From 2e08f91f6255c751b842eac92a7f72c70b6df80e Mon Sep 17 00:00:00 2001
From: Manuel Gutierrez <manuel.gutierrez@wazuh.com>
Date: Wed, 5 Feb 2020 18:02:25 +0100
Subject: [PATCH] Replace nginx rebuild with nginx_conf

---
 nginx/Dockerfile                            | 18 -----
 nginx/config/entrypoint.sh                  | 78 ---------------------
 nginx_conf/kibana-web.conf                  | 20 ++++++
 nginx_conf/kibana.htpasswd                  |  1 +
 nginx_conf/ssl/README.md                    | 23 ++++++
 nginx_conf/ssl/generate-self-signed-cert.sh |  9 +++
 6 files changed, 53 insertions(+), 96 deletions(-)
 delete mode 100644 nginx/Dockerfile
 delete mode 100644 nginx/config/entrypoint.sh
 create mode 100644 nginx_conf/kibana-web.conf
 create mode 100644 nginx_conf/kibana.htpasswd
 create mode 100644 nginx_conf/ssl/README.md
 create mode 100644 nginx_conf/ssl/generate-self-signed-cert.sh

diff --git a/nginx/Dockerfile b/nginx/Dockerfile
deleted file mode 100644
index b1f0e986..00000000
--- a/nginx/Dockerfile
+++ /dev/null
@@ -1,18 +0,0 @@
-# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-FROM nginx:latest
-
-ENV DEBIAN_FRONTEND noninteractive
-
-RUN apt-get update && apt-get install -y openssl apache2-utils && \
-    apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-COPY config/entrypoint.sh /entrypoint.sh
-
-RUN chmod 755 /entrypoint.sh
-
-VOLUME ["/etc/nginx/conf.d"]
-
-ENV NGINX_NAME="foo" \
-    NGINX_PWD="bar"
-
-ENTRYPOINT [ "/entrypoint.sh" ]
diff --git a/nginx/config/entrypoint.sh b/nginx/config/entrypoint.sh
deleted file mode 100644
index b7c23c64..00000000
--- a/nginx/config/entrypoint.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/bin/bash
-# Wazuh Docker Copyright (C) 2019 Wazuh Inc. (License GPLv2)
-
-set -e
-
-# Generating certificates.
-if [ ! -d /etc/nginx/conf.d/ssl ]; then
-  echo "Generating SSL certificates"
-  mkdir -p /etc/nginx/conf.d/ssl/certs /etc/nginx/conf.d/ssl/private
-  openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/conf.d/ssl/private/kibana-access.key -out /etc/nginx/conf.d/ssl/certs/kibana-access.pem >/dev/null
-else
-  echo "SSL certificates already present"
-fi
-
-# Setting users credentials.
-# In order to set NGINX_CREDENTIALS, before "docker-compose up -d" run (a or b):
-#
-# a) export NGINX_CREDENTIALS="user1:pass1;user2:pass2;" or
-#    export NGINX_CREDENTIALS="user1:pass1;user2:pass2"
-#
-# b) Set NGINX_CREDENTIALS in docker-compose.yml:
-#    NGINX_CREDENTIALS=user1:pass1;user2:pass2; or
-#    NGINX_CREDENTIALS=user1:pass1;user2:pass2
-#
-if [ ! -f /etc/nginx/conf.d/kibana.htpasswd ]; then
-  echo "Setting users credentials"
-  if [ ! -z "$NGINX_CREDENTIALS" ]; then
-    IFS=';' read -r -a users <<< "$NGINX_CREDENTIALS"
-    for index in "${!users[@]}"
-    do
-      IFS=':' read -r -a credentials <<< "${users[index]}"
-      if [ $index -eq 0 ]; then
-        htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd ${credentials[0]} ${credentials[1]} >/dev/null
-      else
-        htpasswd -b /etc/nginx/conf.d/kibana.htpasswd  ${credentials[0]} ${credentials[1]} >/dev/null
-      fi
-    done
-  else
-    # NGINX_PWD and NGINX_NAME are declared in nginx/Dockerfile 
-    htpasswd -b -c /etc/nginx/conf.d/kibana.htpasswd $NGINX_NAME $NGINX_PWD >/dev/null
-  fi
-else
-  echo "Kibana credentials already configured"
-fi
-
-if [ "x${NGINX_PORT}" = "x" ]; then
-  NGINX_PORT=443
-fi
-
-if [ "x${KIBANA_HOST}" = "x" ]; then
-  KIBANA_HOST="kibana:5601"
-fi
-
-echo "Configuring NGINX"
-cat > /etc/nginx/conf.d/default.conf <<EOF
-server {
-    listen 80;
-    listen [::]:80;
-    return 301 https://\$host:${NGINX_PORT}\$request_uri;
-}
-
-server {
-    listen ${NGINX_PORT} default_server ssl http2;
-    listen [::]:${NGINX_PORT} ssl http2;
-    ssl_certificate /etc/nginx/conf.d/ssl/certs/kibana-access.pem;
-    ssl_certificate_key /etc/nginx/conf.d/ssl/private/kibana-access.key;
-    location / {
-        auth_basic "Restricted";
-        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
-        proxy_pass http://${KIBANA_HOST}/;
-        proxy_buffer_size          128k;
-        proxy_buffers              4 256k;
-        proxy_busy_buffers_size    256k;
-    }
-}
-EOF
-
-exec nginx -g 'daemon off;'
diff --git a/nginx_conf/kibana-web.conf b/nginx_conf/kibana-web.conf
new file mode 100644
index 00000000..be3fa5b0
--- /dev/null
+++ b/nginx_conf/kibana-web.conf
@@ -0,0 +1,20 @@
+server {
+    listen 80;
+    listen [::]:80;
+    return 301 https://$host:443$request_uri;
+}
+
+server {
+    listen 443 default_server ssl http2;
+    listen [::]:443 ssl http2;
+    ssl_certificate /etc/nginx/conf.d/ssl/kibana-access.pem;
+    ssl_certificate_key /etc/nginx/conf.d/ssl/kibana-access.key;
+    location / {
+        auth_basic "Restricted Access";
+        auth_basic_user_file /etc/nginx/conf.d/kibana.htpasswd;
+        proxy_pass http://kibana:5601/;
+#        proxy_buffer_size          128k;
+#        proxy_buffers              4 256k;
+#        proxy_busy_buffers_size    256k;
+    }
+} 
diff --git a/nginx_conf/kibana.htpasswd b/nginx_conf/kibana.htpasswd
new file mode 100644
index 00000000..5008c153
--- /dev/null
+++ b/nginx_conf/kibana.htpasswd
@@ -0,0 +1 @@
+foo:$apr1$WwUDPA87$v9Bj8DS5KF9u1wBTtHH.A/
diff --git a/nginx_conf/ssl/README.md b/nginx_conf/ssl/README.md
new file mode 100644
index 00000000..9c44ff23
--- /dev/null
+++ b/nginx_conf/ssl/README.md
@@ -0,0 +1,23 @@
+
+### Enable SSL Traffic
+
+Our Nginx config has SSL enabled by default, but it does require you to provide your certificate first, copy here your certificate files as `kibana-access.pem` and `kibana-access.key`.
+
+The final tree should be like this:
+
+```
+nginx_conf/
+├── kibana.htpasswd
+├── kibana-web.conf
+└── ssl
+    ├── kibana-access.key
+    └── kibana-access.pem
+```
+
+
+
+#### Using a Self Signed Certificate
+
+In case you want to use a self-signed certificate we provided a script to generate one. You may create your own with more relevant information.
+
+Execute `bash generate-self-signed-cert.sh` on this same directory and the right files will be generated. You must have installed `openssl` locally.
diff --git a/nginx_conf/ssl/generate-self-signed-cert.sh b/nginx_conf/ssl/generate-self-signed-cert.sh
new file mode 100644
index 00000000..cf0a56f0
--- /dev/null
+++ b/nginx_conf/ssl/generate-self-signed-cert.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+if [ -s kibana-access.key ]
+then
+    echo "Aborting. Certificate already exists"
+    exit
+else
+    openssl req -x509 -batch -nodes -days 365 -newkey rsa:2048 -keyout kibana-access.key -out kibana-access.pem
+fi