Sourcegraph Tweaked Dockerfile and NGINX Configuration for NGINX Reverse Proxy

Dockerfile

FROM sourcegraph/server:3.6.0

# Reset original entrypoint from base image.
ENTRYPOINT []

# Grab tweaked nginx.conf.
# See https://gist.github.com/0xbkt/aa8d977d2b7f17b091af6d23fad36927.
ADD https://gist.githubusercontent.com/0xbkt/aa8d977d2b7f17b091af6d23fad36927/raw/nginx.conf /etc/sourcegraph/

# Disable self-signed SSL of Management Console.
ENV UNSAFE_NO_HTTPS=true

# Make Sourcegraph's frontend bind to the PORT given by Heroku at runtime.
CMD export SRC_NGINX_HTTP_ADDR="0.0.0.0:$PORT"; \
    sed -i "s/7080/$PORT/g" /etc/sourcegraph/nginx.conf; \
    tini -s -- /usr/local/bin/server;

nginx.conf

# This config was generated by Sourcegraph.
# You can adjust the configuration to add additional TLS or HTTP features.
# Read more at https://docs.sourcegraph.com/admin/nginx

error_log stderr;
pid /var/run/nginx.pid;

# Do not remove. The contents of sourcegraph_main.conf can change between
# versions and may include improvements to the configuration.
include nginx/sourcegraph_main.conf;

events {
}

http {
    server_tokens off;

    # SAML redirect response headers are sometimes large
    proxy_buffer_size     128k;
    proxy_buffers         8 256k;
    proxy_busy_buffers_size    256k;

    # Do not remove. The contents of sourcegraph_http.conf can change between
    # versions and may include improvements to the configuration.
    include nginx/sourcegraph_http.conf;

    access_log off;
    upstream backend {
        # Do not remove. The contents of sourcegraph_backend.conf can change
        # between versions and may include improvements to the configuration.
        include nginx/sourcegraph_backend.conf;
    }
    
    upstream management_console {
        server 127.0.0.1:2633;
    }

    # Sourcegraph Frontend
    server {
        # Do not remove. The contents of sourcegraph_server.conf can change
        # between versions and may include improvements to the configuration.
        include nginx/sourcegraph_server.conf;

        listen 7080;
        location / {
            proxy_pass http://backend;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # SAML redirect response headers are sometimes large
            proxy_buffer_size     128k;
            proxy_buffers         8 256k;
            proxy_busy_buffers_size    256k;
        }
    }
    
    # Management Console
    server {
        # Do not remove. The contents of sourcegraph_server.conf can change
        # between versions and may include improvements to the configuration.
        include nginx/sourcegraph_server.conf;
        
        # Continue only if the host has src-mgmt subdomain.
        server_name src-mgmt.*;

        listen 7080;
        location / {
            proxy_pass http://management_console;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # SAML redirect response headers are sometimes large
            proxy_buffer_size     128k;
            proxy_buffers         8 256k;
            proxy_busy_buffers_size    256k;
        }
    }
}