Skip to content

Instantly share code, notes, and snippets.

@vdubyna

vdubyna/.gitignore

Forked from karmi/.gitignore
Last active August 29, 2015 14:21
Download ZIP

Revisions

  1. @karmi karmi revised this gist Oct 7, 2014. 1 changed file with 6 additions and 0 deletions.
    6 changes: 6 additions & 0 deletions nginx_authorize_by_lua.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -34,6 +34,7 @@ events {
    http {
    upstream elasticsearch {
    server 127.0.0.1:9200;
    keepalive 15;
    }

    server {
    @@ -47,6 +48,11 @@ http {

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    proxy_buffering off;

    proxy_http_version 1.1;
    proxy_set_header Connection "Keep-Alive";
    proxy_set_header Proxy-Connection "Keep-Alive";
    }

    }
  2. @karmi karmi revised this gist Jul 21, 2014. 10 changed files with 143 additions and 99 deletions.
    9 changes: 4 additions & 5 deletions authorize.lua
    View file
    Original file line number Diff line number Diff line change
    @@ -80,10 +80,10 @@ local restrictions = {
    local role = ngx.var.remote_user
    ngx.log(ngx.DEBUG, role)

    -- 1] Exit 403 when no matching role has been found
    -- exit 403 when no matching role has been found
    if restrictions[role] == nil then
    ngx.header.content_type = 'text/plain'
    ngx.log(ngx.WARN, "Unknown role "..role)
    ngx.log(ngx.WARN, "Unknown role ["..role.."]")
    ngx.status = 403
    ngx.say("403 Forbidden: You don\'t have access to this resource.")
    return ngx.exit(403)
    @@ -114,14 +114,13 @@ for path, methods in pairs(restrictions[role]) do
    if p and m then
    allowed = true
    ngx.log(ngx.NOTICE, method.." "..uri.." matched: "..tostring(m).." "..tostring(path).." for "..role)
    break
    end
    end

    ngx.log(ngx.NOTICE, "Allowed? "..tostring(allowed))

    if not allowed then
    ngx.header.content_type = 'text/plain'
    ngx.log(ngx.WARN, "Role "..role.." not allowed to access the resource")
    ngx.log(ngx.WARN, "Role ["..role.."] not allowed to access the resource ["..method.." "..uri.."]")
    ngx.status = 403
    ngx.say("403 Forbidden: You don\'t have access to this resource.")
    return ngx.exit(403)
    14 changes: 7 additions & 7 deletions nginx_authorize_by_lua.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,9 +1,9 @@
    # Generate passwords:
    #
    # $ printf "john:$(openssl passwd -crypt john)\n" >> passwords
    # $ printf "all:$(openssl passwd -crypt all)\n" >> passwords
    # $ printf "user:$(openssl passwd -crypt user)\n" >> passwords
    # $ printf "admin:$(openssl passwd -crypt admin)\n" >> passwords
    # $ printf "nobody:$(openssl passwd -crypt nobody)\n" >> passwords
    # $ printf "all:$(openssl passwd -crypt all)\n" >> passwords
    # $ printf "user:$(openssl passwd -crypt user)\n" >> passwords
    # $ printf "admin:$(openssl passwd -crypt admin)\n" >> passwords
    #
    # Install the Nginx with Lua support ("openresty"):
    #
    @@ -25,15 +25,15 @@

    worker_processes 1;

    error_log logs/lua_error.log notice;
    error_log logs/lua.log notice;

    events {
    worker_connections 1024;
    worker_connections 1024;
    }

    http {
    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9200;
    }

    server {
    18 changes: 18 additions & 0 deletions nginx_basic_proxy.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_basic_proxy.conf
    # $ curl localhost:8000
    #

    events {
    worker_connections 1024;
    }

    http {
    server {
    listen 8080;
    location / {
    proxy_pass http://localhost:9200;
    }
    }
    }
    37 changes: 37 additions & 0 deletions nginx_http_auth_allow_path.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,37 @@
    # Generate password with eg.
    #
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" > passwords
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_allow_path.conf
    #

    events {
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9200;
    }

    server {
    listen 8080;

    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    location ~* ^(/_cluster|/_nodes) {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }

    location / {
    return 403;
    break;
    }
    }

    }
    62 changes: 29 additions & 33 deletions nginx_http_auth_allow_path_and_method.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,62 +1,58 @@
    # Generate password with eg.
    #
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" >> passwords
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" > passwords
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_allow_path_and_method.conf
    #

    events {
    worker_connections 1024;
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9200;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;
    listen 8080;

    error_log elasticsearch_proxy-errors.log;
    access_log elasticsearch_proxy.log;
    location / {
    error_page 590 = @elasticsearch;
    error_page 595 = @protected_elasticsearch;

    location / {
    error_page 590 = @elasticsearch;
    error_page 595 = @protected_elasticsearch;
    set $ok 0;

    set $ok 0;

    if ($request_uri ~ ^/$) {
    set $ok "${ok}1";
    }

    if ($request_method = HEAD) {
    set $ok "${ok}2";
    }

    if ($ok = 012) {
    return 590;
    }
    if ($request_uri ~ ^/$) {
    set $ok "${ok}1";
    }

    return 595;
    if ($request_method = HEAD) {
    set $ok "${ok}2";
    }

    location @elasticsearch {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    if ($ok = 012) {
    return 590;
    }

    location @protected_elasticsearch {
    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;
    return 595;
    }

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    location @elasticsearch {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }

    location @protected_elasticsearch {
    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    }
    25 changes: 10 additions & 15 deletions nginx_http_auth_basic.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,37 +1,32 @@
    # Generate password with eg.
    #
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" >> passwords
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" > passwords
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_basic.conf
    #

    events {
    worker_connections 1024;
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9200;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;
    listen 8080;

    error_log elasticsearch_proxy-errors.log;
    access_log elasticsearch_proxy.log;

    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    location / {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    location / {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    }
    29 changes: 14 additions & 15 deletions nginx_http_auth_deny_path.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,38 +1,37 @@
    # Generate password with eg.
    #
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" >> passwords
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" > passwords
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_deny_path.conf
    #

    events {
    worker_connections 1024;
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9200;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;
    listen 8080;

    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;
    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    location / {
    if ($request_uri ~ _shutdown) {
    return 403;
    break;
    }

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    location / {
    if ($request_filename ~ _shutdown) {
    return 403;
    break;
    }

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    }
    20 changes: 10 additions & 10 deletions nginx_http_auth_roles.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,21 +1,21 @@
    # Generate passwords:
    #
    # $ printf "user:$(openssl passwd -crypt user)\n" >> users
    # $ printf "admin:$(openssl passwd -crypt admin)\n" >> admins
    # $ printf "user:$(openssl passwd -crypt user)\n" > users
    # $ printf "admin:$(openssl passwd -crypt admin)\n" > admins
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_roles.conf
    #

    events {
    worker_connections 1024;
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9200;
    }

    # Allow HEAD / for all
    @@ -28,7 +28,7 @@ http {
    #
    server {
    listen 8080;
    server_name elasticsearch_all;
    server_name elasticsearch_all.local;

    location / {
    return 401;
    @@ -45,7 +45,7 @@ http {
    }
    }

    # Allow accessing /_search for authenticated "users"
    # Allow access to /_search and /_analyze for authenticated "users"
    #
    # curl -i 'http://localhost:8081/_search'
    # HTTP/1.1 401 Unauthorized
    @@ -61,7 +61,7 @@ http {
    #
    server {
    listen 8081;
    server_name elasticsearch_users;
    server_name elasticsearch_users.local;

    auth_basic "Elasticsearch Users";
    auth_basic_user_file users;
    @@ -70,13 +70,13 @@ http {
    return 403;
    }

    location ~* /_search||_analyze {
    location ~* ^(/_search|/_analyze) {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    # Allow accessing everything for authenticated "admins"
    # Allow access to anything for authenticated "admins"
    #
    # curl -i 'http://admin:admin@localhost:8082/_search'
    # HTTP/1.1 200 OK
    @@ -86,7 +86,7 @@ http {
    #
    server {
    listen 8082;
    server_name elasticsearch_admins;
    server_name elasticsearch_admins.local;

    auth_basic "Elasticsearch Admins";
    auth_basic_user_file admins;
    21 changes: 10 additions & 11 deletions nginx_keep_alive.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -10,21 +10,20 @@ events {
    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9200;

    keepalive 15;
    keepalive 15;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;

    location / {
    proxy_pass http://elasticsearch;
    proxy_http_version 1.1;
    proxy_set_header Connection "Keep-Alive";
    proxy_set_header Proxy-Connection "Keep-Alive";
    }
    listen 8080;

    location / {
    proxy_pass http://elasticsearch;
    proxy_http_version 1.1;
    proxy_set_header Connection "Keep-Alive";
    proxy_set_header Proxy-Connection "Keep-Alive";
    }

    }

    7 changes: 4 additions & 3 deletions nginx_round_robin.conf → nginx_load_balancer.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,6 @@
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_round_robin.conf
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_load_balancer.conf
    #

    events {
    @@ -10,8 +10,9 @@ events {
    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9251;
    server 127.0.0.1:9200;
    server 127.0.0.1:9201;
    server 127.0.0.1:9202;
    }

    server {
  3. @karmi karmi revised this gist Dec 17, 2013. 12 changed files with 561 additions and 0 deletions.
    79 changes: 79 additions & 0 deletions README.markdown
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,79 @@
    Example Nginx Configurations for Elasticsearch
    ==============================================

    This repository contains couple of example configurations for using Nginx as a proxy for Elasticsearch.

    These examples can be run standalone from this repository -- the general pattern is:

    $ nginx -p $PWD/nginx/ -c $PWD/<CONFIG FILE>

    When you change the configuration, simply _reload_ the Nginx process to pick up the changes:

    $ nginx -p $PWD/nginx/ -c $PWD/<CONFIG FILE> -s reload

    Please refer to the Nginx [documentation](http://nginx.org/en/docs/) for more information.

    ## `nginx_round_robin.conf`

    A simple proxy which distributes requests in a round-robin way across configured nodes.

    More information: <http://nginx.org/en/docs/http/ngx_http_upstream_module.html>

    ## `nginx_keep_alive.conf`

    Configures the proxy to keep a pool of persistent connections, preventing opening
    sockets at Elasticsearch for each connection, e.g. with deficient HTTP clients.

    More information: <http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive>

    ## `nginx_http_auth_basic.conf`

    The simplest possible authorization proxy for Elasticsearch: allow access only
    to users authenticated with HTTP Basic Auth, with credentials stored in a `passwords` file.

    ## `nginx_http_auth_deny_path.conf`

    A variation on the simple authorization proxy, which prevents access to certain URLs
    (`_shutdown`).

    ## `nginx_http_auth_allow_path_and_method.conf`

    A variation on the authorization proxy, which uses named `location`s to
    allow certain paths and methods without authorization.

    Demonstrates how to use error codes in Nginx configuration to route requests
    and how to work around the lack of multiple conditions in Nginx' `if` statement.

    More information: <http://wiki.nginx.org/RewriteMultiCondExample>

    ## `nginx_http_auth_roles.conf`

    Demonstrates how to use multiple Nginx servers to separate access rights for
    multiple types of users: unauthenticated, _users_ and _admins_.

    Unauthenticated users can access `HEAD /`, but nothing else.

    Authenticated _user_ can access only the `_search` and `_analyze` endpoints
    (with whatever HTTP method), other endpoints are denied.

    More information: <http://nginx.org/en/docs/http/ngx_http_core_module.html#location>

    ## `nginx_authorize_by_lua.conf`

    Demonstrates how to use custom logic for implementing authorization, via the
    [Lua](http://wiki.nginx.org/HttpLuaModule) support in Nginx.

    The request is authenticated against credentials in the `passwords` file and if
    allowed by the `access_by_lua_file` return value, proxied to Elasticsearch.

    The authorization logic is stored in the `authorize.lua` file, which contains
    a simple "dictionary" (in the form of Lua _table_) with rules for three
    "roles": anybody, users and admins.

    Based on the `$remote_user` Nginx variable value, the request path and method
    are evaluated against the dictionary, and the request is denied with "403 Forbidden"
    if no matching rule is found.

    Lua and Nginx Overview: <http://www.londonlua.org/scripting_nginx_with_lua/slides.html>

    More information: <http://openresty.org>
    1 change: 1 addition & 0 deletions admins
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    admin:bHw.s5hN/IvE6
    128 changes: 128 additions & 0 deletions authorize.lua
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,128 @@
    --[[
    Provides Elasticserach endpoint authorization based on rules in Lua and authenticated user
    See the `nginx_authorize_by_lua.conf` for the Nginx config.
    Synopsis:
    $ /usr/local/openresty/nginx/sbin/nginx -p $PWD/nginx/ -c $PWD/nginx_authorize_by_lua.conf
    $ curl -i -X HEAD 'http://localhost:8080'
    HTTP/1.1 401 Unauthorized
    curl -i -X HEAD 'http://all:all@localhost:8080'
    HTTP/1.1 200 OK
    curl -i -X GET 'http://all:all@localhost:8080'
    HTTP/1.1 403 Forbidden
    curl -i -X GET 'http://user:user@localhost:8080'
    HTTP/1.1 200 OK
    curl -i -X GET 'http://user:user@localhost:8080/_search'
    HTTP/1.1 200 OK
    curl -i -X POST 'http://user:user@localhost:8080/_search'
    HTTP/1.1 200 OK
    curl -i -X GET 'http://user:user@localhost:8080/_aliases'
    HTTP/1.1 200 OK
    curl -i -X POST 'http://user:user@localhost:8080/_aliases'
    HTTP/1.1 403 Forbidden
    curl -i -X POST 'http://user:user@localhost:8080/myindex/mytype/1' -d '{"title" : "Test"}'
    HTTP/1.1 403 Forbidden
    curl -i -X DELETE 'http://user:user@localhost:8080/myindex/'
    HTTP/1.1 403 Forbidden
    curl -i -X POST 'http://admin:admin@localhost:8080/myindex/mytype/1' -d '{"title" : "Test"}'
    HTTP/1.1 200 OK
    curl -i -X DELETE 'http://admin:admin@localhost:8080/myindex/mytype/1'
    HTTP/1.1 200 OK
    curl -i -X DELETE 'http://admin:admin@localhost:8080/myindex/'
    HTTP/1.1 200 OK
    ]]--

    -- authorization rules

    local restrictions = {
    all = {
    ["^/$"] = { "HEAD" }
    },

    user = {
    ["^/$"] = { "GET" },
    ["^/?[^/]*/?[^/]*/_search"] = { "GET", "POST" },
    ["^/?[^/]*/?[^/]*/_msearch"] = { "GET", "POST" },
    ["^/?[^/]*/?[^/]*/_validate/query"] = { "GET", "POST" },
    ["/_aliases"] = { "GET" },
    ["/_cluster.*"] = { "GET" }
    },

    admin = {
    ["^/?[^/]*/?[^/]*/_bulk"] = { "GET", "POST" },
    ["^/?[^/]*/?[^/]*/_refresh"] = { "GET", "POST" },
    ["^/?[^/]*/?[^/]*/?[^/]*/_create"] = { "GET", "POST" },
    ["^/?[^/]*/?[^/]*/?[^/]*/_update"] = { "GET", "POST" },
    ["^/?[^/]*/?[^/]*/?.*"] = { "GET", "POST", "PUT", "DELETE" },
    ["^/?[^/]*/?[^/]*$"] = { "GET", "POST", "PUT", "DELETE" },
    ["/_aliases"] = { "GET", "POST" }
    }
    }

    -- get authenticated user as role
    local role = ngx.var.remote_user
    ngx.log(ngx.DEBUG, role)

    -- 1] Exit 403 when no matching role has been found
    if restrictions[role] == nil then
    ngx.header.content_type = 'text/plain'
    ngx.log(ngx.WARN, "Unknown role "..role)
    ngx.status = 403
    ngx.say("403 Forbidden: You don\'t have access to this resource.")
    return ngx.exit(403)
    end

    -- get URL
    local uri = ngx.var.uri
    ngx.log(ngx.DEBUG, uri)

    -- get method
    local method = ngx.req.get_method()
    ngx.log(ngx.DEBUG, method)

    local allowed = false

    for path, methods in pairs(restrictions[role]) do

    -- path matched rules?
    local p = string.match(uri, path)

    local m = nil

    -- method matched rules?
    for _, _method in pairs(methods) do
    m = m and m or string.match(method, _method)
    end

    if p and m then
    allowed = true
    ngx.log(ngx.NOTICE, method.." "..uri.." matched: "..tostring(m).." "..tostring(path).." for "..role)
    end
    end

    ngx.log(ngx.NOTICE, "Allowed? "..tostring(allowed))

    if not allowed then
    ngx.header.content_type = 'text/plain'
    ngx.log(ngx.WARN, "Role "..role.." not allowed to access the resource")
    ngx.status = 403
    ngx.say("403 Forbidden: You don\'t have access to this resource.")
    return ngx.exit(403)
    end
    53 changes: 53 additions & 0 deletions nginx_authorize_by_lua.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,53 @@
    # Generate passwords:
    #
    # $ printf "john:$(openssl passwd -crypt john)\n" >> passwords
    # $ printf "all:$(openssl passwd -crypt all)\n" >> passwords
    # $ printf "user:$(openssl passwd -crypt user)\n" >> passwords
    # $ printf "admin:$(openssl passwd -crypt admin)\n" >> passwords
    #
    # Install the Nginx with Lua support ("openresty"):
    #
    # $ wget http://openresty.org/download/ngx_openresty-1.4.3.9.tar.gz
    # $ tar xf ngx_openresty-*
    # $ cd ngx_openresty-*
    # $
    # $ ./configure --with-luajit
    # $ # ./configure --with-luajit --with-cc-opt="-I/usr/local/include" --with-ld-opt="-L/usr/local/lib" # Mac OS X w/ Homebrew
    # $ make && make install
    #
    # More information: http://openresty.org/#Installation
    #
    # See the Lua source code in `authorize.lua`
    #
    # Run:
    #
    # $ /usr/local/openresty/nginx/sbin/nginx -p $PWD/nginx/ -c $PWD/nginx_authorize_by_lua.conf

    worker_processes 1;

    error_log logs/lua_error.log notice;

    events {
    worker_connections 1024;
    }

    http {
    upstream elasticsearch {
    server 127.0.0.1:9250;
    }

    server {
    listen 8080;

    location / {
    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    access_by_lua_file '../authorize.lua';

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }

    }
    }
    62 changes: 62 additions & 0 deletions nginx_http_auth_allow_path_and_method.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,62 @@
    # Generate password with eg.
    #
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" >> passwords
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_allow_path_and_method.conf
    #

    events {
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;

    error_log elasticsearch_proxy-errors.log;
    access_log elasticsearch_proxy.log;

    location / {
    error_page 590 = @elasticsearch;
    error_page 595 = @protected_elasticsearch;

    set $ok 0;

    if ($request_uri ~ ^/$) {
    set $ok "${ok}1";
    }

    if ($request_method = HEAD) {
    set $ok "${ok}2";
    }

    if ($ok = 012) {
    return 590;
    }

    return 595;
    }

    location @elasticsearch {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }

    location @protected_elasticsearch {
    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    }
    37 changes: 37 additions & 0 deletions nginx_http_auth_basic.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,37 @@
    # Generate password with eg.
    #
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" >> passwords
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_basic.conf
    #

    events {
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;

    error_log elasticsearch_proxy-errors.log;
    access_log elasticsearch_proxy.log;

    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    location / {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }

    }

    }
    38 changes: 38 additions & 0 deletions nginx_http_auth_deny_path.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,38 @@
    # Generate password with eg.
    #
    # $ printf "john:$(openssl passwd -crypt s3cr3t)\n" >> passwords
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_deny_path.conf
    #

    events {
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;

    auth_basic "Protected Elasticsearch";
    auth_basic_user_file passwords;

    location / {
    if ($request_uri ~ _shutdown) {
    return 403;
    break;
    }

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    }
    100 changes: 100 additions & 0 deletions nginx_http_auth_roles.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,100 @@
    # Generate passwords:
    #
    # $ printf "user:$(openssl passwd -crypt user)\n" >> users
    # $ printf "admin:$(openssl passwd -crypt admin)\n" >> admins
    #
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_http_auth_roles.conf
    #

    events {
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    }

    # Allow HEAD / for all
    #
    # curl -i -X HEAD 'http://localhost:8080'
    # HTTP/1.1 200 OK
    #
    # curl -i -X GET 'http://localhost:8080'
    # HTTP/1.1 403 Forbidden
    #
    server {
    listen 8080;
    server_name elasticsearch_all;

    location / {
    return 401;
    }

    location = / {
    if ($request_method !~ "HEAD") {
    return 403;
    break;
    }

    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    # Allow accessing /_search for authenticated "users"
    #
    # curl -i 'http://localhost:8081/_search'
    # HTTP/1.1 401 Unauthorized
    #
    # curl -i 'http://user:user@localhost:8081/_search'
    # HTTP/1.1 200 OK
    #
    # curl -i 'http://user:user@localhost:8081/_analyze?text=Test'
    # HTTP/1.1 200 OK
    #
    # curl -i 'http://user:user@localhost:8081/_cluster/health'
    # HTTP/1.1 403 Forbidden
    #
    server {
    listen 8081;
    server_name elasticsearch_users;

    auth_basic "Elasticsearch Users";
    auth_basic_user_file users;

    location / {
    return 403;
    }

    location ~* /_search||_analyze {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    # Allow accessing everything for authenticated "admins"
    #
    # curl -i 'http://admin:admin@localhost:8082/_search'
    # HTTP/1.1 200 OK
    #
    # curl -i 'http://admin:admin@localhost:8082/_cluster/health'
    # HTTP/1.1 200 OK
    #
    server {
    listen 8082;
    server_name elasticsearch_admins;

    auth_basic "Elasticsearch Admins";
    auth_basic_user_file admins;

    location / {
    proxy_pass http://elasticsearch;
    proxy_redirect off;
    }
    }

    }
    31 changes: 31 additions & 0 deletions nginx_keep_alive.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,31 @@
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_keep_alive.conf
    #

    events {
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;

    keepalive 15;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;

    location / {
    proxy_pass http://elasticsearch;
    proxy_http_version 1.1;
    proxy_set_header Connection "Keep-Alive";
    proxy_set_header Proxy-Connection "Keep-Alive";
    }

    }

    }
    27 changes: 27 additions & 0 deletions nginx_round_robin.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,27 @@
    # Run:
    #
    # $ nginx -p $PWD/nginx/ -c $PWD/nginx_round_robin.conf
    #

    events {
    worker_connections 1024;
    }

    http {

    upstream elasticsearch {
    server 127.0.0.1:9250;
    server 127.0.0.1:9251;
    }

    server {
    listen 8080;
    server_name elasticsearch_proxy;

    location / {
    proxy_pass http://elasticsearch;
    }

    }

    }
    4 changes: 4 additions & 0 deletions passwords
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,4 @@
    john:C8Qf0PmsRcK7s
    all:gR9A3zOlFFRDs
    user:d.q1Wcp0KUqsk
    admin:/XyxrPc65koRY
    1 change: 1 addition & 0 deletions users
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    user:laYuBcroEif0c
  4. @karmi karmi created this gist Dec 17, 2013.
    7 changes: 7 additions & 0 deletions .gitignore
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,7 @@
    nginx/
    !nginx/.gitkeep
    !nginx/logs/.gitkeep

    src/

    tmp/