Open Build Service

rubygem-nginx-controller.changes Changed

@@ -1,4 +1,19 @@
 -------------------------------------------------------------------
+Fri Oct 31 07:53:29 UTC 2025 - Angelo Grossini <angelo@intercom.it>
+
+- feat(service): Enhance Nginx configuration with access control and logging
+    - Add support for writing and deleting password files for access rules
+    - Create necessary directories in Dockerfile for SSL and logging
+    - Update Nginx configuration template to handle access rules dynamically
+    - Implement integration tests for service configuration generation and validation
+
+- feat(service): Implement access rules parsing and location sorting
+    - Add access_rules method to decode and parse Base64 encoded access rules
+    - Normalize location paths by ensuring leading and trailing slashes are handled
+    - Introduce locations method to generate a sorted list of unique locations
+    - Remove unused auth_basic method code for clarity
+
+-------------------------------------------------------------------
 Tue Sep  5 15:58:46 UTC 2023 - Angelo Grossini <rottame@intercom.it>
 
 - remove tasks filter, prevent reload of all services

rubygem-nginx-controller.spec Changed

nginx-controller-2.0.4.gem/checksums.yaml.gz -> nginx-controller-2.1.0.gem/checksums.yaml.gz Changed

nginx-controller-2.0.4.gem/data/lib/nginx_controller/docker/service.rb -> nginx-controller-2.1.0.gem/data/lib/nginx_controller/docker/service.rb Changed

@@ -5,6 +5,7 @@
 require 'date'
 require 'fileutils'
 require 'openssl'
+require 'base64'
 require 'active_support/all'
 require 'nginx_controller/base_service'
 require 'nginx_controller/self_signed_cert'
@@ -107,6 +108,7 @@
 
       def configure!
         create_directories
+        write_passwd!
         super
         if rotate_logs?
           config = render_logrotate
@@ -115,6 +117,7 @@
       end
 
       def deconfigure!
+        delete_passwd!
         super
         if File.exists?(logrotate_config_filename)
           FileUtils.rm_f(logrotate_config_filename)
@@ -197,28 +200,55 @@
         labels'vhosts-ng/service/access-log' || (raise StandardError.new("#{self.name}: access log not defined"))
       end
 
-      def auth_basic
-        @auth_basic ||= begin
-          count = 1
-          auths = labels.select{|l| l =~ /vhosts-ng\/auth\/basic/}.map { | k, v |
-            loc = k.gsub(/vhosts-ng\/auth\/basic/, '')
-            secret, realm = v.split(',', 2)
-            secret = File::expand_path(secret, '/') # sanitize....
-            secret = File.join(NginxController.htpasswd_path, service_name, secret)
-            unless File.exists?(secret)
-              # generate a dummy htpasswd with a random username/password
-              secret = File.join(NginxController.htpasswd_path, "dummy", service_name, "htpasswd.#{count}")
-              FileUtils.mkdir_p(File.dirname(secret))
-              File.open(secret, 'wb+') do | f |
-                f.write "%s:%s" % 
-                  SecureRandom.alphanumeric(8),
-                  SecureRandom.alphanumeric(16).crypt("$5$#{SecureRandom.alphanumeric(8)}$"),
-                
+      def access_rules
+        @access_rules ||= begin
+          pairs = labels.select { |k, _| k =~ /\Avhosts-ng\/http\/access-rules/ }.map { |_, v|
+            begin
+              raw = Base64.strict_decode64(v)
+              data = JSON.parse(raw, symbolize_names: true)
+              loc = data:location.to_s.strip
+
+              # normalize leading and trailing slashes
+              unless loc.blank?
+                loc = "/#{loc}" unless loc.start_with?('/')
+                loc = loc.chomp('/') if loc.length > 1 && loc.end_with?('/')
               end
+
+              next if loc.blank?
+              next unless data:allow || data:deny || data:auth
+
+              rule = {
+                location: loc,
+                allow: data:allow ? Array(data:allow) : nil,
+                deny: !data:allow && data:deny ? Array(data:deny) : nil,
+                auth: data:auth ? Array(data:auth) : nil,
+              }
+              loc, rule
+            rescue
+              nil
+            end
+          }.compact
+          Hashpairs
+        end
+      end
+
+      def locations
+        @locations = if access_rules.any?
+          locs = '/' + access_rules.keys
+          locs = locs.uniq
+          without_root = locs.reject { |p| p == '/' }
+          sorted = without_root.sort do |a, b|
+            a_segments = a.split('/').reject(&:blank?).length
+            b_segments = b.split('/').reject(&:blank?).length
+            if a_segments != b_segments
+              b_segments <=> a_segments # deeper (child) first
+            else
+              a <=> b
             end
-            loc, {location: loc, secret: secret, realm: realm || 'Pretected area'}
-          }
-          auths = Hashauths
+          end
+          sorted + '/'
+        else
+          '/'
         end
       end
 
@@ -315,7 +345,7 @@
         if ssl?
           @ssl_certs_list ||= begin
             list = 
-            
+
             certs = labels.select{|k,v| k =~ /\Avhosts-ng\/ssl\/certs\/.*\Z/}
             certs.each do | id, d |
               id = File::basename(id) # LAZY but works
@@ -337,7 +367,7 @@
                 key: acme.privkey_path,
               })
             end
-            
+
             list << OpenStruct.new({
               names: self_signed_cert.names,
               cert: self_signed_cert.cert_path,
@@ -377,6 +407,25 @@
           memo
         end
       end
+
+      def write_passwd!
+        cnt = 0
+        access_rules.each do | k, ar |
+          if ar:auth && ar:auth.any?
+            passwd = File.join('/etc/nginx/vhosts.d/', "#{name}.#{cnt}.passwd")
+            File.open(passwd, 'wb+') {|f| f.write(ar:auth.join("\n"))}
+            ar:passwd = passwd
+            cnt += 1
+          end
+        end
+      end
+
+      def delete_passwd!
+        glob = File.join('/etc/nginx/vhosts.d/', "#{name}.*.passwd")
+        Dirglob.each do | passwd |
+          File.delete(passwd)
+        end
+      end
     end
   end
 end

nginx-controller-2.0.4.gem/data/lib/nginx_controller/templates/nginx-common.erb -> nginx-controller-2.1.0.gem/data/lib/nginx_controller/templates/nginx-common.erb Changed

@@ -17,20 +17,36 @@
   client_max_body_size <%= max_body_size %>;
   <% end -%>
 
-  location / {
 <% if running? -%>
-<% if auth_basic'/' -%>
-    auth_basic           "<%= auth_basic'/':realm %>";
-    auth_basic_user_file <%= auth_basic'/':secret %>; 
-    
+<% locations.each do | loc | -%>
+  <% access = access_rulesloc -%>
+
+  location <%= loc %> {
+<% if access -%>
+<% if access:passwd -%>
+    auth_basic           "Restricted area";
+    auth_basic_user_file <%= access:passwd %>;
+<% end -%>
+<% if access:allow -%>
+<% access:allow.each do |ip| %>
+    allow <%= ip %>;
+<% end -%>
+    deny all;
+<% elsif access:deny -%>
+<% access:deny.each do |ip| -%>
+    deny <%= ip -%>;
+<% end -%>
 <% end -%>
+<% end -%>
+
     recursive_error_pages on;
     if ($http_upgrade) {
       return 418;
     }
 
-<%= render 'nginx-proxy-block'%>
+<%= render 'nginx-proxy-block', {location: loc} %>
   }
+<% end -%>
 
   location @websocket {
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
@@ -58,19 +74,9 @@
     proxy_read_timeout 86400s;
     proxy_connect_timeout 10s;
     proxy_send_timeout 30s;
+  }
 <% else -%>
+  location / {
     return 403;
-<% end -%>
-  }
-<% if running? -%>
-  <% auth_basic.each do | loc, data | -%>
-    <% next if loc == '/' %> 
-
-  location <%= loc %> {
-    auth_basic           "<%= data:realm %>";
-    auth_basic_user_file <%= data:secret %>; 
-
-<%= render 'nginx-proxy-block', {location: loc} %>
   }
-  <% end -%>
-<% end -%>
\ No newline at end of file
+<% end -%>

nginx-controller-2.0.4.gem/metadata.gz -> nginx-controller-2.1.0.gem/metadata.gz Changed

@@ -1,16 +1,30 @@
 --- !ruby/object:Gem::Specification
 name: nginx-controller
 version: !ruby/object:Gem::Version
-  version: 2.0.4
+  version: 2.1.0
 platform: ruby
 authors:
 - Angelo Grossini
 autorequire:
 bindir: bin
 cert_chain: 
-date: 2023-09-05 00:00:00.000000000 Z
+date: 2025-10-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.12'
+- !ruby/object:Gem::Dependency
   name: eventmachine
   requirement: !ruby/object:Gem::Requirement
     requirements:
@@ -126,7 +140,7 @@
     - !ruby/object:Gem::Version
       version: '0'
 requirements: 
-rubygems_version: 3.3.15
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Nginx controller for vhosts-ng

Changes of Revision 12