nginx: Add reverse http(s) proxy for users

.etckeeper

@@ -1004,6 +1004,7 @@ maybe chmod 0644 'nginx/nginx.conf'
 maybe chmod 0644 'nginx/scgi_params'
 maybe chmod 0755 'nginx/stream.conf.d'
 maybe chmod 0644 'nginx/stream.conf.d/sock-https.conf'
+maybe chmod 0755 'nginx/symlinks.sh'
 maybe chmod 0644 'nginx/uwsgi_params'
 maybe chmod 0644 'nginx/win-utf'
 maybe chmod 0644 'nova-agent.env'

nginx/stream.conf.d/sock-https.conf

@@ -11,6 +11,6 @@ stream{
                 listen 443;
                 listen [::]:443;
 
-                proxy_pass unix:/var/run/nginx/$user_-https.sock;
+                proxy_pass unix:/run/http/$user_-https.sock;
         }
 }

nginx/symlinks.sh

@@ -0,0 +1,11 @@
+#!/bin/sh -e
+USER="${PAM_USER}"
+UID=$(id -u "$USER")
+XDG_RUNTIME_DIR="/run/user/${UID}"
+NGINX_SOCK_DIR="/run/http"
+
+for proto in http https; do
+    SOCKET_LINK="${NGINX_SOCK_DIR}/${USER}-${proto}.sock"
+    [ -L "${SOCKET_LINK}" ] || \
+	ln -s "${XDG_RUNTIME_DIR}/${proto}.sock" "${SOCKET_LINK}"
+done

pam.d/common-session-noninteractive

@@ -14,6 +14,9 @@ session	required	pam_env.so
 session	required	pam_namespace.so  unmnt_remnt
 session	required	pam_limits.so
 
+# Setting up HTTP-related symlinks
+session optional	pam_exec.so	log=/dev/log /etc/nginx/symlinks.sh
+
 # Passwd database handling
 session	sufficient	pam_sss.so
 session	sufficient	pam_unix.so

tmpfiles.d/http-socks

@@ -0,0 +1,2 @@
+#Type Path              Mode UID  GID  Age Argument
+d     /run/http         0755 root root -   -