxy_pass http://peregrine-service/_status;
        }
        location /pidgin/_status {
            proxy_pass http://pidgin-service/_status;
        }

        location /api/v0/submission/getschema {
            proxy_pass http://peregrine-service/v0/submission/getschema;
        }

        location /guppy/ {
            proxy_pass http://guppy-service/;
        }

        location /api/v0/submission/graphql {
            if ($cookie_csrftoken = "") {
                add_header Set-Cookie "csrftoken=$request_id$request_length$request_time$time_iso8601;Path=/";
            }
            proxy_next_upstream off;
            # Forward the host and set Subdir header so api
            # knows the original request path for hmac signing
            proxy_set_header   Host $host;
            proxy_set_header   Subdir /api;
            proxy_set_header   Authorization "$access_token";
            proxy_connect_timeout 300;
            proxy_send_timeout 300;
            proxy_read_timeout 300;
            send_timeout 300;
            proxy_pass http://peregrine-service/v0/submission/graphql;
        }

        location /api/search {
            if ($csrf_check !~ ^ok-\S.+$) {
              return 403 "failed csrf check";
            }

            gzip off;
            proxy_next_upstream off;
            proxy_set_header   Host $host;
            proxy_set_header   Authorization "$access_token";

            proxy_connect_timeout 300;
            proxy_send_timeout 300;
            proxy_read_timeout 300;
            send_timeout 300;

            rewrite ^/api/search/(.*) /$1 break;
            proxy_pass http://peregrine-service;
        }

        location @errorworkspace {
            return 302 https://$host/no-workspace-access;
        }

        #
        # workspace AuthZ-proxy uses arborist to provide authorization to workpace services
        # that don't implement our authn or authz i.e. shiny, jupyter.
        #
        location = /gen3-authz {
            internal;
            error_page 400 =403 @errorworkspace;
            error_page 500 =403 @errorworkspace;

            proxy_pass http://arborist-service/auth/proxy?resource=$authz_resource&method=$authz_method&service=$authz_service;

            proxy_pass_request_body off;
            proxy_set_header Authorization "$access_token";
            proxy_set_header Content-Length "";
            proxy_intercept_errors on;

            # nginx bug that it checks even if request_body off
            client_max_body_size 0;
        }

        #
        # authorization endpoint
        # https://hostname/authz?resource=programs/blah&method=acb&service=xyz
        #
        location ~ /authz/? {
            if ($csrf_check !~ ^ok-\S.+$) {
                return 403 "failed csrf check";
            }
            set $proxy_service  "arborist";

            proxy_pass http://arborist-service/auth/proxy?resource=$arg_resource&method=$arg_method&service=$arg_service;
        }

        location = /authz/resources {
            if ($csrf_check !~ ^ok-\S.+$) {
                return 403 "failed csrf check";
            }

            proxy_pass http://arborist-service/auth/resources;
        }

        location = /authz/mapping {
            if ($csrf_check !~ ^ok-\S.+$) {
                return 403 "failed csrf check";
            }

            # Do not expose POST /auth/mapping
            limit_except GET {
                deny all;
            }

            # Do not pass the username arg here! Otherwise anyone can see anyone's access.
            # Arborist will fall back to parsing the jwt for username.
            proxy_pass http://arborist-service/auth/mapping;
        }

        location = /lw-workspace/status {
            default_type application/json;
            return 200 "{ \"message\": \"Feelin good!\" }\n";
        }


        location /lw-workspace/proxy {
            set $authz_resource "/workspace";
            set $authz_method "access";
            set $authz_service "jupyterhub";
            # be careful - sub-request runs in same context as this request
            auth_request_set $remoteUser $upstream_http_REMOTE_USER;
            auth_request_set $saved_set_cookie $upstream_http_set_cookie;
            auth_request /gen3-authz;

            if ($saved_set_cookie != "") {
                add_header Set-Cookie $saved_set_cookie always;
            }

            proxy_set_header REMOTE_USER $remoteUser;
            error_page 403 = @errorworkspace;

            #
            # jupyter notebooks use websockets
            # See https://aptro.github.io/server/architecture/2016/06/21/Jupyter-Notebook-Nginx-Setup.html
            #
            proxy_pass http://jupyter-service:8888/lw-workspace/proxy;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            #proxy_set_header X-Real-IP $remote_addr;
            #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $http_connection;
            #client_max_body_size 0;
        }

        location /lw-workspace/ {
            return 302 /lw-workspace/proxy;
        }
    }
}