diff --git a/Dockerfile b/Dockerfile index fb0feaa..1ba7f70 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,7 +6,9 @@ ADD nginx.conf /etc/nginx/nginx.conf ADD nginx-redirects.conf /etc/nginx/redirects.conf ADD nginx-proxy.conf /etc/nginx/proxy.conf ADD nginx-proxy-security-headers.conf /etc/nginx/proxy-security-headers.conf -ADD nginx-fem-redirects.conf /etc/nginx/fem-redirects.conf +ADD nginx-fem-project-redirects.conf /etc/nginx/fem-project-redirects.conf +ADD nginx-pfe-redirects.conf /etc/nginx/pfe-redirects.conf +ADD nginx-pfe-staging-redirects.conf /etc/nginx/pfe-staging-redirects.conf ADD nginx-fem-staging-redirects.conf /etc/nginx/fem-staging-redirects.conf ADD nginx-s3-proxy-headers.conf /etc/nginx/s3-proxy-headers.conf ADD nginx-az-proxy-headers.conf /etc/nginx/az-proxy-headers.conf diff --git a/nginx-fem-redirects.conf b/nginx-fem-project-redirects.conf similarity index 92% rename from nginx-fem-redirects.conf rename to nginx-fem-project-redirects.conf index ca4807e..4af3888 100644 --- a/nginx-fem-redirects.conf +++ b/nginx-fem-project-redirects.conf @@ -1,47 +1,6 @@ set $fe_project_uri "https://fe-project.zooniverse.org"; -set $fe_content_pages_uri "https://fe-content-pages.zooniverse.org"; -set $fe_root_uri "https://fe-root.zooniverse.org"; set $fe_project_host "fe-project.zooniverse.org"; -set $fe_content_pages_host "fe-content-pages.zooniverse.org"; -set $fe_root_host "fe-root.zooniverse.org"; -# Project app data and static files -location ~* ^/projects/(?:_next|assets)/.+?$ { - resolver 1.1.1.1; - proxy_pass $fe_project_uri; - proxy_set_header Host $fe_project_host; - - include /etc/nginx/proxy-security-headers.conf; -} - -# Root app data and static files -location ~* ^/(?:_next|assets)/.+?$ { - resolver 1.1.1.1; - proxy_pass $fe_root_uri; - proxy_set_header Host $fe_root_host; - - include /etc/nginx/proxy-security-headers.conf; -} - -# Zooniverse About pages, prefix match -location /about { - resolver 1.1.1.1; - proxy_pass $fe_root_uri; - proxy_set_header Host $fe_root_host; - - include /etc/nginx/proxy-security-headers.conf; -} - -# Zooniverse Get Involved pages, prefix match -location /get-involved { - resolver 1.1.1.1; - proxy_pass $fe_root_uri; - proxy_set_header Host $fe_root_host; - - include /etc/nginx/proxy-security-headers.conf; -} - -# FEM projects location ~* ^/projects/(?:[\w-]*?/)?zookeeper/galaxy-zoo-weird-and-wonderful/?(?:(classify|about)(?:/.+?)?)?/?$ { resolver 1.1.1.1; proxy_pass $fe_project_uri; diff --git a/nginx-pfe-redirects.conf b/nginx-pfe-redirects.conf new file mode 100644 index 0000000..3e5eadf --- /dev/null +++ b/nginx-pfe-redirects.conf @@ -0,0 +1,75 @@ +set $proxy_path "www.zooniverse.org"; + +# FEM project assets +location ~* ^/projects/(?:_next|assets)/.+?$ { + resolver 1.1.1.1; + proxy_pass "https://fe-project.zooniverse.org"; + proxy_set_header Host fe-project.zooniverse.org; + + include /etc/nginx/proxy-security-headers.conf; +} + +# PFE assets +location ~ ^/[\w-]+\.(js|css)$ { + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path$request_uri; + include /etc/nginx/az-proxy-headers.conf; +} + +# User profile page +location ~* ^/users/[\w-]+/?$ { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# User specific pages +location ~* ^/users/[\w-]+/((collections|favorites|message)?)/?$ { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# Default: /project/* to PFE +# Can be overridden by directives in nginx-project-redirects.conf +location ~* ^/projects { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# Most of the main PFE redirects +location ~* ^/(organizations|collections|favorites|talk|notifications|inbox|lab|admin|accounts|reset-password|settings|privacy|security|youth_privacy) { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# unsubscribe route uses redirects between panoptes and the UI code +# so needs it's own location block to handle the form submission POST +# and the GET page loading (PFE routing handles the path) +location /unsubscribe { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + if ($request_method ~ ^(GET|HEAD)$) { + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + set $proxy_host_header "zooniversestatic.z13.web.core.windows.net"; + } + if ($request_method = POST) { + proxy_pass https://panoptes.zooniverse.org$request_uri; + set $proxy_host_header "panoptes.zooniverse.org"; + } + proxy_set_header Host $proxy_host_header; + proxy_redirect /$host/ /; + + include /etc/nginx/az-proxy-headers.conf; +} diff --git a/nginx-pfe-staging-redirects.conf b/nginx-pfe-staging-redirects.conf new file mode 100644 index 0000000..188df5e --- /dev/null +++ b/nginx-pfe-staging-redirects.conf @@ -0,0 +1,84 @@ +set $proxy_path "www.zooniverse.org"; + +# FEM project assets +location ~* ^/projects/(?:_next|assets)/.+?$ { + resolver 1.1.1.1; + proxy_pass "https://fe-project.preview.zooniverse.org"; + proxy_set_header Host fe-project.preview.zooniverse.org; + + include /etc/nginx/proxy-security-headers.conf; +} + +# PFE assets +location ~ \.(js|css)$ { + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path$request_uri; + include /etc/nginx/az-proxy-headers.conf; +} + +# User profile page +location ~* ^/users/[\w-]+/?$ { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# User specific pages +location ~* ^/users/[\w-]+/((collections|favorites|message)?)/?$ { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# Default: /project/* to PFE +# Can be overridden by directives in nginx-project-redirects.conf +location ~* ^/projects { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# Most of the main PFE redirects +location ~* ^/(organizations|collections|favorites|talk|notifications|inbox|lab|admin|accounts|reset-password|settings|privacy|security|youth_privacy) { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + include /etc/nginx/az-proxy-headers.conf; +} + +# unsubscribe route uses redirects between panoptes and the UI code +# so needs it's own location block to handle the form submission POST +# and the GET page loading (PFE routing handles the path) +location /unsubscribe { + rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; + + resolver 1.1.1.1; + if ($request_method ~ ^(GET|HEAD)$) { + proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + set $proxy_host_header "zooniversestatic.z13.web.core.windows.net"; + } + if ($request_method = POST) { + proxy_pass https://panoptes.zooniverse.org$request_uri; + set $proxy_host_header "panoptes.zooniverse.org"; + } + proxy_set_header Host $proxy_host_header; + proxy_redirect /$host/ /; + + include /etc/nginx/az-proxy-headers.conf; +} + +# Example FEM project redirect +location ~* ^/projects/(?:[\w-]*?/)?brooke/i-fancy-cats/?(?:(classify|about)(?:/.+?)?)?/?$ { + resolver 1.1.1.1; + proxy_pass "https://fe-project.preview.zooniverse.org"; + proxy_set_header Host fe-project.preview.zooniverse.org; + + include /etc/nginx/proxy-security-headers.conf; +} diff --git a/sites/frontend.preview.zooniverse.org.conf b/sites/frontend.preview.zooniverse.org.conf index 97c8d44..1e49b85 100644 --- a/sites/frontend.preview.zooniverse.org.conf +++ b/sites/frontend.preview.zooniverse.org.conf @@ -1,7 +1,6 @@ server { - set $proxy_path "www.zooniverse.org"; include /etc/nginx/ssl.default.conf; - include /etc/nginx/fem-staging-redirects.conf; + include /etc/nginx/pfe-staging-redirects.conf; server_name frontend.preview.zooniverse.org; rewrite ^/lab-policies$ https://help.zooniverse.org/getting-started/lab-policies permanent; @@ -92,40 +91,12 @@ server { return 301 /projects/laac-lscp/maturity-of-baby-sounds$1$2$is_args$query_string; } - # ensure the js and CSS assets are served on the same or subdomain - location ~ \.(js|css)$ { - resolver 1.1.1.1; - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path$request_uri; - include /etc/nginx/az-proxy-headers.conf; - } - - # unsubscribe route uses redirects between panoptes and the UI code - # so needs it's own location block to handle the form submission POST - # and the GET page loading (PFE routing handles the path) - location /unsubscribe { - rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; - - resolver 1.1.1.1; - if ($request_method ~ ^(GET|HEAD)$) { - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; - set $proxy_host_header "zooniversestatic.z13.web.core.windows.net"; - } - if ($request_method = POST) { - proxy_pass https://panoptes.zooniverse.org$request_uri; - set $proxy_host_header "panoptes.zooniverse.org"; - } - proxy_set_header Host $proxy_host_header; - proxy_redirect /$host/ /; - - include /etc/nginx/az-proxy-headers.conf; - } - + # fe-root staging app location / { - rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; - resolver 1.1.1.1; - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + proxy_pass "https://fe-root.preview.zooniverse.org"; + proxy_set_header Host fe-root.preview.zooniverse.org; - include /etc/nginx/az-proxy-headers.conf; + include /etc/nginx/proxy-security-headers.conf; } } diff --git a/sites/static-staging.zooniverse.org.conf b/sites/static-staging.zooniverse.org.conf index c2aa621..57f572a 100644 --- a/sites/static-staging.zooniverse.org.conf +++ b/sites/static-staging.zooniverse.org.conf @@ -1,7 +1,6 @@ server { - set $proxy_path "www.zooniverse.org"; include /etc/nginx/ssl.default.conf; - include /etc/nginx/fem-staging-redirects.conf; + include /etc/nginx/pfe-staging-redirects.conf; server_name static-staging.zooniverse.org; rewrite ^/lab-policies$ https://help.zooniverse.org/getting-started/lab-policies permanent; @@ -72,60 +71,12 @@ server { return 301 /about/contact; } - location ~* ^/projects/meredithspalmer/(cedar-creek-eyes-on-the-wild/?)(.*?)\/?$ { - return 301 /projects/forestis/$1$2$is_args$query_string; - } - - location ~* ^/projects/karilint/the-cradle-of-mankind(/?)(.*?)\/?$ { - return 301 /projects/karilint/cradle-of-humanity$1$2$is_args$query_string; - } - - location ~* ^/projects/cseidenstuecker/every-name-counts(/?)(.*?)\/?$ { - return 301 /projects/arolsen-archives/every-name-counts$1$2$is_args$query_string; - } - - location ~* ^/projects/kevinesolberg/mapping-prejudice(/?)(.*?)\/?$ { - return 301 /projects/mappingprejudice/mapping-prejudice$1$2$is_args$query_string; - } - - location ~* ^/projects/chiarasemenzin/maturity-of-baby-sounds(/?)(.*?)\/?$ { - return 301 /projects/laac-lscp/maturity-of-baby-sounds$1$2$is_args$query_string; - } - - # ensure the js and CSS assets are served on the same or subdomain - location ~ \.(js|css)$ { - resolver 1.1.1.1; - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path$request_uri; - include /etc/nginx/az-proxy-headers.conf; - } - - # unsubscribe route uses redirects between panoptes and the UI code - # so needs it's own location block to handle the form submission POST - # and the GET page loading (PFE routing handles the path) - location /unsubscribe { - rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; - - resolver 1.1.1.1; - if ($request_method ~ ^(GET|HEAD)$) { - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; - set $proxy_host_header "zooniversestatic.z13.web.core.windows.net"; - } - if ($request_method = POST) { - proxy_pass https://panoptes.zooniverse.org$request_uri; - set $proxy_host_header "panoptes.zooniverse.org"; - } - proxy_set_header Host $proxy_host_header; - proxy_redirect /$host/ /; - - include /etc/nginx/az-proxy-headers.conf; - } - + # fe-root staging app location / { - rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$proxy_path$request_uri; - resolver 1.1.1.1; - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$proxy_path/; + proxy_pass "https://fe-root.preview.zooniverse.org"; + proxy_set_header Host fe-root.preview.zooniverse.org; - include /etc/nginx/az-proxy-headers.conf; + include /etc/nginx/proxy-security-headers.conf; } } diff --git a/sites/www.zooniverse.org.conf b/sites/www.zooniverse.org.conf index 4f9f5bc..d5ec356 100644 --- a/sites/www.zooniverse.org.conf +++ b/sites/www.zooniverse.org.conf @@ -1,6 +1,8 @@ server { include /etc/nginx/ssl.default.conf; - include /etc/nginx/fem-redirects.conf; + include /etc/nginx/fem-project-redirects.conf; + include /etc/nginx/pfe-redirects.conf; + server_name www.zooniverse.org; rewrite ^/lab-policies$ https://help.zooniverse.org/getting-started/lab-policies permanent; @@ -103,40 +105,12 @@ server { return 301 /projects/cobalt-lensing/black-hole-hunters$1$2$is_args$query_string; } - # ensure the js and CSS assets are served on the same or subdomain - location ~ \.(js|css)$ { - resolver 8.8.8.8; - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$host$request_uri; - include /etc/nginx/az-proxy-headers.conf; - } - - # unsubscribe route uses redirects between panoptes and the UI code - # so needs it's own location block to handle the form submission POST - # and the GET page loading (PFE routing handles the path) - location /unsubscribe { - rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$host$request_uri; - - resolver 8.8.8.8; - if ($request_method ~ ^(GET|HEAD)$) { - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$host/; - set $proxy_host_header "zooniversestatic.z13.web.core.windows.net"; - } - if ($request_method = POST) { - proxy_pass https://panoptes.zooniverse.org$request_uri; - set $proxy_host_header "panoptes.zooniverse.org"; - } - proxy_set_header Host $proxy_host_header; - proxy_redirect /$host/ /; - - include /etc/nginx/az-proxy-headers.conf; - } - + # Default to fe-root app location / { - rewrite (?i)\.(jp(e)?g|gif|png|ico|txt|mp(3|4)|webm|og(a|g|m|v|x)|spx|opus|pdf|ttf|tar|gz|tgz|bz2|tbz2|zip)$ https://static.zooniverse.org/$host$request_uri; - - resolver 8.8.8.8; - proxy_pass https://zooniversestatic.z13.web.core.windows.net/$host/; + resolver 1.1.1.1; + proxy_pass "https://fe-root.zooniverse.org"; + proxy_set_header Host fe-root.zooniverse.org; - include /etc/nginx/az-proxy-headers.conf; + include /etc/nginx/proxy-security-headers.conf; } }