├── .gitignore
├── config
    ├── crontab
    ├── 10_stream_acme.conf
    ├── 10_default_https.conf
    ├── error-pages
    │   ├── 404
    │   │   └── 00_index.html
    │   ├── 40x
    │   │   └── 00_index.html
    │   ├── 50x
    │   │   └── 00_index.html
    │   ├── all
    │   │   └── 00_index.html
    │   ├── 01_unified.conf
    │   └── 01_default.conf
    ├── 10_default.conf
    ├── 00_log.conf
    ├── 00_log_with_geoip.conf
    ├── 02_proxy.conf
    ├── nginx.conf
    ├── 01_ssl.conf
    ├── 03_geoip2.conf
    └── 00_vars.conf
├── config.sh
├── examples
    ├── stream.d
    │   └── mysql.conf
    ├── vhost.d
    │   ├── example.com.conf
    │   ├── git.example.com.conf
    │   ├── 00_default.conf
    │   ├── wiki.example.com.conf
    │   ├── static.example.com.conf
    │   ├── nexus3.example.com.conf
    │   ├── oidc.lua
    │   └── repo.example.com.conf
    └── epage.d
    │   └── all
    │       ├── 13_Clock.html
    │       ├── 11_Matrix_Rain.html
    │       ├── 10_Newton_Cradle.html
    │       └── 12_Solar_System.html
├── bin
    ├── update-certs
    ├── watch-config
    ├── entrypoint.sh
    ├── nginx-utils.awk
    ├── nginx-utils.sh
    └── build-certs
├── run.sh
├── README.md
├── LICENSE
└── Dockerfile


/.gitignore:
--------------------------------------------------------------------------------
1 | .idea/
2 | 
3 | 


--------------------------------------------------------------------------------
/config/crontab:
--------------------------------------------------------------------------------
1 | # m h  dom mon dow   command
2 | 41 6,15 * * *       /usr/bin/update-certs
3 | 


--------------------------------------------------------------------------------
/config.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | 
3 | IMAGE_VERSION=1.15.12-r1
4 | IMAGE_NAME=flytreeleft/nginx-gateway
5 | 
6 | IMAGE_GEOIP_NAME=flytreeleft/nginx-gateway-with-geoip
7 | 


--------------------------------------------------------------------------------
/examples/stream.d/mysql.conf:
--------------------------------------------------------------------------------
 1 | upstream mysql_upstreams {
 2 |     server mysql0:3306;
 3 |     server mysql1:3306;
 4 | }
 5 | 
 6 | server {
 7 |     listen 3306;
 8 | 
 9 |     proxy_pass mysql_upstreams;
10 | 
11 |     error_log /var/log/nginx/sites/mysql.example.com/error.log;
12 | }
13 | 
14 | 


--------------------------------------------------------------------------------
/config/10_stream_acme.conf:
--------------------------------------------------------------------------------
 1 | map $ssl_preread_alpn_protocols $backend {
 2 |     # ~\bacme-tls/1\b unix:/tmp/nginx-tls-alpn.sock;
 3 |     # default unix:/tmp/nginx-ssl.sock;
 4 |     ~\bacme-tls/1\b 0.0.0.0:21443;
 5 |     default 0.0.0.0:20443;
 6 | }
 7 | 
 8 | server {
 9 |     listen 443;
10 |     listen [::]:443;
11 | 
12 |     ssl_preread on;
13 |     proxy_pass $backend;
14 | }
15 | 


--------------------------------------------------------------------------------
/examples/vhost.d/example.com.conf:
--------------------------------------------------------------------------------
 1 | server {
 2 |     listen 443 ssl;
 3 |     listen [::]:443 ssl;
 4 | 
 5 |     server_name example.com;
 6 | 
 7 |     include /etc/nginx/vhost.d/example.com/*.conf;
 8 | 
 9 |     location / {
10 |         # Disable proxy cache
11 |         proxy_cache off;
12 | 
13 |         # Avoid to get address resolve error when starting
14 |         set $target http://<proxy to backend>:80;
15 |         proxy_pass  $target;
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/examples/vhost.d/git.example.com.conf:
--------------------------------------------------------------------------------
 1 | ##
 2 | # Gitlab service proxy settings
 3 | ##
 4 | 
 5 | server {
 6 |     listen 443 ssl;
 7 |     listen [::]:443 ssl;
 8 | 
 9 |     server_name git.example.com;
10 | 
11 |     include /etc/nginx/vhost.d/git.example.com/*.conf;
12 | 
13 |     # Support to push big files
14 |     client_max_body_size 100M;
15 | 
16 |     location / {
17 |         # Avoid to get address resolve error when starting
18 |         set $target http://<gitlab ip>:<gitlab port>;
19 |         proxy_pass  $target;
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/bin/update-certs:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | CERT_DIR=/etc/letsencrypt
 4 | VHOSTD=/etc/nginx/vhost.d
 5 | LOCK="${CERT_DIR}/.lck"
 6 | 
 7 | if [ -e ${LOCK} ]; then
 8 |     exit 0
 9 | else
10 |     touch ${LOCK}
11 | fi
12 | 
13 | 
14 | # https://github.com/acmesh-official/acme.sh
15 | /usr/bin/acme.sh \
16 |     --cron \
17 |     --home /opt/acme.sh \
18 |     --config-home "${CERT_DIR}/config" \
19 |     "$@" \
20 |     >> "${CERT_DIR}/update.log" \
21 |     2>&1
22 | 
23 | chown -R nginx:nginx ${VHOSTD} ${CERT_DIR}/certs \
24 | && chmod go-rw -R ${VHOSTD} ${CERT_DIR}/certs \
25 | && /usr/sbin/nginx -s reload
26 | 
27 | rm -f ${LOCK}
28 | 


--------------------------------------------------------------------------------
/config/10_default_https.conf:
--------------------------------------------------------------------------------
 1 | # The port 443 is the default ssl port,
 2 | # if you want to create ssl keys for all https server from scratch,
 3 | # you need to enable this configuration for making a default https server
 4 | # to make sure the nginx can be started successfully
 5 | # https://itecnotes.com/server/nginx-disable-ssl-on-an-nginx-server-block-listening-on-port-443/#related-embeded
 6 | server {
 7 |     listen 443 ssl default_server;
 8 |     listen [::]:443 ssl default_server;
 9 |     server_name _;
10 | 
11 |     ssl_certificate /etc/nginx/ssl/default_https_ssl.crt;
12 |     ssl_certificate_key /etc/nginx/ssl/default_https_ssl.key;
13 | 
14 |     return 404;
15 | }
16 | 


--------------------------------------------------------------------------------
/examples/vhost.d/00_default.conf:
--------------------------------------------------------------------------------
 1 | # http://nginx.org/en/docs/http/server_names.html
 2 | # https://community.letsencrypt.org/t/ocsp-stapling-nginx-server/30865/8#post_9
 3 | resolver 8.8.8.8 valid=300s;
 4 | resolver_timeout 5s;
 5 | 
 6 | # Websocket support
 7 | proxy_http_version 1.1;
 8 | proxy_set_header Upgrade $http_upgrade;
 9 | proxy_set_header Connection "upgrade";
10 | 
11 | # Force to change the redirect url's scheme to https
12 | proxy_redirect   http:// $scheme://;
13 | proxy_redirect     / /;
14 | 
15 | # Intercept proxy errors (e.g. 404, 500, etc.) and redirected them to nginx
16 | ## http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_intercept_errors
17 | #proxy_intercept_errors on;
18 | 


--------------------------------------------------------------------------------
/config/error-pages/404/00_index.html:
--------------------------------------------------------------------------------
 1 | <!-- Source code from Nginx -->
 2 | <!DOCTYPE html>
 3 | <html>
 4 |     <head>
 5 |         <title>404 - Page Not Found</title>
 6 |     </head>
 7 |     <body bgcolor="white">
 8 |         <center><h1>404 Page Not Found</h1></center>
 9 |         <hr>
10 |         <center><a href="http://nginx.com/">nginx.com</a></center>
11 |     </body>
12 | </html>
13 | <!-- a padding to disable MSIE and Chrome friendly error page -->
14 | <!-- a padding to disable MSIE and Chrome friendly error page -->
15 | <!-- a padding to disable MSIE and Chrome friendly error page -->
16 | <!-- a padding to disable MSIE and Chrome friendly error page -->
17 | <!-- a padding to disable MSIE and Chrome friendly error page -->
18 | <!-- a padding to disable MSIE and Chrome friendly error page -->
19 | 


--------------------------------------------------------------------------------
/config/error-pages/40x/00_index.html:
--------------------------------------------------------------------------------
 1 | <!-- Source code from Nginx -->
 2 | <!DOCTYPE html>
 3 | <html>
 4 |     <head>
 5 |         <title>{{status}} - {{status_msg}}</title>
 6 |     </head>
 7 |     <body bgcolor="white">
 8 |         <center><h1>{{status}} {{status_msg}}</h1></center>
 9 |         <hr>
10 |         <center><a href="http://nginx.com/">nginx.com</a></center>
11 |     </body>
12 | </html>
13 | <!-- a padding to disable MSIE and Chrome friendly error page -->
14 | <!-- a padding to disable MSIE and Chrome friendly error page -->
15 | <!-- a padding to disable MSIE and Chrome friendly error page -->
16 | <!-- a padding to disable MSIE and Chrome friendly error page -->
17 | <!-- a padding to disable MSIE and Chrome friendly error page -->
18 | <!-- a padding to disable MSIE and Chrome friendly error page -->
19 | 


--------------------------------------------------------------------------------
/config/error-pages/50x/00_index.html:
--------------------------------------------------------------------------------
 1 | <!-- Source code from Nginx -->
 2 | <!DOCTYPE html>
 3 | <html>
 4 |     <head>
 5 |         <title>{{status}} - {{status_msg}}</title>
 6 |     </head>
 7 |     <body bgcolor="white">
 8 |         <center><h1>{{status}} {{status_msg}}</h1></center>
 9 |         <hr>
10 |         <center><a href="http://nginx.com/">nginx.com</a></center>
11 |     </body>
12 | </html>
13 | <!-- a padding to disable MSIE and Chrome friendly error page -->
14 | <!-- a padding to disable MSIE and Chrome friendly error page -->
15 | <!-- a padding to disable MSIE and Chrome friendly error page -->
16 | <!-- a padding to disable MSIE and Chrome friendly error page -->
17 | <!-- a padding to disable MSIE and Chrome friendly error page -->
18 | <!-- a padding to disable MSIE and Chrome friendly error page -->
19 | 


--------------------------------------------------------------------------------
/config/error-pages/all/00_index.html:
--------------------------------------------------------------------------------
 1 | <!-- Source code from Nginx -->
 2 | <!DOCTYPE html>
 3 | <html>
 4 |     <head>
 5 |         <title>{{status}} - {{status_msg}}</title>
 6 |     </head>
 7 |     <body bgcolor="white">
 8 |         <center><h1>{{status}} {{status_msg}}</h1></center>
 9 |         <hr>
10 |         <center><a href="http://nginx.com/">nginx.com</a></center>
11 |     </body>
12 | </html>
13 | <!-- a padding to disable MSIE and Chrome friendly error page -->
14 | <!-- a padding to disable MSIE and Chrome friendly error page -->
15 | <!-- a padding to disable MSIE and Chrome friendly error page -->
16 | <!-- a padding to disable MSIE and Chrome friendly error page -->
17 | <!-- a padding to disable MSIE and Chrome friendly error page -->
18 | <!-- a padding to disable MSIE and Chrome friendly error page -->
19 | 


--------------------------------------------------------------------------------
/config/10_default.conf:
--------------------------------------------------------------------------------
 1 | server {
 2 |     listen 80 default_server;
 3 |     listen [::]:80 default_server;
 4 |     server_name _;
 5 | 
 6 |     # https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/blob/master/app/nginx_location.conf
 7 |     location ^~ /.well-known/acme-challenge/ {
 8 |         allow all;
 9 | 
10 |         # NOTE: The '/' must be put at the end.
11 |         ## https://www.leavesongs.com/PENETRATION/nginx-insecure-configuration.html#_1
12 |         alias       /etc/letsencrypt/.well-known/acme-challenge/;
13 |         try_files   $uri =404;
14 | 
15 |         break;
16 |     }
17 | 
18 |     # Health checking for k8s pod
19 |     ## https://github.com/robszumski/k8s-service-proxy/blob/master/nginx.conf
20 |     location /health {
21 |         access_log off;
22 |         add_header Content-Type text/plain;
23 | 
24 |         return 200;
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/config/00_log.conf:
--------------------------------------------------------------------------------
 1 | # Rotate access log with the variable '$logdate' like 'access_log /var/log/nginx/access$logdate.log main;'.
 2 | # But it's not possible to embed variables in error_log directives:
 3 | ## https://github.com/fcambus/nginx-resources/issues/12
 4 | ## https://www.cambus.net/log-rotation-directly-within-nginx-configuration-file/
 5 | map $time_iso8601 $logdate {
 6 |     default                                             '';
 7 |     '~^(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})'    _$year-$month-$day;
 8 | }
 9 | 
10 | # http://nginx.org/en/docs/http/ngx_http_log_module.html
11 | log_format main '$remote_addr - $remote_user [$time_local]'
12 |                 ' "$request"'
13 |                 ' $upstream_cache_status $status'
14 |                 ' $body_bytes_sent $request_time'
15 |                 ' "$http_referer" "$http_user_agent"'
16 |                 ' "$http_x_forwarded_for"';
17 | 
18 | error_log  /var/log/nginx/error.log debug;
19 | access_log /var/log/nginx/access$logdate.log main;
20 | 


--------------------------------------------------------------------------------
/config/00_log_with_geoip.conf:
--------------------------------------------------------------------------------
 1 | # Rotate access log with the variable '$logdate' like 'access_log /var/log/nginx/access$logdate.log main;'.
 2 | # But it's not possible to embed variables in error_log directives:
 3 | ## https://github.com/fcambus/nginx-resources/issues/12
 4 | ## https://www.cambus.net/log-rotation-directly-within-nginx-configuration-file/
 5 | map $time_iso8601 $logdate {
 6 |     default                                             '';
 7 |     '~^(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})'    _$year-$month-$day;
 8 | }
 9 | 
10 | # http://nginx.org/en/docs/http/ngx_http_log_module.html
11 | log_format main '$remote_addr - $remote_user [$time_local]'
12 |                 ' "$request"'
13 |                 ' $upstream_cache_status $status'
14 |                 ' $body_bytes_sent $request_time'
15 |                 ' "$http_referer" "$http_user_agent"'
16 |                 ' "$http_x_forwarded_for"'
17 |                 ' "$http_x_geoip_data"';
18 | 
19 | error_log  /var/log/nginx/error.log debug;
20 | access_log /var/log/nginx/access$logdate.log main;
21 | 


--------------------------------------------------------------------------------
/config/error-pages/01_unified.conf:
--------------------------------------------------------------------------------
 1 | ##
 2 | # Randomly choose the *.html (e.g. 00_xx.html) to be used as error page,
 3 | # but all files will be used to display all errors.
 4 | #
 5 | # All error pages (*.html) will be picked from /etc/nginx/epage.d/,
 6 | # the files in it's child directory are ignored.
 7 | ##
 8 | 
 9 | # Obmit the `[=[response]]` syntax to keep the error response code for clients.
10 | ## http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page
11 | error_page 404 400 401 403 500 502 503 504    /_/;
12 | 
13 | location /_/ {
14 |     internal;
15 |     random_index on;
16 | 
17 |     # http://nginx.org/en/docs/http/ngx_http_core_module.html#alias
18 |     # https://stackoverflow.com/questions/10631933/nginx-static-file-serving-confusion-with-root-alias#answer-10647080
19 |     alias /etc/nginx/epage.d/all/;
20 | 
21 |     # Replace the placeholders in response content
22 |     # for showing the corresponding status and message.
23 |     sub_filter '{{status}}' '$status';
24 |     sub_filter '{{status_msg}}' '$status_msg';
25 |     sub_filter_once off;
26 | }
27 | 


--------------------------------------------------------------------------------
/config/02_proxy.conf:
--------------------------------------------------------------------------------
 1 | proxy_cache_path    /var/cache/nginx levels=1:2 keys_zone=cache_zone:50m inactive=1d max_size=200m;
 2 | proxy_cache           cache_zone;
 3 | proxy_cache_key       $host$uri$is_args$args;
 4 | proxy_cache_valid     200 304 1h;
 5 | 
 6 | # https://github.com/jwilder/nginx-proxy/issues/130#issuecomment-88962969
 7 | ## issue with ip and the nginx proxy
 8 | real_ip_header    X-Forwarded-For;
 9 | set_real_ip_from  172.17.0.0/16;
10 | 
11 | # http://nginx.org/en/docs/http/ngx_http_proxy_module.html
12 | proxy_set_header        Host $host;
13 | proxy_set_header        X-Real-IP $remote_addr;
14 | proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
15 | proxy_set_header        X-Forwarded-Proto $scheme;
16 | proxy_set_header        X-Forwarded-Ssl on;
17 | 
18 | # Mitigate httpoxy attack
19 | proxy_set_header            Proxy "";
20 | proxy_connect_timeout       120;
21 | proxy_send_timeout          120;
22 | proxy_read_timeout          120;
23 | proxy_buffer_size           4k;
24 | proxy_buffers               4 256k;
25 | proxy_busy_buffers_size     512k;
26 | proxy_temp_file_write_size  512k;
27 | 
28 | # Nginx cache check
29 | ## http://www.361way.com/nginx-cache/2665.html
30 | add_header  Nginx-Cache $upstream_cache_status;
31 | 


--------------------------------------------------------------------------------
/bin/watch-config:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | . /usr/bin/nginx-utils.sh
 4 | 
 5 | while [[ -n "$1" ]]; do
 6 |     case "$1" in
 7 |         --)
 8 |             shift
 9 |             CMD="$@"
10 |             break
11 |         ;;
12 |     esac
13 |     shift
14 | done
15 | 
16 | if [ "x$CMD" = "x" ]; then
17 |     echo "Usage: $0 -- <Command>"
18 |     exit 0
19 | fi
20 | 
21 | 
22 | CHECK_REF_FILE="/tmp/watch-config-check.ref"
23 | touch "${CHECK_REF_FILE}"
24 | 
25 | update_ref() {
26 |     local timestamp="$(date +%Y%m%d%H%M.%S)"
27 | 
28 |     touch "${CHECK_REF_FILE}" -t ${timestamp}
29 | }
30 | 
31 | has_modified_anyof() {
32 |     local result="false"
33 | 
34 |     while [[ -n "$1" ]]; do
35 |         if [[ ! -e "${CHECK_REF_FILE}" || "x$(find "$1" -newer "${CHECK_REF_FILE}" 2>/dev/null)" != "x" ]]; then
36 |             result="true"
37 |             break
38 |         fi
39 |         shift
40 |     done
41 | 
42 |     [[ "$result" = "true" ]]
43 | }
44 | 
45 | run_cmd() {
46 |     local cmd="$1"
47 | 
48 |     eval "${cmd}"
49 |     update_ref
50 | }
51 | 
52 | 
53 | target_dirs=(
54 |     $(get_include_files_from /etc/nginx/nginx.conf | sed -E 's|/[^/]+$||g; /^\/etc\/nginx$/d;' | uniq)
55 | )
56 | while true; do
57 |     sleep 10s
58 | 
59 |     if has_modified_anyof "${target_dirs[@]}"; then
60 |         run_cmd "${CMD}"
61 |     fi
62 | done
63 | 


--------------------------------------------------------------------------------
/examples/vhost.d/wiki.example.com.conf:
--------------------------------------------------------------------------------
 1 | ##
 2 | # Mediawiki service proxy settings, and enable user authentication
 3 | ##
 4 | 
 5 | server {
 6 |     listen 443 ssl;
 7 |     listen [::]:443 ssl;
 8 | 
 9 |     server_name wiki.example.com;
10 | 
11 |     include /etc/nginx/vhost.d/wiki.example.com/*.conf;
12 | 
13 |     client_max_body_size 100M;
14 | 
15 |     location / {
16 |         # http://docs.openhab.org/installation/security.html#nginx-auth-users
17 |         satisfy  any;
18 |         deny     all;
19 |         auth_basic            "Username and Password Required";
20 |         # Debian: apt-get install apache2-utils
21 |         # CentOS: yum install httpd-tools
22 |         # Create first account: htpasswd -c .htpasswd <username>
23 |         # Add new account: htpasswd .htpasswd <username>
24 |         # Remove existing account: htpasswd -D .htpasswd <username>
25 |         auth_basic_user_file  /etc/nginx/vhost.d/wiki.example.com/.htpasswd;
26 | 
27 |         # Authentication with OpenID
28 |         #set $oidc_realm "<realm name, e.g. main>";
29 |         #set $oidc_client_id "<client id, e.g. mediawiki>";
30 |         #set $oidc_ip_whitelist  "10.10.0.1, 10.10.0.2";
31 |         #access_by_lua_file /etc/nginx/vhost.d/oidc.lua;
32 | 
33 |         # Avoid to get address resolve error when starting
34 |         set $target http://<mediawiki ip>:<mediawiki port>;
35 |         proxy_pass  $target;
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/config/error-pages/01_default.conf:
--------------------------------------------------------------------------------
 1 | ##
 2 | # Randomly choose the *.html (e.g. 00_xx.html) to be used as error page.
 3 | # If the target directory only contains a single HTML file,
 4 | # this file will be always the unique error page (A fixed error page).
 5 | #
 6 | # The error page (*.html) will be picked from the child directories of /etc/nginx/epage.d/
 7 | # e.g. /404/, /40x/, /50x/.
 8 | ##
 9 | 
10 | # Obmit the `[=[response]]` syntax to keep the error response code for clients.
11 | ## http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page
12 | error_page 404              /404/;
13 | error_page 400 401 403      /40x/;
14 | error_page 500 502 503 504  /50x/;
15 | 
16 | location /404/ {
17 |     internal;
18 |     random_index on;
19 | 
20 |     root /etc/nginx/epage.d;
21 | }
22 | 
23 | location /40x/ {
24 |     internal;
25 |     random_index on;
26 | 
27 |     root /etc/nginx/epage.d;
28 | 
29 |     # Replace the placeholders in response content
30 |     # for showing the corresponding status and message.
31 |     sub_filter '{{status}}' '$status';
32 |     sub_filter '{{status_msg}}' '$status_msg';
33 |     sub_filter_once off;
34 | }
35 | 
36 | location /50x/ {
37 |     internal;
38 |     random_index on;
39 | 
40 |     root /etc/nginx/epage.d;
41 | 
42 |     # Replace the placeholders in response content
43 |     # for showing the corresponding status and message.
44 |     sub_filter '{{status}}' '$status';
45 |     sub_filter '{{status_msg}}' '$status_msg';
46 |     sub_filter_once off;
47 | }
48 | 


--------------------------------------------------------------------------------
/run.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 4 | . "${DIR}/config.sh"
 5 | 
 6 | 
 7 | DCR_NAME=nginx-gateway
 8 | DCR_IMAGE="${IMAGE_NAME}:${IMAGE_VERSION}"
 9 | 
10 | DCR_VOLUME=/var/lib/nginx-gateway
11 | 
12 | DEBUG=false
13 | ULIMIT=655360
14 | ENABLE_CUSTOM_ERROR_PAGE=true
15 | CERT_EMAIL=nobody@example.com
16 | 
17 | #ulimit -n ${ULIMIT}
18 | docker rm -f ${DCR_NAME}
19 | rm -f "${DCR_VOLUME}/letsencrypt/.lck"
20 | 
21 | # http://serverfault.com/questions/786389/nginx-docker-container-cannot-see-client-ip-when-using-iptables-false-option#answer-788088
22 | docker run -d --name ${DCR_NAME} \
23 |                 --restart always \
24 |                 --network host \
25 |                 --ulimit nofile=${ULIMIT} \
26 |                 -p 443:443 -p 80:80 \
27 |                 -e DEBUG=${DEBUG} \
28 |                 -e CERT_EMAIL=${CERT_EMAIL} \
29 |                 -e ENABLE_CUSTOM_ERROR_PAGE=${ENABLE_CUSTOM_ERROR_PAGE} \
30 |                 -e DISABLE_CERTBOT=false \
31 |                 -e DISABLE_GIXY=false \
32 |                 -v /usr/share/zoneinfo:/usr/share/zoneinfo:ro \
33 |                 -v /etc/localtime:/etc/localtime:ro \
34 |                 -v ${DCR_VOLUME}/logs:/var/log/nginx/sites \
35 |                 -v ${DCR_VOLUME}/letsencrypt:/etc/letsencrypt \
36 |                 -v ${DCR_VOLUME}/vhost.d:/etc/nginx/vhost.d \
37 |                 -v ${DCR_VOLUME}/stream.d:/etc/nginx/stream.d \
38 |                 -v ${DCR_VOLUME}/epage.d:/etc/nginx/epage.d \
39 |                 ${DCR_IMAGE}
40 | 


--------------------------------------------------------------------------------
/config/nginx.conf:
--------------------------------------------------------------------------------
 1 | user nginx;
 2 | # https://www.oschina.net/translate/nginx-tutorial-performance
 3 | worker_processes        auto;
 4 | worker_rlimit_nofile    655360;
 5 | 
 6 | pid        /var/run/nginx.pid;
 7 | error_log  /var/log/nginx/error.log debug;
 8 | 
 9 | events {
10 |     use epoll;
11 |     worker_connections  65536;
12 |     multi_accept        on;
13 | }
14 | 
15 | http {
16 |     sendfile                    on;
17 |     tcp_nopush                  on;
18 |     # sets TCP_NODELAY flag, used on keep-alive connections
19 |     tcp_nodelay                 on;
20 |     keepalive_timeout           60;
21 |     keepalive_requests          100000;
22 |     reset_timedout_connection   on;
23 |     types_hash_max_size         2048;
24 |     client_body_timeout         12;
25 |     client_header_timeout       12;
26 |     send_timeout                10;
27 |     server_tokens               off;
28 | 
29 |     # For chunked cookie: https://github.com/pingidentity/lua-resty-openidc/issues/33
30 |     client_body_buffer_size         16k;
31 |     client_header_buffer_size       1k;
32 |     large_client_header_buffers     4 16k;
33 |     client_max_body_size            10M;
34 |     #server_names_hash_bucket_size  64;
35 |     #server_name_in_redirect        off;
36 | 
37 |     include /etc/nginx/mime.types;
38 |     default_type application/octet-stream;
39 | 
40 |     gzip on;
41 |     gzip_disable        "MSIE [1-6].";
42 |     gzip_vary           on;
43 |     gzip_proxied        any;
44 |     gzip_comp_level     6;
45 |     gzip_buffers        16 8k;
46 |     gzip_min_length     100;
47 |     gzip_http_version   1.1;
48 |     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
49 | 
50 |     # Lua modules
51 |     lua_package_path '/usr/local/share/lua/5.1/?.lua;;';
52 | 
53 |     include /etc/nginx/conf.d/*.conf;
54 |     include /etc/nginx/vhost.d/*.conf;
55 | }
56 | 
57 | stream {
58 |     include /etc/nginx/vstream.d/*.conf;
59 |     include /etc/nginx/stream.d/*.conf;
60 | }
61 | 


--------------------------------------------------------------------------------
/config/01_ssl.conf:
--------------------------------------------------------------------------------
 1 | # https://mozilla.github.io/server-side-tls/ssl-config-generator/
 2 | 
 3 | # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
 4 | #ssl_certificate /etc/letsencrypt/live/example.com/signed_cert_plus_intermediates;
 5 | #ssl_certificate_key /etc/letsencrypt/live/example.com/private_key;
 6 | # Improve HTTPS performance with session resumption
 7 | ssl_session_cache shared:SSL:10m;
 8 | ssl_session_timeout 5m;
 9 | ssl_session_tickets off;
10 | 
11 | # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
12 | ## openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
13 | ssl_dhparam /etc/nginx/ssl/dhparam.pem;
14 | 
15 | # intermediate configuration. tweak to your needs.
16 | ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
17 | ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
18 | ssl_prefer_server_ciphers on;
19 | 
20 | # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
21 | add_header Strict-Transport-Security max-age=15768000;
22 | 
23 | # OCSP Stapling ---
24 | # fetch OCSP records from URL in ssl_certificate and cache them
25 | #ssl_stapling on;
26 | #ssl_stapling_verify on;
27 | 
28 | ## verify chain of trust of OCSP response using Root CA and Intermediate certs
29 | ### NOTE: ssl_certificate module aready includes intermediates
30 | #### http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
31 | #ssl_trusted_certificate /etc/letsencrypt/live/example.com/root_CA_cert_plus_intermediates;
32 | 


--------------------------------------------------------------------------------
/config/03_geoip2.conf:
--------------------------------------------------------------------------------
 1 | # http://www.treselle.com/blog/nginx-with-geoip2-maxmind-database-to-fetch-user-geo-location-data/#Configuring_Nginx_with_MaxMind_Databases
 2 | # https://dev.maxmind.com/geoip/geoip2/geolite2/
 3 | # https://dev.maxmind.com/geoip/geoip2/whats-new-in-geoip2/#Web_Service_Example
 4 | geoip2 /etc/nginx/geoip2/GeoLite2-Country.mmdb {
 5 |     $geoip_country_code source=$remote_addr country iso_code;
 6 |     $geoip_country_name country names en;
 7 | }
 8 | 
 9 | geoip2 /etc/nginx/geoip2/GeoLite2-City.mmdb {
10 |     $geoip_state_name subdivisions 0 names en;
11 |     $geoip_state_code subdivisions 0 iso_code;
12 |     $geoip_city_name city names en;
13 |     $geoip_postal_code postal code;
14 |     $geoip_latitude location latitude;
15 |     $geoip_longitude location longitude;
16 | }
17 | 
18 | access_by_lua_block {
19 |     -- https://github.com/dauer/geohash/blob/master/lua/lib/geohash.lua
20 |     -- Access http://geohash.org/{geohash} to watch the location
21 |     local geohash = "-"
22 |     local geodata = "-"
23 | 
24 |     if ngx.var.geoip_latitude and ngx.var.geoip_longitude then
25 |         local GeoHash = require("geohash")
26 |         GeoHash.precision(6)
27 | 
28 |         -- "Ave, New York, NY, United States, US (40.746482,-74.01508; dr5rg9xv7wu0)"
29 |         geohash = GeoHash.encode(tonumber(ngx.var.geoip_latitude), tonumber(ngx.var.geoip_longitude))
30 |         geodata = string.format("%s, %s, %s, %s, %s (%s,%s; %s)",
31 |                                     ngx.var.geoip_city_name ? ngx.var.geoip_city_name : "-",
32 |                                     ngx.var.geoip_state_name ? ngx.var.geoip_state_name : "-",
33 |                                     ngx.var.geoip_state_code ? ngx.var.geoip_state_code : "-",
34 |                                     ngx.var.geoip_country_name ? ngx.var.geoip_country_name : "-",
35 |                                     ngx.var.geoip_country_code ? ngx.var.geoip_country_code : "-",
36 |                                     ngx.var.geoip_latitude,
37 |                                     ngx.var.geoip_longitude,
38 |                                     geohash)
39 |     end
40 | 
41 |     ngx.req.set_header("X-GeoIP-GeoHash", geohash)
42 |     ngx.req.set_header("X-GeoIP-Data", geodata)
43 | 
44 |     -- ngx.log(ngx.DEBUG, ngx.var.http_x_geoip_geohash.." - "..ngx.var.http_x_geoip_data)
45 | }
46 | 


--------------------------------------------------------------------------------
/examples/vhost.d/static.example.com.conf:
--------------------------------------------------------------------------------
 1 | ##
 2 | # Remote static file proxy settings, and support to forward the target to the squid proxy
 3 | #
 4 | # Proxies:
 5 | # - https://static.example.com/*/http://others.com/asset.js -> http://others.com/asset.js
 6 | ##
 7 | 
 8 | server {
 9 |     listen 443 ssl;
10 |     listen [::]:443 ssl;
11 | 
12 |     server_name static.example.com;
13 | 
14 |     include /etc/nginx/vhost.d/static.example.com/*.conf;
15 | 
16 |     # https://static.example.com/*/http://others.com/asset.js -> http://others.com/asset.js
17 |     ## https://www.mediasuite.co.nz/blog/proxying-s3-downloads-nginx/
18 |     location ~* ^/\*/(http[s]?):?/(.*?)/(.*)$ {
19 |         # Note: Remove the directive 'internal;' to accept the external requests,
20 |         #       otherwise it will return 404 for the external requests.
21 |         #       See http://nginx.org/en/docs/http/ngx_http_core_module.html#internal
22 |         set $backend_protocol   $1;
23 |         set $backend_host       $2;
24 |         set $backend_path       $3;
25 |         set $backend_uri        $backend_host/$backend_path$is_args$args;
26 |         set $backend_url        $backend_protocol://$backend_uri;
27 | 
28 |         # Headers for the remote server, unset Authorization and Cookie for security reasons.
29 |         proxy_set_header Host $backend_host;
30 |         proxy_set_header Authorization '';
31 |         proxy_set_header Cookie '';
32 | 
33 |         # Stops the local disk from being written to (just forwards data through)
34 |         proxy_max_temp_file_size 0;
35 | 
36 |         # Forward the target to the squid proxy
37 |         ## https://serverfault.com/questions/583743/how-to-make-an-existing-caching-nginx-proxy-use-another-proxy-to-bypass-a-firewa#683955
38 |         ## Hide the reponse header to protect the backend proxy
39 |         ### http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header
40 |         proxy_hide_header Via;
41 |         proxy_hide_header X-Cache;
42 |         proxy_hide_header X-Cache-Hits;
43 |         proxy_hide_header X-Cache-Lookup;
44 |         proxy_hide_header X-Fastly-Request-ID;
45 |         proxy_hide_header X-Served-By;
46 |         proxy_hide_header X-Timer;
47 |         rewrite ^(.*)$      "://$backend_uri"           break;
48 |         rewrite ^(.*)$      "$backend_protocol$1"       break;
49 |         proxy_pass http://<squid ip>:3128;
50 | 
51 |         # Proxy to the target directly
52 |         #proxy_pass $backend_url;
53 | 
54 |         proxy_intercept_errors on;
55 |         error_page 301 302 307 = @handle_backend_redirect;
56 |     }
57 | 
58 |     # Nginx Embedded Variables: http://nginx.org/en/docs/varindex.html
59 |     location @handle_backend_redirect {
60 |         return 302 $scheme://$host/*/$upstream_http_location;
61 |     }
62 | }
63 | 


--------------------------------------------------------------------------------
/bin/entrypoint.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | . /usr/bin/nginx-utils.sh
 4 | 
 5 | ERROR_PAGES=${EPAGED}
 6 | if [[ "$(ls -A "${ERROR_PAGES}" 2>/dev/null)" = "" || "${ENABLE_CUSTOM_ERROR_PAGE}" = "force" ]]; then
 7 |     cp -r ${DEFAULT_ERROR_PAGES}/* ${ERROR_PAGES}
 8 |     rm -rf ${ERROR_PAGES}/*.conf
 9 | fi
10 | case ${ENABLE_CUSTOM_ERROR_PAGE} in
11 |     false)
12 |         rm -rf ${ERROR_PAGES}/01_default.conf
13 |         ;;
14 |     unified)
15 |         cat ${DEFAULT_ERROR_PAGES}/01_unified.conf > ${ERROR_PAGES}/01_default.conf
16 |         ;;
17 |     *)
18 |         cat ${DEFAULT_ERROR_PAGES}/01_default.conf > ${ERROR_PAGES}/01_default.conf
19 |         ;;
20 | esac
21 | 
22 | 
23 | rm -f "${CERT_DIR}/.lck"
24 | 
25 | if [[ ! -d "/opt/acme.sh" && "${DISABLE_CERTBOT}" != "true" ]]; then
26 |     pushd /opt/acme.sh-src
27 |         # https://github.com/acmesh-official/acme.sh
28 |         bash ./acme.sh \
29 |             --install  \
30 |             --home /opt/acme.sh \
31 |             --config-home "${CERT_DIR}/config" \
32 |             --cert-home "${CERT_DIR}/certs" \
33 |             --nocron \
34 |             --log \
35 |             --debug 2>/dev/null \
36 |         && ln -sf /opt/acme.sh/acme.sh /usr/bin/acme.sh \
37 |         && chmod +x /opt/acme.sh/acme.sh /usr/bin/acme.sh
38 |     popd
39 | fi
40 | 
41 | if [[ "${DISABLE_CERTBOT}" = "true" || "${CERT_CHALLENGE_TYPE}" != "alpn" ]]; then
42 |     rm -f /etc/nginx/vstream.d/10_stream_acme.conf
43 | fi
44 | if [[ "${DISABLE_DEFAULT_HTTPS_SERVER}" = "true" ]]; then
45 |     rm -f /etc/nginx/conf.d/10_default_https.conf
46 | fi
47 | if [[ "${DISABLE_CERTBOT}" = "true" || "${CERT_CHALLENGE_TYPE}" = "dns" ]]; then
48 |     # Cancel automically updating
49 |     rm -f /var/spool/cron/crontabs/root
50 | else
51 |     crond -c /var/spool/cron/crontabs -b -L /var/log/cron/cron.log
52 | fi
53 | 
54 | 
55 | # https://github.com/yandex/gixy#usage
56 | if [[ "${DISABLE_GIXY}" != "true" && -e /usr/bin/gixy ]]; then
57 |     # Note: Gixy will search all `include` directives
58 |     /usr/bin/gixy /etc/nginx/nginx.conf
59 | fi
60 | 
61 | # just check if the certification file exist
62 | /usr/bin/build-certs true true
63 | # create missing log
64 | check_log_files_for /etc/nginx/nginx.conf
65 | # and remove invaild ssl listen
66 | if [[ "${DISABLE_CERTBOT}" = "true" ]]; then
67 |     update_server_ssl_for /etc/nginx/nginx.conf
68 | fi
69 | 
70 | 
71 | export -f update_host_config_for
72 | CERT_BUILD_CMD="update_host_config_for /etc/nginx/nginx.conf; /usr/sbin/nginx -s reload"
73 | 
74 | if [[ "${CERT_CHALLENGE_TYPE}" = "dns" ]]; then
75 |     echo "The cert challenge type is set to DNS, you should run the script /usr/bin/build-certs interactively"
76 | else
77 |     CERT_BUILD_CMD="/usr/bin/build-certs ${DISABLE_CERTBOT} >> '${CERT_DIR}/build.log' 2>&1; ${CERT_BUILD_CMD}"
78 | fi
79 | /usr/bin/watch-config -- "${CERT_BUILD_CMD}" &
80 | 
81 | 
82 | NGINX=nginx
83 | if [[ "${DEBUG}" = "true" ]]; then
84 |     NGINX=nginx-debug
85 | fi
86 | 
87 | chown -R nginx /var/log/nginx
88 | 
89 | eval "${NGINX} -g \"daemon off;\""
90 | 


--------------------------------------------------------------------------------
/config/00_vars.conf:
--------------------------------------------------------------------------------
 1 | # https://gist.github.com/tmthrgd/3504859568e1dba9ee80e260f974a708
 2 | map $status $status_msg {
 3 |     default "An error occured";
 4 |     100 Continue;
 5 |     101 "Switching Protocols";
 6 |     102 Processing; # WebDAV; RFC 2518
 7 |     200 OK;
 8 |     201 Created;
 9 |     202 Accepted;
10 |     203 "Non-Authoritative Information";
11 |     204 "No Content";
12 |     205 "Reset Content";
13 |     206 "Partial Content";
14 |     207 Multi-Status; # WebDAV; RFC 4918
15 |     208 "Already Reported"; # WebDAV; RFC 5842
16 |     226 "IM Used"; # RFC 3229
17 |     300 "Multiple Choices";
18 |     301 "Moved Permanently";
19 |     302 Found;
20 |     303 "See Other";
21 |     304 "Not Modified";
22 |     305 "Use Proxy";
23 |     306 "Switch Proxy";
24 |     307 "Temporary Redirect";
25 |     308 "Permanent Redirect"; # RFC 7538
26 |     400 "Bad Request";
27 |     401 Unauthorized;
28 |     402 "Payment Required";
29 |     403 Forbidden;
30 |     404 "Not Found";
31 |     405 "Method Not Allowed";
32 |     406 "Not Acceptable";
33 |     407 "Proxy Authentication Required";
34 |     408 "Request Timeout";
35 |     409 Conflict;
36 |     410 Gone;
37 |     411 "Length Required";
38 |     412 "Precondition Failed";
39 |     413 "Request Entity Too Large";
40 |     414 "Request-URI Too Long";
41 |     415 "Unsupported Media Type";
42 |     416 "Requested Range Not Satisfiable";
43 |     417 "Expectation Failed";
44 |     418 "I'm a teapot"; # RFC 2324
45 |     419 "Authentication Timeout"; # not in RFC 2616
46 |     # 420 "Method Failure"; # Spring Framework
47 |     420 "Enhance Your Calm"; # Twitter
48 |     422 "Unprocessable Entity"; # WebDAV; RFC 4918
49 |     423 Locked; # WebDAV; RFC 4918
50 |     424 "Failed Dependency"; # WebDAV; RFC 4918
51 |     426 "Upgrade Required";
52 |     428 "Precondition Required"; # RFC 6585
53 |     429 "Too Many Requests"; # RFC 6585
54 |     431 "Request Header Fields Too Large"; # RFC 6585
55 |     440 "Login Timeout"; # Microsoft
56 |     444 "No Response"; # Nginx
57 |     449 "Retry With"; # Microsoft
58 |     450 "Blocked by Windows Parental Controls"; # Microsoft
59 |     451 "Unavailable For Legal Reasons"; # Internet draft
60 |     # 451 Redirect; # Microsoft
61 |     494 "Request Header Too Large"; # Nginx
62 |     495 "Cert Error"; # Nginx
63 |     496 "No Cert"; # Nginx
64 |     497 "HTTP to HTTPS"; # Nginx
65 |     498 "Token expired/invalid"; # Esri
66 |     499 "Client Closed Request"; # Nginx
67 |     # 499 "Token required"; # Esri
68 |     500 "Internal Server Error";
69 |     501 "Not Implemented";
70 |     502 "Bad Gateway";
71 |     503 "Service Unavailable";
72 |     504 "Gateway Timeout";
73 |     505 "HTTP Version Not Supported";
74 |     506 "Variant Also Negotiates"; # RFC 2295
75 |     507 "Insufficient Storage"; # WebDAV; RFC 4918
76 |     508 "Loop Detected"; # WebDAV; RFC 5842
77 |     509 "Bandwidth Limit Exceeded"; # Apache bw/limited extension
78 |     510 "Not Extended"; # RFC 2774
79 |     511 "Network Authentication Required"; # RFC 6585
80 |     598 "Network read timeout error"; # Unknown
81 |     599 "Network connect timeout error"; # Unknown
82 | }
83 | 


--------------------------------------------------------------------------------
/bin/nginx-utils.awk:
--------------------------------------------------------------------------------
 1 | BEGIN {
 2 |     cmd = "cat '" source_file "'"
 3 | 
 4 |     content_lines_index = 0
 5 |     current_block_index = 0
 6 |     while ( ( cmd | getline ) > 0 ) {
 7 |         line = $0
 8 | 
 9 |         content_lines_index += 1
10 |         content_lines[content_lines_index] = line
11 | 
12 |         if ( match(line, /^[^#]+\{/) ) {
13 |             current_block_index += 1
14 |         }
15 |         else if ( match(line, /^[[:space:]]*\}/) ) {
16 |             current_block_index += 1
17 |         }
18 |         # listen 443 ssl;
19 |         # listen [::]:443 ssl;
20 |         else if ( match(line, /^[[:space:]]*listen[[:space:]]+.+;/) ) {
21 |             listen_directive_block_indexes[content_lines_index] = current_block_index
22 |         }
23 |         else if ( match(line, /^[[:space:]]*include[[:space:]]+.+;/) ) {
24 |             include_file = line
25 |             # include /etc/nginx/vhost.d/<domain-name>/*.conf;
26 |             gsub(/^[[:space:]]*include[[:space:]]+|[[:space:]]*;.*$/, " ", include_file)
27 | 
28 |             file = include_files_in_block[current_block_index]
29 |             if ( file ) {
30 |                 include_files_in_block[current_block_index] = file " " include_file
31 |             } else {
32 |                 include_files_in_block[current_block_index] = include_file
33 |             }
34 |         }
35 |     }
36 |     close(cmd)
37 | 
38 |     for ( i = 1; i <= content_lines_index; i++ ) {
39 |         line = content_lines[i]
40 |         listen_directive_block_index = listen_directive_block_indexes[i]
41 | 
42 |         if ( ! ( listen_directive_block_index > 0 ) ) {
43 |             print line
44 |             continue
45 |         }
46 | 
47 |         listen_directive = line
48 |         # listen 443 ssl; # ssl enabled
49 |         if ( ! match(listen_directive, /[[:space:]]+ssl.*;|;[[:space:]]+#[[:space:]]+ssl enabled/) ) {
50 |             print listen_directive
51 |             continue
52 |         }
53 | 
54 |         include_files = include_files_in_block[listen_directive_block_index]
55 | 
56 |         is_ssl_exists = ssl_listen_enable_blocks[listen_directive_block_index] == "true"
57 |         if ( ! is_ssl_exists && include_files ) {
58 |             # The function 'is_server_ssl_existing_in' is defined in /usr/bin/nginx-utils.sh
59 |             ## https://unix.stackexchange.com/questions/72935/using-bash-shell-function-inside-awk#answer-417232
60 |             cmd = "bash -c 'is_server_ssl_existing_in " include_files "'"
61 |             cmd | getline ssl_exists_checking
62 |             close(cmd)
63 | 
64 |             if ( ssl_exists_checking == "true" ) {
65 |                 is_ssl_exists = 1 == 1
66 |             }
67 |         }
68 | 
69 |         if ( is_ssl_exists ) {
70 |             ssl_listen_enable_blocks[listen_directive_block_index] = "true"
71 | 
72 |             if ( ! match(listen_directive, /[[:space:]]+ssl.*;/) ) {
73 |                 gsub(/[[:space:]]*;/, " ssl;", listen_directive)
74 |             }
75 |         } else {
76 |             if ( match(listen_directive, /[[:space:]]+ssl.*;/) ) {
77 |                 gsub(/[[:space:]]+ssl/, "", listen_directive)
78 |             }
79 |         }
80 |         gsub(/;.*/, "; # ssl enabled", listen_directive)
81 | 
82 |         print listen_directive
83 |     }
84 | }
85 | 


--------------------------------------------------------------------------------
/examples/epage.d/all/13_Clock.html:
--------------------------------------------------------------------------------
  1 | <!-- Source from https://codepen.io/Maku2202/pen/MarRgK -->
  2 | <!DOCTYPE html>
  3 | <html>
  4 | <head>
  5 |     <meta charset="utf-8"/>
  6 |     <meta http-equiv="X-UA-Compatible" content="IE=Edge"/>
  7 |     <title>{{status}} - {{status_msg}}</title>
  8 |     <style type="text/css">
  9 |         * {
 10 |             margin: 0;
 11 |             padding: 0;
 12 |         }
 13 | 
 14 |         html, body {
 15 |             width: 100%;
 16 |             height: 100%;
 17 |             border: 0;
 18 |             overflow: hidden;
 19 |             font-size: 100%;
 20 |         }
 21 | 
 22 |         body {
 23 |             color: #333;
 24 |             text-align: center;
 25 |             background-color: #000;
 26 |         }
 27 | 
 28 |         a, a:visited, a:hover {
 29 |             text-decoration: none;
 30 |             color: #db5989;
 31 |         }
 32 | 
 33 |         a:hover {
 34 |             color: #a05772;
 35 |         }
 36 | 
 37 |         .heading {
 38 |             font-size: 2em;
 39 |             margin: 1em 0 0 0;
 40 |         }
 41 | 
 42 |         .heading footer {
 43 |             font-size: 1rem;
 44 |             color: #777;
 45 |         }
 46 |     </style>
 47 | </head>
 48 | <body>
 49 |     <div class="heading">
 50 |         <h1>{{status}} {{status_msg}}</h1>
 51 |         <footer>
 52 |             Animation based on
 53 |             <a href="https://codepen.io/Maku2202/pen/MarRgK">Canvas Clock</a>
 54 |             by <a href="https://codepen.io/Maku2202">Marco Antonio Aguilar Acuña</a>
 55 |         </footer>
 56 |     </div>
 57 |     <canvas id="clock_canvas" width="500" height="500"></canvas>
 58 | </body>
 59 | <script type="text/javascript">
 60 |     var canvas = document.getElementById("clock_canvas");
 61 |     var ctx = canvas.getContext("2d");
 62 | 
 63 |     ctx.strokeStyle = '#00ffff';
 64 |     ctx.lineWidth = 17;
 65 |     ctx.shadowBlur = 15;
 66 |     ctx.shadowColor = '#00ffff';
 67 | 
 68 |     function degToRad(degree) {
 69 |         var factor = Math.PI / 180;
 70 |         return degree * factor;
 71 |     }
 72 | 
 73 |     function renderTime() {
 74 |         var now = new Date();
 75 |         var today = now.toDateString();
 76 |         var time = now.toLocaleTimeString();
 77 |         var hrs = now.getHours();
 78 |         var min = now.getMinutes();
 79 |         var sec = now.getSeconds();
 80 |         var mil = now.getMilliseconds();
 81 |         var smoothsec = sec + (mil / 1000);
 82 |         var smoothmin = min + (smoothsec / 60);
 83 | 
 84 |         //Background
 85 |         var gradient = ctx.createRadialGradient(250, 250, 5, 250, 250, 300);
 86 |         gradient.addColorStop(0, "#03303a");
 87 |         gradient.addColorStop(1, "black");
 88 |         ctx.fillStyle = gradient;
 89 |         //ctx.fillStyle = 'rgba(00 ,00 , 00, 1)';
 90 |         ctx.fillRect(0, 0, 500, 500);
 91 |         //Hours
 92 |         ctx.beginPath();
 93 |         ctx.arc(250, 250, 200, degToRad(270), degToRad((hrs * 30) - 90));
 94 |         ctx.stroke();
 95 |         //Minutes
 96 |         ctx.beginPath();
 97 |         ctx.arc(250, 250, 170, degToRad(270), degToRad((smoothmin * 6) - 90));
 98 |         ctx.stroke();
 99 |         //Seconds
100 |         ctx.beginPath();
101 |         ctx.arc(250, 250, 140, degToRad(270), degToRad((smoothsec * 6) - 90));
102 |         ctx.stroke();
103 |         //Date
104 |         ctx.font = "25px Helvetica";
105 |         ctx.fillStyle = 'rgba(00, 255, 255, 1)';
106 |         ctx.fillText(today, 175, 250);
107 |         //Time
108 |         ctx.font = "25px Helvetica Bold";
109 |         ctx.fillStyle = 'rgba(00, 255, 255, 1)';
110 |         ctx.fillText(time + ":" + mil, 175, 280);
111 |     }
112 | 
113 |     setInterval(renderTime, 40);
114 | </script>
115 | </html>
116 | 


--------------------------------------------------------------------------------
/examples/epage.d/all/11_Matrix_Rain.html:
--------------------------------------------------------------------------------
  1 | <!-- Source from http://cssdeck.com/labs/the-matrix, https://codepen.io/The1462/full/FtBmy/ -->
  2 | <!DOCTYPE html>
  3 | <html>
  4 | <head>
  5 |     <meta charset="utf-8"/>
  6 |     <meta http-equiv="X-UA-Compatible" content="IE=Edge"/>
  7 |     <title>{{status}} - {{status_msg}}</title>
  8 |     <style type="text/css">
  9 |         * {
 10 |             margin: 0;
 11 |             padding: 0;
 12 |         }
 13 | 
 14 |         html, body {
 15 |             width: 100%;
 16 |             height: 100%;
 17 |             border: 0;
 18 |             overflow: hidden;
 19 |             font-size: 100%;
 20 |         }
 21 | 
 22 |         body {
 23 |             background: #000;
 24 |             color: #1d8a1f;
 25 |             display: flex;
 26 |             flex-direction: column;
 27 |             align-items: center;
 28 |             justify-content: center;
 29 |         }
 30 | 
 31 |         .message {
 32 |             color: #1d8a1f;
 33 |             min-width: 250px;
 34 |             max-width: 50%;
 35 |             padding: 10px;
 36 |             border: 1px solid #0d520e;
 37 |             background: #030302;
 38 |             z-index: 10;
 39 |         }
 40 | 
 41 |         .message h1 {
 42 |             font-size: 1.2em;
 43 |             border-bottom: 1px solid #0D520E;
 44 |             padding-bottom: .6em;
 45 |             margin-bottom: .8em;
 46 |         }
 47 | 
 48 |         .message footer {
 49 |             border-top: 1px solid #0D520E;
 50 |             margin-top: .8em;
 51 |             font-size: .6rem;
 52 |             padding-top: .6em;
 53 |             text-align: right;
 54 |         }
 55 | 
 56 |         .matrix {
 57 |             position: fixed;
 58 |             z-index: -1;
 59 |         }
 60 |     </style>
 61 | </head>
 62 | <body>
 63 |     <div class="message">
 64 |         <h1>An error has occurred: {{status}} {{status_msg}}</h1>
 65 |         <p>
 66 |             <b>Boy</b>: Do not try and bend the website. That's impossible. Instead... only try to realize the truth.
 67 |             <br>
 68 |             <b>Neo</b>: What truth?
 69 |             <br>
 70 |             <b>Boy</b>: Perhaps, the error cannot be fixed in a short time.
 71 |             <br>
 72 |             <b>Neo</b>: Oh, No!
 73 |             <br>
 74 |             <b>Boy</b>: Then you'll see, that it is not the website that bends, it is only yourself.
 75 |         </p>
 76 |         <footer>
 77 |             Animation based on
 78 |             <a href="http://cssdeck.com/labs/the-matrix">Matrix Canvas Code</a>
 79 |             (by <a href="http://cssdeck.com/user/shaundunne">Shaun Dunne</a>)
 80 |             and <a href="https://codepen.io/The1462/full/FtBmy/">Matrix Rain</a>
 81 |             (by <a href="https://codepen.io/The1462">Mustafa Zeytin</a>)
 82 |         </footer>
 83 |     </div>
 84 |     <canvas class="matrix" id="matrix_canvas"></canvas>
 85 | </body>
 86 | <script type="text/javascript">
 87 |     var canvas = document.getElementById('matrix_canvas');
 88 |     var width = canvas.width = window.screen.width;
 89 |     var height = canvas.height = window.screen.height;
 90 |     var letters = (new Array(256)).join(1).split('');
 91 | 
 92 |     var draw = function () {
 93 |         canvas.getContext('2d').fillStyle = 'rgba(0,0,0,.05)';
 94 |         canvas.getContext('2d').fillRect(0, 0, width, height);
 95 |         canvas.getContext('2d').fillStyle = '#0F0';
 96 |         letters.map(function (y, index) {
 97 |             var text = String.fromCharCode(3e4 + Math.random() * 33);
 98 |             var x = index * 10;
 99 | 
100 |             canvas.getContext('2d').fillText(text, x, y);
101 |             letters[index] = (y > 758 + Math.random() * 1e4) ? 0 : y + 10;
102 |         });
103 |     };
104 |     setInterval(draw, 33);
105 | </script>
106 | </html>
107 | 


--------------------------------------------------------------------------------
/bin/nginx-utils.sh:
--------------------------------------------------------------------------------
  1 | get_include_files_from() {
  2 |     local source="$1"
  3 | 
  4 |     for file in $(sed -E '/^\s*include /!d; s/^\s*include\s+([^ ;]+)\s*;/\1/g;' "$source"); do
  5 |         ls -1 $file 2>/dev/null
  6 |     done | sort | uniq
  7 | }
  8 | 
  9 | get_include_files_deeply_from() {
 10 |     local source="$1"
 11 | 
 12 |     for file in $(get_include_files_from "$source"); do
 13 |         echo "$file"
 14 | 
 15 |         get_include_files_deeply_from "$file"
 16 |     done | sort | uniq
 17 | }
 18 | 
 19 | get_server_names_from() {
 20 |     local source="$1"
 21 | 
 22 |     if [[ -d "$source" ]]; then
 23 |         source_content="$(cat "$source"/*.conf)"
 24 |     else
 25 |         source_content="$(cat "$source")"
 26 |     fi
 27 |     # https://stackoverflow.com/questions/32400933/how-can-i-list-all-vhosts-in-nginx#answer-46230868
 28 |     echo "$source_content" \
 29 |         | sed -r -e 's/[ \t]*$//' -e 's/^[ \t]*//' -e 's/^#.*$//' -e 's/[ \t]*#.*$//' -e '/^$/d' \
 30 |         | sed -e ':a;N;$!ba;s/\([^;\{\}]\)\n/\1 /g' \
 31 |         | grep -E 'server_name[ \t]' | grep -v '\$' | grep '\.' \
 32 |         | sed -r -e 's/(\S)[ \t]+(\S)/\1\n\2/g' -e 's/[\t ]//g' -e 's/;//' -e 's/server_name//' \
 33 |         | sed -e '/^$/d' -e 's/^\*\.//g' | sort | uniq
 34 | }
 35 | 
 36 | is_server_ssl_existing_in() {
 37 |     local ssl_files=( $(
 38 |         grep -Eh '^\s*(ssl_certificate|ssl_certificate_key|ssl_trusted_certificate)\s+/' "$@" \
 39 |             | sed -E 's/^\s*(ssl_certificate|ssl_certificate_key|ssl_trusted_certificate)\s+([^ ;]+).*;/\2/g;' \
 40 |             | sort | uniq
 41 |     ) )
 42 | 
 43 |     if [[ "${#ssl_files[@]}" = "0" ]]; then
 44 |         return
 45 |     fi
 46 | 
 47 |     for file in "${ssl_files[@]}"; do
 48 |         if [[ ! -f "$file" ]]; then
 49 |             return
 50 |         fi
 51 |     done
 52 |     echo "true"
 53 | }
 54 | 
 55 | check_log_files_for() {
 56 |     local source="$1"
 57 | 
 58 |     echo "Check log files for '$source'"
 59 |     local files=( "$source" )
 60 |     files+=( $(get_include_files_deeply_from "$source") )
 61 | 
 62 |     for log in $(grep -Eh '^\s*(error_log|access_log)\s+/' "${files[@]}" \
 63 |                     | sed -E 's/^\s*(error_log|access_log)\s+([^ ;]+).*;/\2/g;' \
 64 |                     | sort | uniq); do
 65 |         if [[ -f "$log" ]]; then
 66 |             echo "  - '$log' exists."
 67 |             continue
 68 |         fi
 69 | 
 70 |         local log_dir="$(dirname "$log")"
 71 |         if [[ "x$(echo "$log_dir" | grep '\$')" != "x" ]]; then
 72 |             echo "  - '$log_dir' is ignored."
 73 |             continue
 74 |         fi
 75 | 
 76 |         mkdir -p "$log_dir"
 77 | 
 78 |         if [[ "x$(echo "$log" | grep '\$')" != "x" ]]; then
 79 |             echo "  - '$log' is ignored."
 80 |             continue
 81 |         fi
 82 |         echo "  - '$log' is creating..."
 83 |         touch "$log" && chown nginx "$log_dir" && chmod go-rwx "$log_dir"
 84 |     done
 85 | }
 86 | 
 87 | update_server_ssl_for() {
 88 |     local source="$1"
 89 | 
 90 |     # export bash function to awk scripts
 91 |     export -f is_server_ssl_existing_in
 92 | 
 93 |     echo "Check ssl configuration for '$source'"
 94 |     local files=( "$source" )
 95 |     files+=( $(get_include_files_deeply_from "$source") )
 96 | 
 97 |     for conf in $(grep -El '^\s*server\s+\{' "${files[@]}" | sort | uniq); do
 98 |         local updated_conf_content="$(awk -v source_file="$conf" -f /usr/bin/nginx-utils.awk)"
 99 | 
100 |         if [[ "$(cat "$conf")" != "$updated_conf_content" ]]; then
101 |             echo "  - '$conf' is updating ..."
102 |             echo "$updated_conf_content" > "$conf"
103 |         else
104 |             echo "  - '$conf' is ignored."
105 |         fi
106 |     done
107 | }
108 | 
109 | update_host_config_for() {
110 |     local source="$1"
111 | 
112 |     check_log_files_for "$source"
113 |     update_server_ssl_for "$source"
114 | }
115 | 


--------------------------------------------------------------------------------
/examples/vhost.d/nexus3.example.com.conf:
--------------------------------------------------------------------------------
 1 | ##
 2 | # Nexus3 service proxy settings, and enable Single-Sign-On (SSO)
 3 | #
 4 | # Note: You need to install the [Nexus3 Keycloak Plugin](https://github.com/flytreeleft/nexus3-keycloak-plugin) first
 5 | ##
 6 | 
 7 | server {
 8 |     listen 443 ssl;
 9 |     listen [::]:443 ssl;
10 | 
11 |     server_name nexus3.example.com;
12 | 
13 |     include /etc/nginx/vhost.d/nexus3.example.com/*.conf;
14 | 
15 |     set $oidc_logout_path "/logout";
16 |     set $oidc_redirect_after_logout_uri "/";
17 | 
18 |     location / {
19 |         # Note: $http_host contains ip and port, but $host just contains ip only
20 |         proxy_set_header Host $http_host;
21 |         proxy_set_header X-Keycloak-Sec-Auth $http_x_remote_user:$http_x_remote_user_access_token;
22 |         # proxy_set_header Authorization $http_authorization;
23 |         # Note: make the HTTP header to be smaller
24 |         proxy_hide_header X-Remote-User-Access-Token;
25 | 
26 |         set $oidc_disabled "false";
27 |         # Disable OIDC when using maven client
28 |         if ($http_user_agent ~* "^(Apache-Maven|docker)/.+$") {
29 |             set $oidc_disabled "true";
30 |         }
31 |         # And disable OIDC when the header Authorization was specified
32 |         if ($http_authorization !~* "^$") {
33 |             set $oidc_disabled "true";
34 |         }
35 | 
36 |         set $oidc_realm "<keycloak realm>";
37 |         # Note: change the client id and secret to the actual value
38 |         set $oidc_client_id "<nexus3 client id>";
39 |         set $oidc_client_secret "<nexus3 client secret>";
40 |         set $oidc_discovery "http://<keycloak ip>:<keycloak port>/auth/realms/$oidc_realm/.well-known/openid-configuration";
41 |         access_by_lua_file /etc/nginx/vhost.d/oidc.lua;
42 | 
43 |         client_max_body_size 500M;
44 |         # Disable cache of assets
45 |         proxy_cache            off;
46 |         proxy_read_timeout     600;
47 |         proxy_connect_timeout  600;
48 | 
49 |         # Avoid to get address resolve error when starting
50 |         set $target http://<nexus3 ip>:<nexus3 port>;
51 |         proxy_pass  $target;
52 | 
53 |         sub_filter '</body>' '<script type="text/javascript">(function inject_logout() { var oidc_disabled = "$oidc_disabled"; if (oidc_disabled === "true") { return; } var dom = document.querySelectorAll("a[id^=\'nx-header-signout-\']")[0]; if (!dom) { setTimeout(inject_logout, 500); } else { dom.addEventListener("click", function (event) { event.stopPropagation(); window.location.href = "$oidc_logout_path"; }, true); }})();</script></body>';
54 |         sub_filter_once on;
55 | 
56 |         # Just for debugging, you may not want it
57 |         # header_filter_by_lua_block {
58 |         #     for key, value in pairs(ngx.resp.get_headers()) do
59 |         #         local val = type(value) == 'string' and {value} or value
60 |         #         for k, v in ipairs(val) do
61 |         #             for i=0, v:len(), 1024 do
62 |         #                 ngx.log(ngx.DEBUG, 'Response Header: '..key..' -> '..v:sub(i + 1, i + 1024))
63 |         #             end
64 |         #         end
65 |         #     end
66 |         #     for key, value in pairs(ngx.req.get_headers()) do
67 |         #         local val = type(value) == 'string' and {value} or value
68 |         #         for k, v in ipairs(val) do
69 |         #             for i=0, v:len(), 1024 do
70 |         #                 ngx.log(ngx.DEBUG, 'Request Header: '..key..' -> '..v:sub(i + 1, i + 1024))
71 |         #             end
72 |         #         end
73 |         #     end
74 |         # }
75 |     }
76 | 
77 |     # Override the logout action of Nexus
78 |     location /service/rapture/session {
79 |         if ($request_method ~* "^DELETE$") {
80 |             # Redirect to the internal logout url
81 |             return 302 $scheme://$http_host$oidc_logout_path;
82 |         }
83 |         # Login forbidden
84 |         return 403;
85 |     }
86 | }
87 | 


--------------------------------------------------------------------------------
/examples/epage.d/all/10_Newton_Cradle.html:
--------------------------------------------------------------------------------
  1 | <!-- Source from http://cssdeck.com/labs/css3-loader-newtons-cradle -->
  2 | <!DOCTYPE html>
  3 | <html>
  4 | <head>
  5 |     <meta charset="utf-8"/>
  6 |     <meta http-equiv="X-UA-Compatible" content="IE=Edge"/>
  7 |     <title>{{status}} - {{status_msg}}</title>
  8 |     <style type="text/css">
  9 |         * {
 10 |             margin: 0;
 11 |             padding: 0;
 12 |         }
 13 | 
 14 |         html, body {
 15 |             width: 100%;
 16 |             height: 100%;
 17 |             border: 0;
 18 |             overflow: hidden;
 19 |             font-size: 100%;
 20 |         }
 21 | 
 22 |         body {
 23 |             background: #ede9de;
 24 |             color: #333;
 25 |             text-align: center;
 26 |         }
 27 | 
 28 |         a, a:visited, a:hover {
 29 |             text-decoration: none;
 30 |             color: #db5989;
 31 |         }
 32 | 
 33 |         a:hover {
 34 |             color: #a05772;
 35 |         }
 36 | 
 37 |         .heading {
 38 |             font-size: 2em;
 39 |             margin: 1em 0 0 0;
 40 |         }
 41 | 
 42 |         .heading footer {
 43 |             font-size: 1rem;
 44 |             color: #777;
 45 |         }
 46 | 
 47 |         .cradle {
 48 |             display: inline-block;
 49 |         }
 50 | 
 51 |         .cord {
 52 |             padding-top: 100px;
 53 |             width: 15px;
 54 |             transform: rotate(0deg);
 55 |             transform-origin: 50% 50%;
 56 |             float: left;
 57 |         }
 58 | 
 59 |         .ball {
 60 |             background: #333;
 61 |             width: 15px;
 62 |             height: 15px;
 63 |             float: left;
 64 |             border-radius: 50%;
 65 |         }
 66 | 
 67 |         .shadows {
 68 |             clear: left;
 69 |             padding-top: 20px;
 70 |             margin-left: -2px;
 71 |         }
 72 | 
 73 |         .shadows div {
 74 |             float: left;
 75 |             margin-left: 2px;
 76 |             width: 13px;
 77 |             height: 3px;
 78 |             border-radius: 50%;
 79 |             box-shadow: 0 0 3px rgba(204, 204, 204, 0.3);
 80 |             background: rgba(204, 204, 204, 0.3);
 81 |         }
 82 | 
 83 |         .leftMove {
 84 |             animation: leftBall .5s ease-in-out 0s infinite alternate;
 85 |         }
 86 | 
 87 |         .rightMove {
 88 |             animation: rightBall .5s ease-in-out 0s infinite alternate;
 89 |         }
 90 | 
 91 |         .leftShadow {
 92 |             animation: leftShadowN .5s ease-in-out 0s infinite alternate;
 93 |         }
 94 | 
 95 |         .rightShadow {
 96 |             animation: rightShadowN .5s ease-in-out 0s infinite alternate;
 97 |         }
 98 | 
 99 |         @keyframes leftBall {
100 |             0% {
101 |                 transform: rotate(0deg) translateY(0px);
102 |             }
103 |             /*this pauses the ball at the begining*/
104 |             50% {
105 |                 transform: rotate(0deg) translateY(0px);
106 |             }
107 |             100% {
108 |                 transform: rotate(50deg) translateY(-20px);
109 |             }
110 |         }
111 | 
112 |         @keyframes rightBall {
113 |             0% {
114 |                 transform: rotate(-50deg) translateY(-20px);
115 |             }
116 |             /*this pauses the ball at the begining*/
117 |             50% {
118 |                 transform: rotate(0deg) translateY(0px);
119 |             }
120 |             100% {
121 |                 transform: rotate(0deg) translateY(0px) translateX(0px);
122 |             }
123 |         }
124 | 
125 |         @keyframes leftShadowN {
126 |             0% {
127 |                 transform: translateX(0px);
128 |             }
129 |             /*this pauses the ball at the begining*/
130 |             50% {
131 |                 transform: translateX(0px);
132 |             }
133 | 
134 |             100% {
135 |                 transform: translateX(-25px);
136 |             }
137 |         }
138 | 
139 |         @keyframes rightShadowN {
140 |             0% {
141 |                 transform: translateX(25px);
142 |             }
143 |             /*this pauses the ball at the begining*/
144 |             50% {
145 |                 transform: translateY(0px);
146 |             }
147 |             100% {
148 |                 transform: translateY(0px);
149 |             }
150 |         }
151 | 
152 |         .cord:nth-of-type(1) .ball {
153 |             background: #335672;
154 |         }
155 | 
156 |         .cord:nth-of-type(2) .ball {
157 |             background: #35506b;
158 |         }
159 | 
160 |         .cord:nth-of-type(3) .ball {
161 |             background: #5f4e60;
162 |         }
163 | 
164 |         .cord:nth-of-type(4) .ball {
165 |             background: #924a4e;
166 |         }
167 | 
168 |         .cord:nth-of-type(5) .ball {
169 |             background: #a73a33;
170 |         }
171 | 
172 |         .cord:nth-of-type(6) .ball {
173 |             background: #cf4231;
174 |         }
175 | 
176 |         .cord:nth-of-type(7) .ball {
177 |             background: #df3e2a;
178 |         }
179 |     </style>
180 | </head>
181 | <body>
182 |     <div class="heading">
183 |         <h1>{{status}} {{status_msg}}</h1>
184 |         <footer>
185 |             Animation based on
186 |             <a href="http://cssdeck.com/labs/css3-loader-newtons-cradle">Newton's Cradle</a>
187 |             by <a href="http://cssdeck.com/user/TNTbits">dlsooklb</a>
188 |         </footer>
189 |     </div>
190 |     <div class="container">
191 |         <div class="cradle">
192 |             <div class="cord leftMove">
193 |                 <div class="ball"></div>
194 |             </div>
195 |             <div class="cord">
196 |                 <div class="ball"></div>
197 |             </div>
198 |             <div class="cord">
199 |                 <div class="ball"></div>
200 |             </div>
201 |             <div class="cord">
202 |                 <div class="ball"></div>
203 |             </div>
204 |             <div class="cord">
205 |                 <div class="ball"></div>
206 |             </div>
207 |             <div class="cord">
208 |                 <div class="ball"></div>
209 |             </div>
210 |             <div class="cord rightMove">
211 |                 <div class="ball" id="first"></div>
212 |             </div>
213 |             <div class="shadows">
214 |                 <div class="leftShadow"></div>
215 |                 <div></div>
216 |                 <div></div>
217 |                 <div></div>
218 |                 <div></div>
219 |                 <div></div>
220 |                 <div class="rightShadow"></div>
221 |             </div>
222 |         </div>
223 |     </div>
224 | </body>
225 | </html>
226 | 


--------------------------------------------------------------------------------
/bin/build-certs:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | 
  3 | SHOULD_NOT_RUN_CERTBOT="$1"
  4 | DISABLE_DEBUG="$2"
  5 | 
  6 | VHOSTS="${VHOSTD}"
  7 | LOG="${NGINX_SITES_LOG}"
  8 | # NOTE: All cluster nodes should share challenges
  9 | LOCK="${CERT_DIR}/.lck"
 10 | 
 11 | . /usr/bin/nginx-utils.sh
 12 | 
 13 | 
 14 | # https://github.com/acmesh-official/acme.sh
 15 | ACME_CMD="acme.sh --issue \
 16 | --config-home '${CERT_DIR}/config' \
 17 | --accountemail '${CERT_EMAIL}' \
 18 | -w '${CERT_DIR}' -k 4096"
 19 | 
 20 | if [ "${CERT_STAGING}" = "true" ]; then
 21 |     ACME_CMD="${ACME_CMD} --staging"
 22 | fi
 23 | if [ "${CERT_CHALLENGE_TYPE}" = "alpn" ]; then
 24 |     ACME_CMD="${ACME_CMD} --alpn --tlsport 21443"
 25 | fi
 26 | if [ "${CERT_CHALLENGE_TYPE}" = "dns" ]; then
 27 |     ACME_CMD="${ACME_CMD} --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please"
 28 | fi
 29 | 
 30 | 
 31 | get_top_domains() {
 32 |     echo "$@" | sed -E 's/\s+/\n/g' | awk -F. '{
 33 |         if ( length($3) == 0 ) { print $1"."$2 }
 34 |         else if ( length($4) == 0 ) { print $2"."$3 }
 35 |         else if ( length($5) == 0 ) { print $2"."$3"."$4 }
 36 |         else if ( length($6) == 0 ) { print $2"."$3"."$4"."$5 }
 37 |     }'
 38 | }
 39 | 
 40 | get_domain_conf() {
 41 |     local domain="$1"
 42 |     local domain_conf="${VHOSTS}/${domain}.conf"
 43 | 
 44 |     if [ ! -e "${domain_conf}" ]; then
 45 |         domain_conf="$(grep -rl -E "\binclude .*/${domain}/.+;" ${VHOSTS}/*.conf | head -n 1)"
 46 |     fi
 47 |     if [ ! -e "${domain_conf}" ]; then
 48 |         echo ""
 49 |     else
 50 |         echo "${domain_conf}"
 51 |     fi
 52 | }
 53 | 
 54 | is_matched_domain_list() {
 55 |     local domain="$1"
 56 |     local domains=( "$2" )
 57 |     local top_domain=$(get_top_domains ${domain})
 58 | 
 59 |     local matched="false"
 60 |     for d in "${domains[@]}"; do
 61 |         if [[ "${top_domain}" = "${d}" || "${domain}" = "${d}" ]]; then
 62 |             matched="true"
 63 |             break
 64 |         fi
 65 |     done
 66 | 
 67 |     [[ "${matched}" = "true" ]]
 68 | }
 69 | 
 70 | update_ssl_confs() {
 71 |     local domain="$1"
 72 |     local domain_conf="$2"
 73 |     local domain_cert_dir="$3"
 74 |     local domain_sub_dir="${VHOSTS}/${domain}"
 75 |     local domain_log_dir="${LOG}/${domain}"
 76 | 
 77 |     mkdir -p "${domain_sub_dir}"
 78 | 
 79 |     echo "Create ${domain_sub_dir}/01_ssl.conf ..."
 80 |     cat > "${domain_sub_dir}/01_ssl.conf" <<EOF
 81 | # SSL and OCSP Stapling
 82 | ssl_stapling on;
 83 | ssl_stapling_verify on;
 84 | 
 85 | ssl_certificate ${domain_cert_dir}/fullchain.pem;
 86 | ssl_certificate_key ${domain_cert_dir}/privkey.pem;
 87 | ssl_trusted_certificate ${domain_cert_dir}/chain.pem;
 88 | EOF
 89 | 
 90 |     echo "Create ${domain_sub_dir}/02_log.conf ..."
 91 |     cat > "${domain_sub_dir}/02_log.conf" <<EOF
 92 | # Error and access log
 93 | error_log ${domain_log_dir}/error.log debug;
 94 | access_log ${domain_log_dir}/access\$logdate.log main;
 95 | EOF
 96 | 
 97 |     echo "Create ${domain_sub_dir}/03_epage.conf ..."
 98 |     cat > "${domain_sub_dir}/03_epage.conf" <<EOF
 99 | # Custom error page
100 | include /etc/nginx/epage.d/*.conf;
101 | EOF
102 | }
103 | 
104 | is_all_certs_existing_in() {
105 |     local cert_dir="$1"
106 |     local cert_files=(
107 |         "${cert_dir}/chain.pem"
108 |         "${cert_dir}/cert.pem"
109 |         "${cert_dir}/privkey.pem"
110 |         "${cert_dir}/fullchain.pem"
111 |     )
112 | 
113 |     local all_exists="true"
114 |     for cert in "${cert_files[@]}"; do
115 |         if [[ ! -f "${cert}" ]]; then
116 |             all_exists="false"
117 |             break
118 |         fi
119 |     done
120 | 
121 |     [[ "${all_exists}" = "true" ]]
122 | }
123 | 
124 | update_http_acme() {
125 |     local domain="$1"
126 |     local domain_conf="$2"
127 |     local domain_sub_dir="${VHOSTS}/${domain}"
128 |     local domain_log_dir="${LOG}/${domain}"
129 |     local domain_cert_dir="${CERT_DIR}/certs/${domain}"
130 | 
131 |     if is_all_certs_existing_in "${domain_cert_dir}"; then
132 |         # just make sure the ssl.conf exist
133 |         update_ssl_confs "${domain}" "${domain_conf}" "${domain_cert_dir}"
134 |         return
135 |     fi
136 | 
137 |     echo "Remove ${domain_sub_dir}/01_ssl.conf for new one ..."
138 |     rm -f "${domain_sub_dir}/01_ssl.conf"
139 | 
140 |     if [ "${SHOULD_NOT_RUN_CERTBOT}" = "true" ]; then
141 |         update_server_ssl_for "${domain_conf}"
142 |         return
143 |     fi
144 | 
145 |     if [ "${CERT_CHALLENGE_TYPE}" = "alpn" ]; then
146 |         if [ "x$(grep -E 'listen .*\b443\b' "${domain_conf}")" != "x" ]; then
147 |             sed -i -E 's/(listen .*)\b443\b(.*);/\120443\2;/g;' "${domain_conf}"
148 |         fi
149 |     fi
150 | 
151 |     # https://www.vermouthx.com/2018/09/16/acme-sh/
152 |     eval "${ACME_CMD} -d ${domain} \
153 |             --ca-file '${domain_cert_dir}/chain.pem' \
154 |             --cert-file '${domain_cert_dir}/cert.pem' \
155 |             --key-file '${domain_cert_dir}/privkey.pem' \
156 |             --fullchain-file '${domain_cert_dir}/fullchain.pem' \
157 |             2>/dev/null"
158 |     if [[ "$?" != "0" ]]; then
159 |         echo "Can not update certificate for ${domain}."
160 |         return
161 |     fi
162 | 
163 |     update_ssl_confs "${domain}" "${domain_conf}" "${domain_cert_dir}"
164 | }
165 | 
166 | update_dns_acme() {
167 |     local domain="$1"
168 |     local domain_cert_dir="${CERT_DIR}/certs/${domain}"
169 | 
170 |     if is_all_certs_existing_in "${domain_cert_dir}"; then
171 |         [[ 1 -eq 0 ]] # false
172 |         return
173 |     fi
174 | 
175 |     cmd="${ACME_CMD} -d ${domain} -d '*.${domain}'"
176 | 
177 |     eval "${cmd}" 2>&1 | sed '/integer expression expected/d'
178 | 
179 |     echo "Check if TXT is valid by running: dig -t TXT _acme-challenge.${domain}"
180 | 
181 |     read -p "Added TXT value for domain: _acme-challenge.${domain}? (Y/N): "  confirm
182 |     if [[ "${confirm}" != "Y" && "${confirm}" != "y" ]]; then
183 |         [[ 1 -eq 0 ]] # false
184 |         return
185 |     fi
186 | 
187 |     eval "${cmd} --renew" 2>/dev/null
188 |     if [[ "$?" != "0" ]]; then
189 |         [[ 1 -eq 0 ]] # false
190 |         return
191 |     fi
192 | 
193 |     eval "acme.sh \
194 |             --install-cert \
195 |             --config-home '${CERT_DIR}/config' \
196 |             -d ${domain} \
197 |             --ca-file '${domain_cert_dir}/chain.pem' \
198 |             --cert-file '${domain_cert_dir}/cert.pem' \
199 |             --key-file '${domain_cert_dir}/privkey.pem' \
200 |             --fullchain-file '${domain_cert_dir}/fullchain.pem'"
201 | 
202 |     [[ "$?" != "0" ]]
203 | }
204 | 
205 | 
206 | if [ -e ${LOCK} ]; then
207 |     echo "Other is updating certs now. Exit!"
208 |     exit 0
209 | else
210 |     touch ${LOCK}
211 | fi
212 | 
213 | 
214 | # include /etc/nginx/vhost.d/<domain-name>/*.conf;
215 | domains=( $(get_server_names_from "${VHOSTS}") )
216 | 
217 | http_mode_domains=( "${domains[@]}" )
218 | dns_mode_domains=( )
219 | if [ "${CERT_CHALLENGE_TYPE}" = "dns" ]; then
220 |     http_mode_domains=(  )
221 |     top_domains=(
222 |         $(get_top_domains ${domains[@]} | sort | uniq)
223 |     )
224 |     for top_domain in "${top_domains[@]}"; do
225 |         read -p "Use DNS acme mode for domain: *.${top_domain}? (Y/N): "  confirm
226 |         if [[ "${confirm}" != "Y" && "${confirm}" != "y" ]]; then
227 |             http_mode_domains+=( "${top_domain}" )
228 |             continue
229 |         fi
230 | 
231 |         echo "Update certificate in DNS mode for ${top_domain}."
232 |         if update_dns_acme "${top_domain}"; then
233 |             dns_mode_domains+=( "${top_domain}" )
234 |         fi
235 |     done
236 | fi
237 | 
238 | for domain in "${domains[@]}"; do
239 |     domain_sub_dir="${VHOSTS}/${domain}"
240 |     domain_conf="$(get_domain_conf "${domain}")"
241 | 
242 |     if [ "x${domain_conf}" = "x" ]; then
243 |         echo "No configuration file found for the domain ${domain}, skip it."
244 |         continue
245 |     fi
246 | 
247 |     if [[ "${domains[@]}" = "${http_mode_domains[@]}" ]] || is_matched_domain_list "${domain}" "${http_mode_domains[@]}"; then
248 |         if [ "${DISABLE_DEBUG}" != "true" ]; then
249 |             set -x
250 |         fi
251 |         update_http_acme "${domain}" "${domain_conf}"
252 |         set +x
253 |     elif is_matched_domain_list "${domain}" "${dns_mode_domains[@]}"; then
254 |         top_domain=$(get_top_domains ${domain})
255 |         domain_cert_dir="${CERT_DIR}/certs/${top_domain}"
256 | 
257 |         update_ssl_confs "${domain}" "${domain_conf}" "${domain_cert_dir}"
258 |     else
259 |         echo "Can not update certificate for ${domain}."
260 |     fi
261 | done
262 | 
263 | 
264 | chown -R nginx:nginx ${VHOSTS} ${CERT_DIR}/certs \
265 |     && chmod go-rw -R ${VHOSTS} ${CERT_DIR}/certs
266 | 
267 | rm ${LOCK}
268 | 


--------------------------------------------------------------------------------
/examples/vhost.d/oidc.lua:
--------------------------------------------------------------------------------
  1 | local http = require "resty.http"
  2 | local cjson = require "cjson"
  3 | 
  4 | -- <<<<<<<< Source from https://github.com/zmartzone/lua-resty-openidc/blob/v1.5.3/lib/resty/openidc.lua
  5 | local function openidc_parse_json_response(response)
  6 |     local err
  7 |     local res
  8 |     -- check the response from the OP
  9 |     if response.status ~= 200 then
 10 |         err = "response indicates failure, status="..response.status..", body="..response.body
 11 |     else
 12 |         -- decode the response and extract the JSON object
 13 |         res = cjson.decode(response.body)
 14 |         if not res then
 15 |             err = "JSON decoding failed"
 16 |         end
 17 |     end
 18 |     return res, err
 19 | end
 20 | 
 21 | local function openidc_cache_get(type, key)
 22 |     local dict = ngx.shared[type]
 23 |     local value
 24 |     local flags
 25 |     if dict then
 26 |         value, flags = dict:get(key)
 27 |         if value then ngx.log(ngx.DEBUG, "cache hit: type=", type, " key=", key) end
 28 |     end
 29 |     return value
 30 | end
 31 | 
 32 | local function openidc_cache_set(type, key, value, exp)
 33 |     local dict = ngx.shared[type]
 34 |     if dict then
 35 |         local success, err, forcible = dict:set(key, value, exp)
 36 |         ngx.log(ngx.DEBUG, "cache set: success=", success, " err=", err, " forcible=", forcible)
 37 |     end
 38 | end
 39 | 
 40 | local function openidc_discover(url, ssl_verify)
 41 |     ngx.log(ngx.DEBUG, "In openidc_discover - URL is "..url)
 42 | 
 43 |     local json, err
 44 |     local v = openidc_cache_get("discovery", url)
 45 |     if not v then
 46 |         ngx.log(ngx.DEBUG, "Discovery data not in cache. Making call to discovery endpoint")
 47 |         -- make the call to the discovery endpoint
 48 |         local httpc = http.new()
 49 |         local res, error = httpc:request_uri(url, {
 50 |             ssl_verify = (ssl_verify ~= "no")
 51 |         })
 52 |         if not res then
 53 |             err = "accessing discovery url ("..url..") failed: "..error
 54 |             ngx.log(ngx.ERR, err)
 55 |         else
 56 |             ngx.log(ngx.DEBUG, "Response data: "..res.body)
 57 |             json, err = openidc_parse_json_response(res)
 58 |             if json then
 59 |                 if string.sub(url, 1, string.len(json['issuer'])) == json['issuer'] then
 60 |                     openidc_cache_set("discovery", url, cjson.encode(json), 24 * 60 * 60)
 61 |                 else
 62 |                     err = "issuer field in Discovery data does not match URL"
 63 |                     json = nil
 64 |                 end
 65 |             else
 66 |                 err = "could not decode JSON from Discovery data"
 67 |             end
 68 |         end
 69 |     else
 70 |         json = cjson.decode(v)
 71 |     end
 72 | 
 73 |     return json, err
 74 | end
 75 | -- >>>>>> End
 76 | 
 77 | local function openidc_send_error(err)
 78 |     ngx.status = 500
 79 |     ngx.say(err)
 80 |     ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
 81 | end
 82 | 
 83 | local function openidc_backend_logout(opts, session_opts)
 84 |     local discovery, err = openidc_discover(opts.discovery, opts.ssl_verify)
 85 |     if err then
 86 |         return openidc_send_error(err)
 87 |     end
 88 | 
 89 |     local session = require("resty.session").open(session_opts)
 90 |     local id_token = session.data.enc_id_token
 91 | 
 92 |     local end_session_endpoint = discovery.end_session_endpoint or discovery.ping_end_session_endpoint
 93 |     local httpc = http.new()
 94 |     -- https://github.com/ledgetech/lua-resty-http#request
 95 |     local res, err = httpc:request_uri(end_session_endpoint, {
 96 |         method = "GET",
 97 |         query = {
 98 |             id_token_hint = id_token -- Pass encoded id_token
 99 |         },
100 |         ssl_verify = (ssl_verify ~= "no")
101 |     })
102 | 
103 |     if err then
104 |         return openidc_send_error(err)
105 |     end
106 |     session:destroy()
107 | 
108 |     if opts.redirect_after_logout_uri then
109 |         return ngx.redirect(opts.redirect_after_logout_uri)
110 |     else
111 |         ngx.header.content_type = "text/html"
112 |         ngx.say("<html><body>Logged Out</body></html>")
113 |         ngx.exit(ngx.OK)
114 |     end
115 | end
116 | 
117 | 
118 | local function oidc_check(opts, session_opts)
119 |     -- https://github.com/pingidentity/lua-resty-openidc#sample-configuration-for-google-signin
120 |     if ngx.var.oidc_ip_whitelist and ngx.var.remote_addr then
121 |         for ip in string.gmatch(ngx.var.oidc_ip_whitelist, '([^, ]+)') do
122 |             if ip == ngx.var.remote_addr then
123 |                 return
124 |             end
125 |         end
126 |     end
127 | 
128 |     -- Change the redirect uri to the root uri to prevent to get 500 error
129 |     local request_uri_args = ngx.req.get_uri_args()
130 |     if ngx.var.request_uri == opts.redirect_uri_path and (not request_uri_args.code or not request_uri_args.state) then
131 |         -- https://github.com/openresty/lua-nginx-module#ngxreqset_uri
132 |         -- Note: 1. 'jump=true' isn't allowed in 'access_by_lua' directive
133 |         --       2. 'ngx.req.set_uri' will not change the value of 'ngx.var.request_uri'
134 |         --ngx.req.set_uri("/", false)
135 |         return ngx.redirect("/")
136 |     end
137 | 
138 |     -- Do logout in the background
139 |     if ngx.var.request_uri == opts.logout_path then
140 |         return openidc_backend_logout(opts, session_opts)
141 |     end
142 | 
143 |     -- Do authenticate
144 |     local res, err = require("resty.openidc").authenticate(opts, nil, nil, session_opts)
145 |     if err then
146 |         ngx.status = 500
147 |         ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
148 |         return
149 |     end
150 | 
151 |     -- for key, value in pairs(ngx.req.get_headers()) do
152 |     --     local val = type(value) == 'string' and {value} or value
153 |     --     for k, v in ipairs(val) do
154 |     --         for i=0, v:len(), 1024 do
155 |     --             ngx.log(ngx.DEBUG, 'Request Header: '..key..' -> '..v:sub(i + 1, i + 1024))
156 |     --         end
157 |     --     end
158 |     -- end
159 | 
160 |     -- https://kubernetes.io/docs/admin/authentication/#authenticating-proxy
161 |     if res.id_token.sub then
162 |         -- Drop the old session to avoid to pass big cookie to the proxied backend
163 |         local cookie = ngx.req.get_headers()['Cookie'];
164 |         if string.match(cookie, "session_%d=") then
165 |             -- Note: ngx.log() will only print the first 2048 bytes for the long log
166 |             -- for i=0, cookie:len(), 1024 do
167 |             --     ngx.log(ngx.DEBUG, "old cookies: "..cookie:sub(i + 1, i + 1024))
168 |             -- end
169 |             -- Lua Regex Pattern: https://riptutorial.com/lua/topic/5829/pattern-matching
170 |             cookie = cookie:gsub('session=.-;', '')
171 |             ngx.req.set_header('Cookie', cookie)
172 |         end
173 | 
174 |         local username = res.id_token.username or res.id_token.preferred_username or (res.id_token.user and res.id_token.user.name)
175 |         ngx.req.set_header("X-Remote-User", username)
176 |         ngx.req.set_header("X-Remote-User-Access-Token", res.access_token)
177 | 
178 |         if res.id_token.groups then
179 |             for i, group in ipairs(res.id_token.groups) do
180 |                 ngx.req.set_header("X-Remote-Group", group)
181 |             end
182 |         end
183 |     else
184 |         ngx.req.clear_header("X-Remote-USER")
185 |         ngx.req.clear_header("X-Remote-GROUP")
186 |         ngx.req.clear_header("X-Remote-User-Access-Token")
187 |     end
188 | end
189 | 
190 | 
191 | if ngx.var.oidc_disabled == "true" then
192 |     return
193 | end
194 | 
195 | local opts = {
196 |     -- Redirect uri which doesn't exist and cannot be '/'
197 |     redirect_uri_path = "/redirect_uri",
198 |     discovery = ngx.var.oidc_discovery,
199 |     client_id = ngx.var.oidc_client_id,
200 |     client_secret = ngx.var.oidc_client_secret,
201 |     ssl_verify = ngx.var.oidc_ssl_verify or "no",
202 |     logout_path = ngx.var.oidc_logout_path,
203 |     redirect_after_logout_uri = ngx.var.oidc_redirect_after_logout_uri,
204 |     -- Prevent 'client_secret' to be nil:
205 |     -- https://github.com/pingidentity/lua-resty-openidc/blob/v1.5.3/lib/resty/openidc.lua#L353
206 |     token_endpoint_auth_method = "client_secret_post",
207 |     --refresh_session_interval = 900,
208 |     --access_token_expires_in = 3600,
209 |     --force_reauthorize = false
210 | }
211 | -- Set a fixed and unique session secret for every domain to prevent infinite redirect loop
212 | --   https://github.com/pingidentity/lua-resty-openidc/issues/32#issuecomment-273900768
213 | --   https://github.com/openresty/lua-nginx-module#set_by_lua
214 | local session_opts = {
215 |     secret = ngx.encode_base64(ngx.var.server_name):sub(0, 32)
216 | }
217 | 
218 | oidc_check(opts, session_opts)
219 | 


--------------------------------------------------------------------------------
/examples/vhost.d/repo.example.com.conf:
--------------------------------------------------------------------------------
  1 | ##
  2 | # Nexus3 service proxy settings
  3 | #
  4 | # Nexus3 supports to serve different repositories like npmjs, maven, docker, etc.
  5 | # Here, we create different domain site for different repositories and change
  6 | # the request URL via the directive 'rewrite'.
  7 | ##
  8 | 
  9 | server {
 10 |     listen 443 ssl;
 11 |     listen [::]:443 ssl;
 12 | 
 13 |     server_name repo.example.com;
 14 | 
 15 |     include /etc/nginx/vhost.d/repo.example.com/*.conf;
 16 | 
 17 |     proxy_cache off;
 18 | 
 19 |     location / {
 20 |         # Avoid to get address resolve error when starting
 21 |         set $target http://<nexus3 ip>:<nexus3 web port>;
 22 |         proxy_pass $target;
 23 |     }
 24 | }
 25 | 
 26 | ##
 27 | # https://dcr.example.com
 28 | #
 29 | # Repositories:
 30 | # - `docker-<remote repository>`(proxy): Proxy the offical or another public repository like
 31 | #   https://hub.docker.com/, https://gcr.io/, etc.
 32 | #   You can name them as `docker-docker.com` and `maven-gcr.io`.
 33 | # - `docker-public`(group): Group all `docker-<remote repository>` repositories. The HTTP port should be set.
 34 | # - `docker-hosted`(hosted): Host the private docker images. The HTTP port should be set.
 35 | #
 36 | # Proxies:
 37 | # - HEAD|POST|PUT|DELETE|PATCH https://dcr.example.com -> http://nexus3-web:<docker-hosted port>
 38 | # - GET https://dcr.example.com -> http://nexus3-web:<docker-public port>
 39 | #
 40 | # Usage:
 41 | # - Login: `docker login dcr.example.com`
 42 | # - Pull image: `docker pull dcr.example.com/<image name>:<image version>`
 43 | # - Push image: `docker push dcr.example.com/<image name>:<image version>`
 44 | ##
 45 | server {
 46 |     listen 443 ssl;
 47 |     listen [::]:443 ssl;
 48 | 
 49 |     server_name dcr.example.com;
 50 | 
 51 |     include /etc/nginx/vhost.d/dcr.example.com/*.conf;
 52 | 
 53 |     # Disable cache of assets
 54 |     proxy_cache            off;
 55 |     proxy_read_timeout     600;
 56 |     proxy_connect_timeout  600;
 57 | 
 58 |     client_max_body_size 500M;
 59 | 
 60 |     location / {
 61 |         if ($http_user_agent !~* "^docker/.+$") {
 62 |             return 301 $scheme://repo.example.com/#browse/browse/components:docker-public$request_uri;
 63 |         }
 64 | 
 65 |         set $nexus3 http://<nexus3 ip>;
 66 | 
 67 |         # docker pull dcr.example.com/xx-xx
 68 |         set $target $nexus3:<docker-public port>;
 69 | 
 70 |         # https://github.com/moby/moby/blob/7061b0f748c29ffd1e6852cdc5dd11f90840eb1c/daemon/logger/awslogs/cloudwatchlogs_test.go#L71
 71 |         # https://github.com/moby/moby/blob/master/client/image_pull.go
 72 |         # https://github.com/moby/moby/blob/master/client/image_push.go
 73 | 
 74 |         # NOTE: rewrite and proxy_pass should be put in the same block
 75 |         ## http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#rewrite
 76 |         # docker push dcr.example.com/xx-xx
 77 |         if ($request_method ~* "^HEAD|POST|PUT|DELETE|PATCH$") {
 78 |             set $target $nexus3:<docker-hosted port>;
 79 |         }
 80 | 
 81 |         proxy_pass $target;
 82 |     }
 83 | }
 84 | 
 85 | ##
 86 | # https://mvn.example.com
 87 | #
 88 | # Repositories:
 89 | # - `maven-<remote repository>`(proxy): Proxy the offical or another public repositoy like
 90 | #   http://central.maven.org/maven2/, https://repo.maven.apache.org/maven2/, etc.
 91 | #   You can name them as `maven-maven.org` and `maven-apache.org`.
 92 | # - `maven-pulic`(group): Group all `maven-<remote repository>` repositories.
 93 | # - `maven-hosted-releases`(hosted): Host the private release packages.
 94 | # - `maven-hosted-snapshots`(hosted): Host the private snapshot packages.
 95 | # - `maven-hosted`(group): Group the `maven-hosted-releases` and `maven-hosted-snapshots` repositories.
 96 | #
 97 | # Rewrites:
 98 | # - GET|HEAD https://mvn.example.com/public/ -> http://nexus3-web/repository/maven-public/
 99 | # - GET|HEAD https://mvn.example.com/hosted/ -> http://nexus3-web/repository/maven-hosted/
100 | # - GET|HEAD https://mvn.example.com/releases/ -> http://nexus3-web/repository/maven-hosted/
101 | # - GET|HEAD https://mvn.example.com/snapshots/ -> http://nexus3-web/repository/maven-hosted/
102 | # - POST|PUT https://mvn.example.com/releases/ -> http://nexus3-web/repository/maven-hosted-releases/
103 | # - POST|PUT https://mvn.example.com/snapshots/ -> http://nexus3-web/repository/maven-hosted-snapshots/
104 | ##
105 | server {
106 |     listen 443 ssl;
107 |     listen [::]:443 ssl;
108 | 
109 |     server_name mvn.example.com;
110 | 
111 |     include /etc/nginx/vhost.d/mvn.example.com/*.conf;
112 | 
113 |     # Redirect to the maven repository (named as 'maven-public') of Nexus3
114 |     location = / {
115 |         return 302 $scheme://repo.example.com/#browse/browse/components:maven-public/;
116 |     }
117 |     # Redirect to the target asset of Nexus3
118 |     location ~* ^/repository/maven-.+$ {
119 |         return 301 $scheme://repo.example.com$request_uri;
120 |     }
121 | 
122 |     # Disable cache of assets
123 |     proxy_cache            off;
124 |     proxy_read_timeout     300;
125 |     proxy_connect_timeout  300;
126 | 
127 |     client_max_body_size 500M;
128 | 
129 |     location / {
130 |         #access_by_lua_block {
131 |         #    local cjson = require("cjson")
132 |         #    -- Print the request headers
133 |         #    ngx.log(ngx.DEBUG, ngx.var.request_uri..", "..cjson.encode(ngx.req.get_headers()))
134 |         #}
135 | 
136 |         set $target http://<nexus3 ip>:<nexus3 web port>;
137 | 
138 |         # NOTE: rewrite and proxy_pass should be put in the same block
139 |         ## http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#rewrite
140 |         # we browse or `mvn compile`
141 |         if ($request_method ~* "^GET|HEAD$") {
142 |             rewrite ^/public/(.*)           /repository/maven-public/$1    break;
143 |             rewrite ^/hosted/(.*)           /repository/maven-hosted/$1    break;
144 |             rewrite ^/releases/(.*)         /repository/maven-hosted/$1    break;
145 |             rewrite ^/snapshots/(.*)        /repository/maven-hosted/$1    break;
146 |             proxy_pass      $target;
147 |             break;
148 |         }
149 | 
150 |         # `mvn deploy`
151 |         if ($request_method ~* "^POST|PUT$") {
152 |             rewrite ^/(releases|snapshots)/(.*)     /repository/maven-hosted-$1/$2   break;
153 |             proxy_pass      $target;
154 |             break;
155 |         }
156 |     }
157 | }
158 | 
159 | ##
160 | # https://npm.example.com
161 | #
162 | # Repositories:
163 | # - `npm-<remote repository>`(proxy): Proxy the offical or another public repositoy like
164 | #   https://registry.npmjs.org/, https://registry.npm.taobao.org/, etc.
165 | #   You can name them as `npm-npmjs.org` and `npm-taobao.org`.
166 | # - `npm-pulic`(group): Group all `npm-<remote repository>` repositories.
167 | # - `npm-hosted`(hosted): Host the private packages.
168 | #
169 | # Rewrites:
170 | # - GET https://npm.example.com/ -> http://nexus3-web/repository/npm-public/
171 | # - PUT|DELETE https://npm.example.com/ -> http://nexus3-web/repository/npm-hosted/
172 | #
173 | # Usage:
174 | # - Login: `npm login --registry=https://npm.example.com`
175 | # - Install modules: `npm --registry=https://npm.example.com install <module>`
176 | # - Publish module: `npm --registry=https://npm.example.com publish <folder>`
177 | # - Change global registry: `npm config set registry https://npm.example.com`
178 | ##
179 | server {
180 |     listen 443 ssl;
181 |     listen [::]:443 ssl;
182 | 
183 |     server_name npm.example.com;
184 | 
185 |     include /etc/nginx/vhost.d/npm.example.com/*.conf;
186 | 
187 |     # Redirect to the npm repository (named as 'npm-public') of Nexus3
188 |     location = / {
189 |         return 302 $scheme://repo.example.com/#browse/browse/components:npm-public/;
190 |     }
191 |     # Redirect to the target asset of Nexus3
192 |     location ~* ^/repository/npm-.+$ {
193 |         return 301 $scheme://repo.example.com$request_uri;
194 |     }
195 | 
196 |     # Disable cache of assets
197 |     proxy_cache            off;
198 |     proxy_read_timeout     60;
199 |     proxy_connect_timeout  60;
200 | 
201 |     client_max_body_size 50M;
202 | 
203 |     location / {
204 |         set $target http://<nexus3 ip>:<nexus3 web port>;
205 | 
206 |         # NOTE: rewrite and proxy_pass should be put in the same block
207 |         ## http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#rewrite
208 |         # we browse or `npm install`
209 |         if ($request_method ~* "^GET$") {
210 |             rewrite ^/(.+)      /repository/npm-public/$    break;
211 |             proxy_pass      $target;
212 |             break;
213 |         }
214 | 
215 |         # `npm publish`
216 |         if ($request_method ~* "^PUT|DELETE$") {
217 |             rewrite ^/(.+)      /repository/npm-hosted/$1   break;
218 |             proxy_pass      $target;
219 |             break;
220 |         }
221 |     }
222 | }
223 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | Nginx Gateway
  2 | ===============================
  3 | 
  4 | A tiny, flexable, configurable Nginx Gateway (reverse proxy) Docker image based on [alpine image](https://hub.docker.com/_/alpine/).
  5 | 
  6 | ## Features
  7 | 
  8 | - Enable HTTPS and [OCSP Stapling](https://tools.ietf.org/html/rfc4366#section-3.6) with [Let’s Encrypt](https://letsencrypt.org/).
  9 | - Automatically register [Let’s Encrypt](https://letsencrypt.org/) certificate for new domain and update certificates via [acme.sh](https://github.com/acmesh-official/acme.sh).
 10 | - Support to display your custom error pages randomly.
 11 | - Support to load and execute [Lua](https://github.com/openresty/lua-nginx-module) codes.
 12 | - Support to proxy HTTP and TCP stream.
 13 | - Make individual configuration for every domain to serve static files or to proxy the backend servers.
 14 | - Support to create multiple pod replicas in k8s.
 15 | - Support access log rotation, e.g. `access_2018-04-26.log`.
 16 | - Support authentication with OpenID (via [lua-resty-openidc](https://github.com/zmartzone/lua-resty-openidc)) and to add client IPs to the non-auth whitelist.
 17 | - Enable building image with [GeoIp2](https://github.com/leev/ngx_http_geoip2_module) or not.
 18 | - Integrated with [Gixy](https://github.com/yandex/gixy) to analyze Nginx configuration to prevent security misconfiguration and automate flaw detection.
 19 | 
 20 | ## How to use?
 21 | 
 22 | ### Image version
 23 | 
 24 | The image version is formated as `<nginx version>-r<revision number>[p<patch number>]`, e.g. `1.11.2-r1`, `1.11.2-r1p1`, `1.11.2-r2` etc.
 25 | 
 26 | ### Build image
 27 | 
 28 | Run the following commands in the root directory of this git repository:
 29 | 
 30 | ```bash
 31 | IMAGE_VERSION=1.15.12-r1
 32 | IMAGE_NAME=flytreeleft/nginx-gateway:${IMAGE_VERSION}
 33 | 
 34 | docker build --rm -t ${IMAGE_NAME} .
 35 | ```
 36 | 
 37 | If you want to enable [GeoIp2](https://github.com/leev/ngx_http_geoip2_module), just set the build argument `enable_geoip` to `true`:
 38 | 
 39 | ```bash
 40 | IMAGE_VERSION=1.15.12-r1
 41 | IMAGE_NAME=flytreeleft/nginx-gateway-with-geoip:${IMAGE_VERSION}
 42 | 
 43 | docker build --rm --build-arg enable_geoip=true -t ${IMAGE_NAME} .
 44 | ```
 45 | 
 46 | **Note**: You can run `docker pull flytreeleft/nginx-gateway` or `docker pull flytreeleft/nginx-gateway-with-geoip` to get the latest image from the [Docker Hub](https://hub.docker.com/u/flytreeleft).
 47 | 
 48 | ### Create and run
 49 | 
 50 | ```bash
 51 | DCR_IMAGE_VERSION=1.15.12-r1
 52 | 
 53 | DCR_NAME=nginx-gateway
 54 | DCR_IMAGE=flytreeleft/nginx-gateway:${DCR_IMAGE_VERSION}
 55 | 
 56 | DCR_VOLUME=/var/lib/nginx-gateway
 57 | 
 58 | DEBUG=false
 59 | ULIMIT=655360
 60 | ENABLE_CUSTOM_ERROR_PAGE=true
 61 | CERT_EMAIL=nobody@example.com
 62 | 
 63 | ulimit -n ${ULIMIT}
 64 | docker run -d --name ${DCR_NAME} \
 65 |                 --restart always \
 66 |                 --network host \
 67 |                 --ulimit nofile=${ULIMIT} \
 68 |                 -p 443:443 -p 80:80 \
 69 |                 -e DEBUG=${DEBUG} \
 70 |                 -e CERT_EMAIL=${CERT_EMAIL} \
 71 |                 -e ENABLE_CUSTOM_ERROR_PAGE=${ENABLE_CUSTOM_ERROR_PAGE} \
 72 |                 -e DISABLE_CERTBOT=false \
 73 |                 -e DISABLE_GIXY=false \
 74 |                 -v /usr/share/zoneinfo:/usr/share/zoneinfo:ro \
 75 |                 -v /etc/localtime:/etc/localtime:ro \
 76 |                 -v ${DCR_VOLUME}/logs:/var/log/nginx/sites \
 77 |                 -v ${DCR_VOLUME}/letsencrypt:/etc/letsencrypt \
 78 |                 -v ${DCR_VOLUME}/vhost.d:/etc/nginx/vhost.d \
 79 |                 -v ${DCR_VOLUME}/stream.d:/etc/nginx/stream.d \
 80 |                 -v ${DCR_VOLUME}/epage.d:/etc/nginx/epage.d \
 81 |                 ${DCR_IMAGE}
 82 | ```
 83 | 
 84 | **Note**:
 85 | - If you want to use your error pages, just set `ENABLE_CUSTOM_ERROR_PAGE` to `false`, and put your configuration (e.g. [config/error-pages/01_default.conf](./config/error-pages/01_default.conf)) and error pages to `${STORAGE}/epage.d`.
 86 | - Mapping `/usr/share/zoneinfo` and `/etc/localtime` from the host machine to make sure the container use the same Time Zone with the host.
 87 | - The access and error log will be put in the directory `/var/log/nginx/sites/{domain}`. The access log file will be named as `access_{date}.log` (e.g. `access_2018-04-26.log`), and the error log will be named as `error.log`.
 88 | - Set `DISABLE_CERTBOT` to `true` if you want to disable [certbot](https://certbot.eff.org/docs/using.html) to register or update [Let’s Encrypt](https://letsencrypt.org/) certificate automatically. If certbot is disabled, you can run `$ docker exec -it nginx-gateway sh -c '/usr/bin/build-certs && /usr/sbin/nginx -s reload'` to update **Let’s Encrypt** certificate manually.
 89 | - Set `DISABLE_GIXY` to `true` if you don't want to run Gixy to check Nginx configuration files when they are changed. Otherwise, you can run `docker logs --tail 100 ${DCR_NAME}` to check the detection results.
 90 | 
 91 | ## How to configure your site?
 92 | 
 93 | There are some examples in [examples/vhost.d](./examples/vhost.d) for different needs.
 94 | 
 95 | In [config/10_default.conf](./config/10_default.conf), all HTTP requests will be redirected to HTTPS,
 96 | so you just need to listen on `443` and configure for you HTTPS site which is like the following codes:
 97 | ```nginx
 98 | server {
 99 |     listen 443 ssl;
100 |     listen [::]:443 ssl;
101 | 
102 |     server_name <your-domain>;
103 | 
104 |     # Note: The additional configuration files (for ssl, log, etc.) which are generated automatically
105 |     # will be put into the fixed location as '/etc/nginx/vhost.d/<your-domain>',
106 |     # so do not change it.
107 |     include /etc/nginx/vhost.d/<your-domain>/*.conf;
108 | 
109 |     location / {
110 |         # Avoid to get address resolve error when starting
111 |         set $target http://<proxy to backend>:80;
112 |         proxy_pass  $target;
113 |     }
114 | }
115 | ```
116 | 
117 | Also, you can put the global and default settings in one file (e.g. [vhost.d/00_default.conf](./examples/vhost.d/00_default.conf)),
118 | just make sure it will be loaded before the other site configuration files. Here are some usefull configurations:
119 | ```nginx
120 | resolver 8.8.8.8 valid=300s;
121 | resolver_timeout 5s;
122 | 
123 | # Websocket support
124 | proxy_http_version 1.1;
125 | proxy_set_header Upgrade $http_upgrade;
126 | proxy_set_header Connection "upgrade";
127 | 
128 | # Force to change the redirect url's scheme to https
129 | proxy_redirect   http:// $scheme://;
130 | proxy_redirect     / /;
131 | ```
132 | 
133 | For other needs, see details in:
134 | - [Enable upload big files to your site](./examples/vhost.d/git.example.com.conf)
135 | - [The Nexus3 repository sites for Docker images and the library packages of Maven, NPM, etc.](./examples/vhost.d/repo.example.com.conf)
136 | - [Proxy the static files behind the firewall](./examples/vhost.d/static.example.com.conf)
137 | - [Enable the HTTP Basic Authentication or OpenID](./examples/vhost.d/wiki.example.com.conf)
138 | - [Proxy the TCP streams](./examples/stream.d/mysql.conf)
139 | 
140 | ## Thanks
141 | 
142 | - [nginxinc/docker-nginx](https://github.com/nginxinc/docker-nginx/blob/master/stable/alpine/Dockerfile): The official NGINX Dockerfiles based on [alpine image](https://hub.docker.com/_/alpine/).
143 | - [sebble/docker-images/letsencrypt-certbot](https://github.com/sebble/docker-images/tree/master/letsencrypt-certbot): Running [certbot](https://certbot.eff.org/docs/using.html) via crontab.
144 | - [nrollr/nginx.conf](https://gist.github.com/nrollr/9a39bb636a820fb97eec2ed85e473d38): NGINX config for SSL with Let's Encrypt certs.
145 | - [JrCs/docker-letsencrypt-nginx-proxy-companion](https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion): LetsEncrypt companion container for nginx-proxy.
146 | - [tmthrgd/nginx-status-text.conf](https://gist.github.com/tmthrgd/3504859568e1dba9ee80e260f974a708): Nginx status code to message map.
147 | - [Using NGINX’s X-Accel with Remote URLs](https://www.mediasuite.co.nz/blog/proxying-s3-downloads-nginx/)
148 | - [How to make an existing caching Nginx proxy use another proxy to bypass a firewall?](https://serverfault.com/questions/583743/how-to-make-an-existing-caching-nginx-proxy-use-another-proxy-to-bypass-a-firewa#683955)
149 | - [nginx docker container cannot see client ip when using '--iptables=false' option](http://serverfault.com/questions/786389/nginx-docker-container-cannot-see-client-ip-when-using-iptables-false-option#answer-788088)
150 | - [Log rotation directly within Nginx configuration file](https://www.cambus.net/log-rotation-directly-within-nginx-configuration-file/): Using variables in `access_log` directives to rotate access log. Note: embed variables can not be used in `error_log` directives.
151 | - [Log rotation directly within Nginx configuration file: map instead of if](https://github.com/fcambus/nginx-resources/issues/12): Using `map` directives instead of `if` for rotating access log.
152 | - [zmartzone/lua-resty-openidc](https://github.com/zmartzone/lua-resty-openidc): Give a way to enable OpenID authentication for Nginx.
153 | - [Gixy](https://github.com/yandex/gixy): A tool to analyze Nginx configuration to prevent security misconfiguration.
154 | 
155 | ## Reference
156 | 
157 | - [Nginx ssl_stapling](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling)
158 | - [Nginx alias](http://nginx.org/en/docs/http/ngx_http_core_module.html#alias): Used to change the directory path of the request file.
159 | - [Nginx sub_filter](http://nginx.org/en/docs/http/ngx_http_sub_module.html#sub_filter): Filter and modify the response body.
160 | - [Nginx error_page](http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page): Define the error page or URI.
161 | - [Nginx random_index](http://nginx.org/en/docs/http/ngx_http_random_index_module.html#random_index): Picks a random file in a directory to serve as an index file.
162 | - [Nginx proxy_intercept_errors](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_intercept_errors): Intercept proxy errors and redirected them to nginx for processing with the `error_page` directive.
163 | - [Nginx proxy_hide_header](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header): Hide the headers from the response of a proxied server to a client.
164 | - [Nginx variables](http://nginx.org/en/docs/varindex.html)
165 | - [Nginx log_format&access_log](http://nginx.org/en/docs/http/ngx_http_log_module.html)
166 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                                  Apache License
  2 |                            Version 2.0, January 2004
  3 |                         http://www.apache.org/licenses/
  4 | 
  5 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  6 | 
  7 |    1. Definitions.
  8 | 
  9 |       "License" shall mean the terms and conditions for use, reproduction,
 10 |       and distribution as defined by Sections 1 through 9 of this document.
 11 | 
 12 |       "Licensor" shall mean the copyright owner or entity authorized by
 13 |       the copyright owner that is granting the License.
 14 | 
 15 |       "Legal Entity" shall mean the union of the acting entity and all
 16 |       other entities that control, are controlled by, or are under common
 17 |       control with that entity. For the purposes of this definition,
 18 |       "control" means (i) the power, direct or indirect, to cause the
 19 |       direction or management of such entity, whether by contract or
 20 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 21 |       outstanding shares, or (iii) beneficial ownership of such entity.
 22 | 
 23 |       "You" (or "Your") shall mean an individual or Legal Entity
 24 |       exercising permissions granted by this License.
 25 | 
 26 |       "Source" form shall mean the preferred form for making modifications,
 27 |       including but not limited to software source code, documentation
 28 |       source, and configuration files.
 29 | 
 30 |       "Object" form shall mean any form resulting from mechanical
 31 |       transformation or translation of a Source form, including but
 32 |       not limited to compiled object code, generated documentation,
 33 |       and conversions to other media types.
 34 | 
 35 |       "Work" shall mean the work of authorship, whether in Source or
 36 |       Object form, made available under the License, as indicated by a
 37 |       copyright notice that is included in or attached to the work
 38 |       (an example is provided in the Appendix below).
 39 | 
 40 |       "Derivative Works" shall mean any work, whether in Source or Object
 41 |       form, that is based on (or derived from) the Work and for which the
 42 |       editorial revisions, annotations, elaborations, or other modifications
 43 |       represent, as a whole, an original work of authorship. For the purposes
 44 |       of this License, Derivative Works shall not include works that remain
 45 |       separable from, or merely link (or bind by name) to the interfaces of,
 46 |       the Work and Derivative Works thereof.
 47 | 
 48 |       "Contribution" shall mean any work of authorship, including
 49 |       the original version of the Work and any modifications or additions
 50 |       to that Work or Derivative Works thereof, that is intentionally
 51 |       submitted to Licensor for inclusion in the Work by the copyright owner
 52 |       or by an individual or Legal Entity authorized to submit on behalf of
 53 |       the copyright owner. For the purposes of this definition, "submitted"
 54 |       means any form of electronic, verbal, or written communication sent
 55 |       to the Licensor or its representatives, including but not limited to
 56 |       communication on electronic mailing lists, source code control systems,
 57 |       and issue tracking systems that are managed by, or on behalf of, the
 58 |       Licensor for the purpose of discussing and improving the Work, but
 59 |       excluding communication that is conspicuously marked or otherwise
 60 |       designated in writing by the copyright owner as "Not a Contribution."
 61 | 
 62 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 63 |       on behalf of whom a Contribution has been received by Licensor and
 64 |       subsequently incorporated within the Work.
 65 | 
 66 |    2. Grant of Copyright License. Subject to the terms and conditions of
 67 |       this License, each Contributor hereby grants to You a perpetual,
 68 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 69 |       copyright license to reproduce, prepare Derivative Works of,
 70 |       publicly display, publicly perform, sublicense, and distribute the
 71 |       Work and such Derivative Works in Source or Object form.
 72 | 
 73 |    3. Grant of Patent License. Subject to the terms and conditions of
 74 |       this License, each Contributor hereby grants to You a perpetual,
 75 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 76 |       (except as stated in this section) patent license to make, have made,
 77 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 78 |       where such license applies only to those patent claims licensable
 79 |       by such Contributor that are necessarily infringed by their
 80 |       Contribution(s) alone or by combination of their Contribution(s)
 81 |       with the Work to which such Contribution(s) was submitted. If You
 82 |       institute patent litigation against any entity (including a
 83 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 84 |       or a Contribution incorporated within the Work constitutes direct
 85 |       or contributory patent infringement, then any patent licenses
 86 |       granted to You under this License for that Work shall terminate
 87 |       as of the date such litigation is filed.
 88 | 
 89 |    4. Redistribution. You may reproduce and distribute copies of the
 90 |       Work or Derivative Works thereof in any medium, with or without
 91 |       modifications, and in Source or Object form, provided that You
 92 |       meet the following conditions:
 93 | 
 94 |       (a) You must give any other recipients of the Work or
 95 |           Derivative Works a copy of this License; and
 96 | 
 97 |       (b) You must cause any modified files to carry prominent notices
 98 |           stating that You changed the files; and
 99 | 
100 |       (c) You must retain, in the Source form of any Derivative Works
101 |           that You distribute, all copyright, patent, trademark, and
102 |           attribution notices from the Source form of the Work,
103 |           excluding those notices that do not pertain to any part of
104 |           the Derivative Works; and
105 | 
106 |       (d) If the Work includes a "NOTICE" text file as part of its
107 |           distribution, then any Derivative Works that You distribute must
108 |           include a readable copy of the attribution notices contained
109 |           within such NOTICE file, excluding those notices that do not
110 |           pertain to any part of the Derivative Works, in at least one
111 |           of the following places: within a NOTICE text file distributed
112 |           as part of the Derivative Works; within the Source form or
113 |           documentation, if provided along with the Derivative Works; or,
114 |           within a display generated by the Derivative Works, if and
115 |           wherever such third-party notices normally appear. The contents
116 |           of the NOTICE file are for informational purposes only and
117 |           do not modify the License. You may add Your own attribution
118 |           notices within Derivative Works that You distribute, alongside
119 |           or as an addendum to the NOTICE text from the Work, provided
120 |           that such additional attribution notices cannot be construed
121 |           as modifying the License.
122 | 
123 |       You may add Your own copyright statement to Your modifications and
124 |       may provide additional or different license terms and conditions
125 |       for use, reproduction, or distribution of Your modifications, or
126 |       for any such Derivative Works as a whole, provided Your use,
127 |       reproduction, and distribution of the Work otherwise complies with
128 |       the conditions stated in this License.
129 | 
130 |    5. Submission of Contributions. Unless You explicitly state otherwise,
131 |       any Contribution intentionally submitted for inclusion in the Work
132 |       by You to the Licensor shall be under the terms and conditions of
133 |       this License, without any additional terms or conditions.
134 |       Notwithstanding the above, nothing herein shall supersede or modify
135 |       the terms of any separate license agreement you may have executed
136 |       with Licensor regarding such Contributions.
137 | 
138 |    6. Trademarks. This License does not grant permission to use the trade
139 |       names, trademarks, service marks, or product names of the Licensor,
140 |       except as required for reasonable and customary use in describing the
141 |       origin of the Work and reproducing the content of the NOTICE file.
142 | 
143 |    7. Disclaimer of Warranty. Unless required by applicable law or
144 |       agreed to in writing, Licensor provides the Work (and each
145 |       Contributor provides its Contributions) on an "AS IS" BASIS,
146 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 |       implied, including, without limitation, any warranties or conditions
148 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 |       PARTICULAR PURPOSE. You are solely responsible for determining the
150 |       appropriateness of using or redistributing the Work and assume any
151 |       risks associated with Your exercise of permissions under this License.
152 | 
153 |    8. Limitation of Liability. In no event and under no legal theory,
154 |       whether in tort (including negligence), contract, or otherwise,
155 |       unless required by applicable law (such as deliberate and grossly
156 |       negligent acts) or agreed to in writing, shall any Contributor be
157 |       liable to You for damages, including any direct, indirect, special,
158 |       incidental, or consequential damages of any character arising as a
159 |       result of this License or out of the use or inability to use the
160 |       Work (including but not limited to damages for loss of goodwill,
161 |       work stoppage, computer failure or malfunction, or any and all
162 |       other commercial damages or losses), even if such Contributor
163 |       has been advised of the possibility of such damages.
164 | 
165 |    9. Accepting Warranty or Additional Liability. While redistributing
166 |       the Work or Derivative Works thereof, You may choose to offer,
167 |       and charge a fee for, acceptance of support, warranty, indemnity,
168 |       or other liability obligations and/or rights consistent with this
169 |       License. However, in accepting such obligations, You may act only
170 |       on Your own behalf and on Your sole responsibility, not on behalf
171 |       of any other Contributor, and only if You agree to indemnify,
172 |       defend, and hold each Contributor harmless for any liability
173 |       incurred by, or claims asserted against, such Contributor by reason
174 |       of your accepting any such warranty or additional liability.
175 | 
176 |    END OF TERMS AND CONDITIONS
177 | 
178 |    APPENDIX: How to apply the Apache License to your work.
179 | 
180 |       To apply the Apache License to your work, attach the following
181 |       boilerplate notice, with the fields enclosed by brackets "[]"
182 |       replaced with your own identifying information. (Don't include
183 |       the brackets!)  The text should be enclosed in the appropriate
184 |       comment syntax for the file format. We also recommend that a
185 |       file or class name and description of purpose be included on the
186 |       same "printed page" as the copyright notice for easier
187 |       identification within third-party archives.
188 | 
189 |    Copyright [yyyy] [name of copyright owner]
190 | 
191 |    Licensed under the Apache License, Version 2.0 (the "License");
192 |    you may not use this file except in compliance with the License.
193 |    You may obtain a copy of the License at
194 | 
195 |        http://www.apache.org/licenses/LICENSE-2.0
196 | 
197 |    Unless required by applicable law or agreed to in writing, software
198 |    distributed under the License is distributed on an "AS IS" BASIS,
199 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 |    See the License for the specific language governing permissions and
201 |    limitations under the License.
202 | 


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
  1 | # https://github.com/nginxinc/docker-nginx/blob/master/mainline/alpine/Dockerfile
  2 | FROM alpine:3.10
  3 | LABEL author="flytreeleft@crazydan.org"
  4 | 
  5 | 
  6 | ENV LUA_JIT_VERSION 2.1-20190912
  7 | ENV LUA_ROCKS_VERSION 3.2.1
  8 | ENV LUA_RESTY_LRUCACHE_VERSION 0.09
  9 | ENV LUA_RESTY_CORE_VERSION 0.1.17
 10 | ENV LUA_RESTY_STRING_VERSION 0.11
 11 | 
 12 | ENV NGINX_VERSION 1.15.12
 13 | ENV NDK_VERSION 0.3.1
 14 | ENV NGX_LUA_VERSION 0.10.15
 15 | ENV NGX_GEOIP2_VERSION 2.0
 16 | 
 17 | RUN GPG_KEYS=B0F4253373F8F6F510D42178520A9993A1C052F8 \
 18 |     && CONFIG="\
 19 |         --prefix=/etc/nginx \
 20 |         --sbin-path=/usr/sbin/nginx \
 21 |         --modules-path=/usr/lib/nginx/modules \
 22 |         --conf-path=/etc/nginx/nginx.conf \
 23 |         --error-log-path=/var/log/nginx/error.log \
 24 |         --http-log-path=/var/log/nginx/access.log \
 25 |         --pid-path=/var/run/nginx.pid \
 26 |         --lock-path=/var/run/nginx.lock \
 27 |         --http-client-body-temp-path=/var/cache/nginx/client_temp \
 28 |         --http-proxy-temp-path=/var/cache/nginx/proxy_temp \
 29 |         --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
 30 |         --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
 31 |         --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
 32 |         --user=nginx \
 33 |         --group=nginx \
 34 |         --with-ipv6 \
 35 |         --with-http_ssl_module \
 36 |         --with-http_realip_module \
 37 |         --with-http_addition_module \
 38 |         --with-http_sub_module \
 39 |         --with-http_dav_module \
 40 |         --with-http_flv_module \
 41 |         --with-http_mp4_module \
 42 |         --with-http_gunzip_module \
 43 |         --with-http_gzip_static_module \
 44 |         --with-http_random_index_module \
 45 |         --with-http_secure_link_module \
 46 |         --with-http_stub_status_module \
 47 |         --with-http_auth_request_module \
 48 |         --with-http_xslt_module=dynamic \
 49 |         --with-http_image_filter_module=dynamic \
 50 |         --with-threads \
 51 |         --with-stream \
 52 |         --with-stream_ssl_module \
 53 |         --with-stream_ssl_preread_module \
 54 |         --with-http_slice_module \
 55 |         --with-mail \
 56 |         --with-mail_ssl_module \
 57 |         --with-file-aio \
 58 |         --with-http_v2_module \
 59 |     " \
 60 |     && apk add --update --no-cache openssl ca-certificates bash curl \
 61 |     && update-ca-certificates \
 62 |     && addgroup -S nginx \
 63 |     && adduser -D -S -h /var/cache/nginx -s /sbin/nologin -G nginx nginx \
 64 |     && apk add --no-cache --virtual .build-deps \
 65 |         git \
 66 |         gcc \
 67 |         libc-dev \
 68 |         make \
 69 |         openssl-dev \
 70 |         pcre-dev \
 71 |         zlib-dev \
 72 |         linux-headers \
 73 |         unzip \
 74 |         gnupg \
 75 |         libxslt-dev \
 76 |         gd-dev \
 77 |         libmaxminddb \
 78 |         libmaxminddb-dev \
 79 |     && curl -fSL https://github.com/openresty/luajit2/archive/v$LUA_JIT_VERSION.tar.gz  -o lua-jit.tar.gz \
 80 |     && curl -fSL https://github.com/luarocks/luarocks/archive/v$LUA_ROCKS_VERSION.tar.gz  -o lua-rocks.tar.gz \
 81 |     && curl -fSL https://github.com/openresty/lua-resty-lrucache/archive/v$LUA_RESTY_LRUCACHE_VERSION.tar.gz  -o lua-resty-lrucache.tar.gz \
 82 |     && curl -fSL https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE_VERSION.tar.gz  -o lua-resty-core.tar.gz \
 83 |     && curl -fSL https://github.com/openresty/lua-resty-string/archive/v$LUA_RESTY_STRING_VERSION.tar.gz  -o lua-resty-string.tar.gz \
 84 |     && curl -fSL http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz -o nginx.tar.gz \
 85 |     && curl -fSL http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz.asc  -o nginx.tar.gz.asc \
 86 |     && curl -fSL https://github.com/simpl/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz  -o ngx_devel_kit.tar.gz \
 87 |     && curl -fSL https://github.com/openresty/lua-nginx-module/archive/v$NGX_LUA_VERSION.tar.gz  -o lua-nginx-module.tar.gz \
 88 |     && curl -fSL https://github.com/leev/ngx_http_geoip2_module/archive/$NGX_GEOIP2_VERSION.tar.gz  -o ngx_http_geoip2_module.tar.gz \
 89 |     && export GNUPGHOME="$(mktemp -d)" \
 90 |     && found=''; \
 91 |     for server in \
 92 |         ha.pool.sks-keyservers.net \
 93 |         hkp://keyserver.ubuntu.com:80 \
 94 |         hkp://p80.pool.sks-keyservers.net:80 \
 95 |         pgp.mit.edu \
 96 |     ; do \
 97 |         echo "Fetching GPG key $GPG_KEYS from $server"; \
 98 |         gpg --keyserver "$server" --keyserver-options timeout=10 --recv-keys "$GPG_KEYS" && found=yes && break; \
 99 |     done; \
100 |     test -z "$found" && echo >&2 "error: failed to fetch GPG key $GPG_KEYS" && exit 1; \
101 |     gpg --batch --verify nginx.tar.gz.asc nginx.tar.gz \
102 |     && rm -r "$GNUPGHOME" nginx.tar.gz.asc \
103 |     && mkdir -p /usr/src \
104 |     && tar -zxC /usr/src -f lua-jit.tar.gz \
105 |     && tar -zxC /usr/src -f lua-rocks.tar.gz \
106 |     && tar -zxC /usr/src -f lua-resty-lrucache.tar.gz \
107 |     && tar -zxC /usr/src -f lua-resty-core.tar.gz \
108 |     && tar -zxC /usr/src -f lua-resty-string.tar.gz \
109 |     && tar -zxC /usr/src -f nginx.tar.gz \
110 |     && tar -zxC /usr/src -f ngx_devel_kit.tar.gz \
111 |     && tar -zxC /usr/src -f lua-nginx-module.tar.gz \
112 |     && tar -zxC /usr/src -f ngx_http_geoip2_module.tar.gz \
113 |     && rm -f *.tar.gz \
114 |     && cd /usr/src/luajit2-$LUA_JIT_VERSION \
115 |     && make \
116 |     && make install \
117 |     && ln -sf /usr/local/bin/luajit /usr/local/bin/lua \
118 |     && export LUAJIT_LIB=/usr/local/lib \
119 |     && export LUAJIT_INC=/usr/local/include/luajit-2.1 \
120 |     && cd /usr/src/luarocks-$LUA_ROCKS_VERSION \
121 |     && ./configure --prefix=/usr/local \
122 |             --lua-suffix=jit \
123 |             --with-lua=/usr/local \
124 |             --with-lua-include=$LUAJIT_INC \
125 |             --with-lua-lib=$LUAJIT_LIB \
126 |     && make build \
127 |     && make install \
128 |     && cd /usr/src/lua-resty-string-$LUA_RESTY_STRING_VERSION \
129 |     && make \
130 |     && make install LUA_INCLUDE_DIR=$LUAJIT_INC LUA_LIB_DIR=/usr/local/share/lua/5.1 \
131 |     # Install Lua moduels
132 |     && luarocks install lua-cjson \
133 |     && luarocks install lua-resty-http \
134 |     && luarocks install lua-resty-session \
135 |     && luarocks install lua-resty-jwt \
136 |     && luarocks install lua-resty-openidc \
137 |     && cp -r /usr/src/lua-resty-lrucache-$LUA_RESTY_LRUCACHE_VERSION/lib/* /usr/local/share/lua/5.1 \
138 |     && cp -r /usr/src/lua-resty-core-$LUA_RESTY_CORE_VERSION/lib/* /usr/local/share/lua/5.1 \
139 |     && cd /usr/src/nginx-$NGINX_VERSION \
140 |     && ./configure $CONFIG \
141 |             --with-debug \
142 |             --with-ld-opt="-Wl,-rpath,$LUAJIT_LIB" \
143 |             --add-module=/usr/src/ngx_devel_kit-$NDK_VERSION \
144 |             --add-module=/usr/src/lua-nginx-module-$NGX_LUA_VERSION \
145 |             --add-module=/usr/src/ngx_http_geoip2_module-$NGX_GEOIP2_VERSION \
146 |     && make -j$(getconf _NPROCESSORS_ONLN) \
147 |     && mv objs/nginx objs/nginx-debug \
148 |     && mv objs/ngx_http_xslt_filter_module.so objs/ngx_http_xslt_filter_module-debug.so \
149 |     && mv objs/ngx_http_image_filter_module.so objs/ngx_http_image_filter_module-debug.so \
150 |     && ./configure $CONFIG \
151 |             --with-ld-opt="-Wl,-rpath,$LUAJIT_LIB" \
152 |             --add-module=/usr/src/ngx_devel_kit-$NDK_VERSION \
153 |             --add-module=/usr/src/lua-nginx-module-$NGX_LUA_VERSION \
154 |             --add-module=/usr/src/ngx_http_geoip2_module-$NGX_GEOIP2_VERSION \
155 |     && make -j$(getconf _NPROCESSORS_ONLN) \
156 |     && make install \
157 |     # Note: Keep the '/etc/nginx/html' to prevent 'testing "/etc/nginx/html" existence failed' error
158 |     #&& rm -rf /etc/nginx/html/
159 |     && mkdir /etc/nginx/conf.d/ \
160 |     && mkdir -p /usr/share/nginx/html/ \
161 |     && install -m644 html/index.html /usr/share/nginx/html/ \
162 |     && install -m644 html/50x.html /usr/share/nginx/html/ \
163 |     && install -m755 objs/nginx-debug /usr/sbin/nginx-debug \
164 |     && install -m755 objs/ngx_http_xslt_filter_module-debug.so /usr/lib/nginx/modules/ngx_http_xslt_filter_module-debug.so \
165 |     && install -m755 objs/ngx_http_image_filter_module-debug.so /usr/lib/nginx/modules/ngx_http_image_filter_module-debug.so \
166 |     && ln -s ../../usr/lib/nginx/modules /etc/nginx/modules \
167 |     && strip /usr/sbin/nginx* \
168 |     && strip /usr/lib/nginx/modules/*.so \
169 |     && rm -rf /usr/src \
170 |     \
171 |     # Bring in gettext so we can get `envsubst`, then throw
172 |     # the rest away. To do this, we need to install `gettext`
173 |     # then move `envsubst` out of the way so `gettext` can
174 |     # be deleted completely, then move `envsubst` back.
175 |     && apk add --no-cache --virtual .gettext gettext \
176 |     && mv /usr/bin/envsubst /tmp/ \
177 |     \
178 |     && runDeps="$( \
179 |         scanelf --needed --nobanner /usr/sbin/nginx /usr/lib/nginx/modules/*.so \
180 |                                     /usr/local/bin/luarocks /usr/local/bin/luajit \
181 |                                     /usr/local/lib/*.so /tmp/envsubst \
182 |             | awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
183 |             | sort -u \
184 |             | xargs -r apk info --installed \
185 |             | sort -u \
186 |     )" \
187 |     && apk add --no-cache --virtual .nginx-rundeps $runDeps \
188 |     && apk del .build-deps \
189 |     && apk del .gettext \
190 |     && mv /tmp/envsubst /usr/local/bin/ \
191 |     \
192 |     # forward request and error logs to docker log collector
193 |     #&& ln -sf /dev/stdout /var/log/nginx/access.log
194 |     && ln -sf /dev/stderr /var/log/nginx/error.log
195 | 
196 | 
197 | ARG enable_gixy=false
198 | # https://github.com/docker-library/python/blob/master/3.7/alpine3.7/Dockerfile
199 | RUN set -ex; \
200 |     [[ "${enable_gixy}" = "true" ]] \
201 |     && apk add --update --no-cache python3 \
202 |     && ln -s /usr/bin/python3 /usr/bin/python \
203 | 	&& wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py' \
204 | 	&& python get-pip.py \
205 | 		--no-cache-dir \
206 | 	&& pip --version \
207 | 	&& find /usr/local -depth \
208 | 		\( \
209 | 			\( -type d -a \( -name test -o -name tests \) \) \
210 | 			-o \
211 | 			\( -type f -a \( -name '*.pyc' -o -name '*.pyo' \) \) \
212 | 		\) -exec rm -rf '{}' +; \
213 | 	rm -f get-pip.py \
214 |     ; echo ""
215 | # https://github.com/yandex/gixy
216 | RUN [[ "${enable_gixy}" = "true" ]] && pip install gixy \
217 |     ; echo ""
218 | 
219 | 
220 | ARG enable_geoip=false
221 | # https://github.com/leev/ngx_http_geoip2_module
222 | # http://www.treselle.com/blog/nginx-with-geoip2-maxmind-database-to-fetch-user-geo-location-data/
223 | # https://dev.maxmind.com/geoip/geoip2/geolite2/
224 | RUN [[ "${enable_geoip}" = "true" ]] \
225 |     && mkdir -p /etc/nginx/geoip2 /tmp/geoip2 \
226 |     && cd /tmp/geoip2 \
227 |     && wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz \
228 |             http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.tar.gz \
229 |     && tar -zxf GeoLite2-City.tar.gz \
230 |     && tar -zxf GeoLite2-Country.tar.gz \
231 |     && find . -name "*.mmdb" -type f -exec mv {} /etc/nginx/geoip2 \; \
232 |     && cd - && rm -rf /tmp/geoip2 \
233 |     ; echo ""
234 | # https://github.com/dauer/geohash/blob/master/lua/README.md
235 | RUN [[ "${enable_geoip}" = "true" ]] \
236 |     && luarocks install https://github.com/dauer/geohash/raw/master/lua/geohash-0.9-1.rockspec \
237 |     ; echo ""
238 | 
239 | RUN curl -fSL https://github.com/acmesh-official/acme.sh/archive/2.8.5.tar.gz -o acme-sh.tar.gz \
240 |     && tar -zxC /opt -f acme-sh.tar.gz \
241 |     && mv /opt/acme.sh-2.8.5 /opt/acme.sh-src \
242 |     && rm -f acme-sh.tar.gz
243 | 
244 | 
245 | ENV DEBUG=false
246 | ENV DOMAIN=
247 | ENV CERT_EMAIL=
248 | ENV CERT_DIR=/etc/letsencrypt
249 | ENV ENABLE_CUSTOM_ERROR_PAGE=false
250 | ENV DEFAULT_ERROR_PAGES=/usr/share/nginx/error-pages
251 | ENV VHOSTD=/etc/nginx/vhost.d
252 | ENV STREAMD=/etc/nginx/stream.d
253 | ENV EPAGED=/etc/nginx/epage.d
254 | ENV NGINX_LOG=/var/log/nginx
255 | ENV NGINX_SITES_LOG=/var/log/nginx/sites
256 | 
257 | RUN mkdir -p /etc/nginx/ssl \
258 |     && openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096 \
259 |     && openssl req -x509 -nodes -days 36500 -newkey rsa:4096 \
260 |         -subj "/C=CC/ST=STT/L=LL/O=OO/CN=example.com" \
261 |         -keyout /etc/nginx/ssl/default_https_ssl.key \
262 |         -out /etc/nginx/ssl/default_https_ssl.crt
263 | 
264 | RUN rm -rf /root/.cache
265 | 
266 | RUN mkdir -p /var/log/cron /var/log/letsencrypt \
267 |         /etc/nginx/lua /etc/nginx/vstream.d \
268 |         ${NGINX_LOG} ${NGINX_SITES_LOG}
269 | #RUN mkdir -p /var/www/html && chown -R nginx:nginx /var/www/html
270 | RUN rm -f /etc/nginx/conf.d/default.conf
271 | 
272 | ADD config/nginx.conf /etc/nginx/nginx.conf
273 | ADD config/00_vars.conf /etc/nginx/conf.d/00_vars.conf
274 | ADD config/00_log.conf /etc/nginx/conf.d/00_log.conf
275 | ADD config/01_ssl.conf /etc/nginx/conf.d/01_ssl.conf
276 | ADD config/02_proxy.conf /etc/nginx/conf.d/02_proxy.conf
277 | ADD config/03_geoip2.conf /etc/nginx/conf.d/03_geoip2.conf
278 | ADD config/00_log_with_geoip.conf /etc/nginx/conf.d/00_log_with_geoip.conf
279 | ADD config/10_default.conf /etc/nginx/conf.d/10_default.conf
280 | ADD config/10_default_https.conf /etc/nginx/conf.d/10_default_https.conf
281 | # NOTE: The other crontab file will not be scaned
282 | COPY config/crontab /var/spool/cron/crontabs/root
283 | ADD config/10_stream_acme.conf /etc/nginx/vstream.d/10_stream_acme.conf
284 | 
285 | ADD bin/nginx-utils.sh /usr/bin/nginx-utils.sh
286 | ADD bin/nginx-utils.awk /usr/bin/nginx-utils.awk
287 | ADD bin/build-certs /usr/bin/build-certs
288 | ADD bin/update-certs /usr/bin/update-certs
289 | ADD bin/watch-config /usr/bin/watch-config
290 | ADD bin/entrypoint.sh /entrypoint.sh
291 | 
292 | ADD config/error-pages ${DEFAULT_ERROR_PAGES}
293 | 
294 | RUN [[ "${enable_geoip}" != "true" ]] \
295 |     && rm -f /etc/nginx/conf.d/*geoip* \
296 |     ; echo ""
297 | RUN mkdir -p ${VHOSTD} ${STREAMD} ${CERT_DIR} ${EPAGED}
298 | RUN chmod +x /usr/bin/build-certs /usr/bin/update-certs \
299 |         /usr/bin/watch-config /entrypoint.sh
300 | 
301 | VOLUME ["${VHOSTD}", "${STREAMD}", "${EPAGED}", "${CERT_DIR}"]
302 | 
303 | EXPOSE 80 443
304 | 
305 | # CMD & ENTRYPOINT
306 | ## https://docs.docker.com/engine/reference/builder/#understand-how-cmd-and-entrypoint-interact
307 | ENTRYPOINT ["/entrypoint.sh"]
308 | 


--------------------------------------------------------------------------------
/examples/epage.d/all/12_Solar_System.html:
--------------------------------------------------------------------------------
  1 | <!-- Source from https://codepen.io/kowlor/pen/ZYYQoy -->
  2 | <!DOCTYPE html>
  3 | <html>
  4 | <head>
  5 |     <meta charset="utf-8"/>
  6 |     <meta http-equiv="X-UA-Compatible" content="IE=Edge"/>
  7 |     <title>{{status}} - {{status_msg}}</title>
  8 |     <style type="text/css">
  9 |         /*
 10 |           Malik Dellidj - @Dathink
 11 | 
 12 |           Solar System orbit animation true time scaled
 13 | 
 14 |           Revolution of planets in earth days (from Wikipedia)
 15 |           Mercury : ~87,5 days
 16 |           Venus : ~224,7 days
 17 |           Earth : ~365,2563 days
 18 |             + Moon : ~27,3216 days (around earth)
 19 |           Mars : ~687 days (~1,8 year)
 20 |           Jupiter : ~4 331 days (~12 years)
 21 |           Saturn : ~10 747 days (~30 years)
 22 |           Uranus : ~30 589 days (~84 years)
 23 |           Neptune : ~59 802 days (~165 years)
 24 |           Pluto : ~90 580 days (~248 years)
 25 |         */
 26 |         *, *:before, *:after {
 27 |             padding: 0;
 28 |             margin: 0;
 29 |             box-sizing: border-box;
 30 |         }
 31 | 
 32 |         html, body {
 33 |             height: 100%;
 34 |             width: 100%;
 35 |         }
 36 | 
 37 |         body {
 38 |             font: normal 1em/1.45em "Helvetica Neue", Helvetica, Arial, sans-serif;
 39 |             color: #fff;
 40 |             background: radial-gradient(ellipse at bottom, #1C2837 0%, #050608 100%);
 41 |             background-attachment: fixed;
 42 |             overflow: hidden;
 43 |         }
 44 | 
 45 |         h1 {
 46 |             font-weight: 300;
 47 |             font-size: 2.5em;
 48 |             text-transform: uppercase;
 49 |             font-family: Lato;
 50 |             line-height: 1.6em;
 51 |             letter-spacing: .1em;
 52 |         }
 53 | 
 54 |         a, a:visited {
 55 |             text-decoration: none;
 56 |             color: white;
 57 |             opacity: .7;
 58 |         }
 59 | 
 60 |         a:hover, a:visited:hover {
 61 |             opacity: 1;
 62 |         }
 63 | 
 64 |         .description {
 65 |             padding: 30px;
 66 |             position: absolute;
 67 |             top: 0;
 68 |             left: 0;
 69 |             width: 25%;
 70 |             z-index: 999;
 71 |         }
 72 | 
 73 |         .description p {
 74 |             font-size: .9em;
 75 |         }
 76 | 
 77 |         .description p + p {
 78 |             margin-top: 20px;
 79 |         }
 80 | 
 81 |         .description p.author {
 82 |             font-size: .7em;
 83 |         }
 84 | 
 85 |         hr {
 86 |             margin: 26px 0;
 87 |             border: 0;
 88 |             border-top: 1px solid white;
 89 |             background: transparent;
 90 |             width: 25%;
 91 |             opacity: .1;
 92 |         }
 93 | 
 94 |         code {
 95 |             color: #ae94c0;
 96 |             font-family: Menlo, Monaco, Consolas, 'Courier New', monospace;
 97 |             font-size: .9em;
 98 |         }
 99 | 
100 |         .solar-syst {
101 |             margin: 0 auto;
102 |             width: 100%;
103 |             height: 100%;
104 |             position: relative;
105 |         }
106 | 
107 |         .solar-syst:after {
108 |             content: "";
109 |             position: absolute;
110 |             height: 2px;
111 |             width: 2px;
112 |             top: -2px;
113 |             background: white;
114 |             box-shadow: 504px 1079px 0 0px rgba(255, 255, 255, 0.502), 973px 375px 0 0px rgba(255, 255, 255, 0.777), 1562px 1788px 0 0px rgba(255, 255, 255, 0.141), 823px 1493px 0 0px rgba(255, 255, 255, 0.643), 841px 832px 0 0px rgba(255, 255, 255, 0.085), 754px 787px 0 0px rgba(255, 255, 255, 0.584), 376px 1460px 0 0px rgba(255, 255, 255, 0.238), 1185px 1252px 0 0px rgba(255, 255, 255, 0.648), 1140px 976px 0 0px rgba(255, 255, 255, 0.384), 1085px 1585px 0 0px rgba(255, 255, 255, 0.609), 442px 1536px 0 0px rgba(255, 255, 255, 0.814), 1722px 1737px 0 0px rgba(255, 255, 255, 0.453), 577px 1139px 0 0px rgba(255, 255, 255, 0.171), 158px 1313px 0 0px rgba(255, 255, 255, 0.618), 915px 858px 0 0px rgba(255, 255, 255, 0.906), 272px 1767px 0 0px rgba(255, 255, 255, 0.274), 1601px 246px 0 0px rgba(255, 255, 255, 0.205), 911px 1727px 0 0px rgba(255, 255, 255, 0.132), 548px 494px 0 0px rgba(255, 255, 255, 0.638), 1786px 1200px 0 0px rgba(255, 255, 255, 0.479), 1788px 1256px 0 0px rgba(255, 255, 255, 0.747), 1200px 1189px 0 0px rgba(255, 255, 255, 0.215), 1507px 1298px 0 0px rgba(255, 255, 255, 0.63), 307px 1336px 0 0px rgba(255, 255, 255, 0.28), 585px 1769px 0 0px rgba(255, 255, 255, 0.827), 1146px 846px 0 0px rgba(255, 255, 255, 0.93), 991px 1670px 0 0px rgba(255, 255, 255, 0.137), 1403px 1086px 0 0px rgba(255, 255, 255, 0.942), 1314px 499px 0 0px rgba(255, 255, 255, 0.366), 959px 692px 0 0px rgba(255, 255, 255, 0.291), 495px 1064px 0 0px rgba(255, 255, 255, 0.689), 477px 764px 0 0px rgba(255, 255, 255, 0.523), 1173px 809px 0 0px rgba(255, 255, 255, 0.668), 1158px 873px 0 0px rgba(255, 255, 255, 0.717), 479px 494px 0 0px rgba(255, 255, 255, 0.921), 1793px 1532px 0 0px rgba(255, 255, 255, 0.119), 977px 1183px 0 0px rgba(255, 255, 255, 0.626), 1071px 295px 0 0px rgba(255, 255, 255, 0.292), 1530px 101px 0 0px rgba(255, 255, 255, 0.322), 289px 1714px 0 0px rgba(255, 255, 255, 0.13), 1455px 73px 0 0px rgba(255, 255, 255, 0.435), 610px 1516px 0 0px rgba(255, 255, 255, 0.132), 645px 333px 0 0px rgba(255, 255, 255, 0.895), 1599px 1535px 0 0px rgba(255, 255, 255, 0.908), 897px 994px 0 0px rgba(255, 255, 255, 0.135), 479px 945px 0 0px rgba(255, 255, 255, 0.091), 280px 643px 0 0px rgba(255, 255, 255, 0.849), 134px 1112px 0 0px rgba(255, 255, 255, 0.75), 1161px 1095px 0 0px rgba(255, 255, 255, 0.172), 779px 740px 0 0px rgba(255, 255, 255, 0.088), 1285px 1210px 0 0px rgba(255, 255, 255, 0.193), 1172px 1601px 0 0px rgba(255, 255, 255, 0.201), 1462px 749px 0 0px rgba(255, 255, 255, 0.355), 218px 420px 0 0px rgba(255, 255, 255, 0.928), 1050px 482px 0 0px rgba(255, 255, 255, 0.108), 1273px 1544px 0 0px rgba(255, 255, 255, 0.253), 1140px 1605px 0 0px rgba(255, 255, 255, 0.472), 1138px 1568px 0 0px rgba(255, 255, 255, 0.106), 1113px 1582px 0 0px rgba(255, 255, 255, 0.141), 848px 417px 0 0px rgba(255, 255, 255, 0.843), 33px 926px 0 0px rgba(255, 255, 255, 0.347), 42px 985px 0 0px rgba(255, 255, 255, 0.138), 990px 852px 0 0px rgba(255, 255, 255, 0.386), 1019px 142px 0 0px rgba(255, 255, 255, 0.064), 729px 1434px 0 0px rgba(255, 255, 255, 0.09), 1057px 1494px 0 0px rgba(255, 255, 255, 0.214), 686px 636px 0 0px rgba(255, 255, 255, 0.876), 781px 582px 0 0px rgba(255, 255, 255, 0.903), 1420px 507px 0 0px rgba(255, 255, 255, 0.326), 595px 228px 0 0px rgba(255, 255, 255, 0.208), 725px 999px 0 0px rgba(255, 255, 255, 0.451), 1536px 1715px 0 0px rgba(255, 255, 255, 0.553), 505px 307px 0 0px rgba(255, 255, 255, 0.81), 1311px 220px 0 0px rgba(255, 255, 255, 0.413), 1263px 1517px 0 0px rgba(255, 255, 255, 0.36), 1282px 1153px 0 0px rgba(255, 255, 255, 0.976), 1077px 1394px 0 0px rgba(255, 255, 255, 0.897), 43px 572px 0 0px rgba(255, 255, 255, 0.861), 219px 620px 0 0px rgba(255, 255, 255, 0.278), 571px 1198px 0 0px rgba(255, 255, 255, 0.263), 1751px 929px 0 0px rgba(255, 255, 255, 0.488), 274px 530px 0 0px rgba(255, 255, 255, 0.947), 1757px 456px 0 0px rgba(255, 255, 255, 0.563), 743px 305px 0 0px rgba(255, 255, 255, 0.571), 1692px 1202px 0 0px rgba(255, 255, 255, 0.213), 726px 421px 0 0px rgba(255, 255, 255, 0.74), 1298px 462px 0 0px rgba(255, 255, 255, 0.462), 1431px 700px 0 0px rgba(255, 255, 255, 0.058), 367px 677px 0 0px rgba(255, 255, 255, 0.042), 626px 432px 0 0px rgba(255, 255, 255, 0.581), 1780px 118px 0 0px rgba(255, 255, 255, 0.481), 283px 1159px 0 0px rgba(255, 255, 255, 0.036), 785px 635px 0 0px rgba(255, 255, 255, 0.361), 1586px 621px 0 0px rgba(255, 255, 255, 0.007), 484px 790px 0 0px rgba(255, 255, 255, 0.884), 1242px 6px 0 0px rgba(255, 255, 255, 0.765), 1026px 1638px 0 0px rgba(255, 255, 255, 0.351), 1719px 311px 0 0px rgba(255, 255, 255, 0.063), 728px 125px 0 0px rgba(255, 255, 255, 0.105), 1647px 967px 0 0px rgba(255, 255, 255, 0.122), 360px 551px 0 0px rgba(255, 255, 255, 0.457), 1638px 1672px 0 0px rgba(255, 255, 255, 0.384), 1324px 1130px 0 0px rgba(255, 255, 255, 0.361), 1251px 664px 0 0px rgba(255, 255, 255, 0.586), 259px 1032px 0 0px rgba(255, 255, 255, 0.745), 712px 1181px 0 0px rgba(255, 255, 255, 0.585), 1130px 1239px 0 0px rgba(255, 255, 255, 0.092), 7px 1131px 0 0px rgba(255, 255, 255, 0.921), 857px 839px 0 0px rgba(255, 255, 255, 0.585), 499px 153px 0 0px rgba(255, 255, 255, 0.975), 453px 1536px 0 0px rgba(255, 255, 255, 0.002), 490px 201px 0 0px rgba(255, 255, 255, 0.453), 1734px 972px 0 0px rgba(255, 255, 255, 0.655), 910px 961px 0 0px rgba(255, 255, 255, 0.744), 897px 8px 0 0px rgba(255, 255, 255, 0.598), 1060px 1322px 0 0px rgba(255, 255, 255, 0.509), 592px 1112px 0 0px rgba(255, 255, 255, 0.538), 1123px 559px 0 0px rgba(255, 255, 255, 0.56), 668px 811px 0 0px rgba(255, 255, 255, 0.402), 496px 1712px 0 0px rgba(255, 255, 255, 0.898), 103px 433px 0 0px rgba(255, 255, 255, 0.603), 218px 28px 0 0px rgba(255, 255, 255, 0.188), 868px 503px 0 0px rgba(255, 255, 255, 0.573), 1789px 96px 0 0px rgba(255, 255, 255, 0.771), 459px 1353px 0 0px rgba(255, 255, 255, 0.761), 1525px 768px 0 0px rgba(255, 255, 255, 0.051), 769px 517px 0 0px rgba(255, 255, 255, 0.337), 304px 1540px 0 0px rgba(255, 255, 255, 0.973), 367px 1126px 0 0px rgba(255, 255, 255, 0.224), 1637px 1622px 0 0px rgba(255, 255, 255, 0.228), 1749px 413px 0 0px rgba(255, 255, 255, 0.521), 1517px 353px 0 0px rgba(255, 255, 255, 0.129), 1196px 345px 0 0px rgba(255, 255, 255, 0.385), 1485px 7px 0 0px rgba(255, 255, 255, 0.937), 1048px 806px 0 0px rgba(255, 255, 255, 0.19), 705px 1491px 0 0px rgba(255, 255, 255, 0.136), 1504px 1703px 0 0px rgba(255, 255, 255, 0.728), 74px 1213px 0 0px rgba(255, 255, 255, 0.069), 1132px 790px 0 0px rgba(255, 255, 255, 0.607), 449px 475px 0 0px rgba(255, 255, 255, 0.61), 679px 361px 0 0px rgba(255, 255, 255, 0.803), 1022px 1588px 0 0px rgba(255, 255, 255, 0.2), 631px 441px 0 0px rgba(255, 255, 255, 0.991), 549px 1261px 0 0px rgba(255, 255, 255, 0.965), 1602px 1539px 0 0px rgba(255, 255, 255, 0.329), 636px 1120px 0 0px rgba(255, 255, 255, 0.737), 120px 596px 0 0px rgba(255, 255, 255, 0.714), 44px 741px 0 0px rgba(255, 255, 255, 0.38), 82px 826px 0 0px rgba(255, 255, 255, 0.307), 956px 1733px 0 0px rgba(255, 255, 255, 0.094), 55px 1135px 0 0px rgba(255, 255, 255, 0.557), 1489px 757px 0 0px rgba(255, 255, 255, 0.844), 1464px 1368px 0 0px rgba(255, 255, 255, 0.472), 100px 1143px 0 0px rgba(255, 255, 255, 0.374), 1292px 1280px 0 0px rgba(255, 255, 255, 0.784), 1366px 238px 0 0px rgba(255, 255, 255, 0.057), 1607px 1212px 0 0px rgba(255, 255, 255, 0.209), 1320px 1407px 0 0px rgba(255, 255, 255, 0.561), 566px 1527px 0 0px rgba(255, 255, 255, 0.491), 221px 17px 0 0px rgba(255, 255, 255, 0.385), 1464px 1112px 0 0px rgba(255, 255, 255, 0.572), 5px 321px 0 0px rgba(255, 255, 255, 0.809), 488px 1513px 0 0px rgba(255, 255, 255, 0.068), 1251px 388px 0 0px rgba(255, 255, 255, 0.261), 406px 475px 0 0px rgba(255, 255, 255, 0.478), 317px 674px 0 0px rgba(255, 255, 255, 0.663), 1385px 767px 0 0px rgba(255, 255, 255, 0.538), 333px 931px 0 0px rgba(255, 255, 255, 0.957), 869px 1101px 0 0px rgba(255, 255, 255, 0.849), 526px 737px 0 0px rgba(255, 255, 255, 0.146), 75px 269px 0 0px rgba(255, 255, 255, 0.24), 1332px 1290px 0 0px rgba(255, 255, 255, 0.392), 623px 656px 0 0px rgba(255, 255, 255, 0.446), 146px 435px 0 0px rgba(255, 255, 255, 0.405), 450px 858px 0 0px rgba(255, 255, 255, 0.66), 1696px 49px 0 0px rgba(255, 255, 255, 0.577), 1454px 1201px 0 0px rgba(255, 255, 255, 0.591), 1062px 1355px 0 0px rgba(255, 255, 255, 0.463), 841px 606px 0 0px rgba(255, 255, 255, 0.049), 1237px 1540px 0 0px rgba(255, 255, 255, 0.742), 1566px 1688px 0 0px rgba(255, 255, 255, 0.234), 1333px 194px 0 0px rgba(255, 255, 255, 0.612), 259px 950px 0 0px rgba(255, 255, 255, 0.127), 198px 775px 0 0px rgba(255, 255, 255, 0.228), 108px 755px 0 0px rgba(255, 255, 255, 0.453), 8px 541px 0 0px rgba(255, 255, 255, 0.902), 1547px 1434px 0 0px rgba(255, 255, 255, 0.416), 1514px 1406px 0 0px rgba(255, 255, 255, 0.691), 36px 1525px 0 0px rgba(255, 255, 255, 0.793), 441px 1431px 0 0px rgba(255, 255, 255, 0.655), 750px 1134px 0 0px rgba(255, 255, 255, 0.631), 209px 531px 0 0px rgba(255, 255, 255, 0.565), 73px 1493px 0 0px rgba(255, 255, 255, 0.482), 1658px 835px 0 0px rgba(255, 255, 255, 0.328), 619px 661px 0 0px rgba(255, 255, 255, 0.801), 1499px 518px 0 0px rgba(255, 255, 255, 0.966), 263px 1766px 0 0px rgba(255, 255, 255, 0.531), 1540px 332px 0 0px rgba(255, 255, 255, 0.536), 840px 1365px 0 0px rgba(255, 255, 255, 0.423), 1280px 678px 0 0px rgba(255, 255, 255, 0.083), 35px 1447px 0 0px rgba(255, 255, 255, 0.824), 1527px 1128px 0 0px rgba(255, 255, 255, 0.869), 932px 1156px 0 0px rgba(255, 255, 255, 0.965), 506px 428px 0 0px rgba(255, 255, 255, 0.51), 502px 1319px 0 0px rgba(255, 255, 255, 0.457), 260px 938px 0 0px rgba(255, 255, 255, 0.013), 718px 1708px 0 0px rgba(255, 255, 255, 0.646), 164px 688px 0 0px rgba(255, 255, 255, 0.019), 784px 1652px 0 0px rgba(255, 255, 255, 0.667), 577px 818px 0 0px rgba(255, 255, 255, 0.318), 1655px 170px 0 0px rgba(255, 255, 255, 0.589), 335px 1479px 0 0px rgba(255, 255, 255, 0.891), 891px 1137px 0 0px rgba(255, 255, 255, 0.813), 282px 363px 0 0px rgba(255, 255, 255, 0.355), 1355px 1623px 0 0px rgba(255, 255, 255, 0.144), 1049px 1461px 0 0px rgba(255, 255, 255, 0.424), 34px 99px 0 0px rgba(255, 255, 255, 0.331), 438px 1332px 0 0px rgba(255, 255, 255, 0.589), 372px 1144px 0 0px rgba(255, 255, 255, 0.259), 1596px 1713px 0 0px rgba(255, 255, 255, 0.404), 327px 1677px 0 0px rgba(255, 255, 255, 0.057), 1159px 367px 0 0px rgba(255, 255, 255, 0.54), 1788px 1473px 0 0px rgba(255, 255, 255, 0.725), 1071px 416px 0 0px rgba(255, 255, 255, 0.641), 1327px 189px 0 0px rgba(255, 255, 255, 0.389), 774px 1449px 0 0px rgba(255, 255, 255, 0.492), 1717px 679px 0 0px rgba(255, 255, 255, 0.759), 1470px 764px 0 0px rgba(255, 255, 255, 0.305), 87px 97px 0 0px rgba(255, 255, 255, 0.834), 835px 94px 0 0px rgba(255, 255, 255, 0.975), 1071px 784px 0 0px rgba(255, 255, 255, 0.557), 23px 468px 0 0px rgba(255, 255, 255, 0.905), 233px 333px 0 0px rgba(255, 255, 255, 0.665), 139px 1158px 0 0px rgba(255, 255, 255, 0.451), 1727px 1189px 0 0px rgba(255, 255, 255, 0.362), 316px 1670px 0 0px rgba(255, 255, 255, 0.841), 301px 1390px 0 0px rgba(255, 255, 255, 0.682), 668px 669px 0 0px rgba(255, 255, 255, 0.929), 65px 866px 0 0px rgba(255, 255, 255, 0.336), 726px 1433px 0 0px rgba(255, 255, 255, 0.309), 1368px 1234px 0 0px rgba(255, 255, 255, 0.029), 515px 660px 0 0px rgba(255, 255, 255, 0.46), 1606px 466px 0 0px rgba(255, 255, 255, 0.413), 737px 52px 0 0px rgba(255, 255, 255, 0.977), 1141px 1596px 0 0px rgba(255, 255, 255, 0.977), 1098px 1725px 0 0px rgba(255, 255, 255, 0.746), 413px 278px 0 0px rgba(255, 255, 255, 0.547), 1279px 777px 0 0px rgba(255, 255, 255, 0.12), 883px 1487px 0 0px rgba(255, 255, 255, 0.75), 354px 591px 0 0px rgba(255, 255, 255, 0.796), 782px 1387px 0 0px rgba(255, 255, 255, 0.051), 1639px 1328px 0 0px rgba(255, 255, 255, 0.751), 517px 807px 0 0px rgba(255, 255, 255, 0.581), 808px 197px 0 0px rgba(255, 255, 255, 0.298), 1209px 818px 0 0px rgba(255, 255, 255, 0.888), 1428px 1689px 0 0px rgba(255, 255, 255, 0.559), 569px 1028px 0 0px rgba(255, 255, 255, 0.76), 372px 1182px 0 0px rgba(255, 255, 255, 0.239), 1534px 651px 0 0px rgba(255, 255, 255, 0.983), 1064px 1193px 0 0px rgba(255, 255, 255, 0.742), 1109px 372px 0 0px rgba(255, 255, 255, 0.336), 722px 547px 0 0px rgba(255, 255, 255, 0.715), 641px 1301px 0 0px rgba(255, 255, 255, 0.435), 959px 76px 0 0px rgba(255, 255, 255, 0.253), 170px 366px 0 0px rgba(255, 255, 255, 0.782), 1006px 428px 0 0px rgba(255, 255, 255, 0.931), 1359px 912px 0 0px rgba(255, 255, 255, 0.662), 1410px 997px 0 0px rgba(255, 255, 255, 0.04), 958px 150px 0 0px rgba(255, 255, 255, 0.405), 1475px 1616px 0 0px rgba(255, 255, 255, 0.186), 1191px 987px 0 0px rgba(255, 255, 255, 0.522), 518px 1449px 0 0px rgba(255, 255, 255, 0.449), 1060px 1722px 0 0px rgba(255, 255, 255, 0.453), 629px 1099px 0 0px rgba(255, 255, 255, 0.12), 782px 478px 0 0px rgba(255, 255, 255, 0.459), 79px 62px 0 0px rgba(255, 255, 255, 0.016), 20px 84px 0 0px rgba(255, 255, 255, 0.563), 1510px 205px 0 0px rgba(255, 255, 255, 0.975), 702px 1634px 0 0px rgba(255, 255, 255, 0.441), 728px 146px 0 0px rgba(255, 255, 255, 0.053), 586px 981px 0 0px rgba(255, 255, 255, 0.146), 1237px 1579px 0 0px rgba(255, 255, 255, 0.149), 969px 181px 0 0px rgba(255, 255, 255, 0.982), 494px 1040px 0 0px rgba(255, 255, 255, 0.866), 1316px 858px 0 0px rgba(255, 255, 255, 0.167), 282px 749px 0 0px rgba(255, 255, 255, 0.645), 1663px 763px 0 0px rgba(255, 255, 255, 0.378), 436px 297px 0 0px rgba(255, 255, 255, 0.633), 1135px 1059px 0 0px rgba(255, 255, 255, 0.973), 455px 1540px 0 0px rgba(255, 255, 255, 0.524), 1589px 1341px 0 0px rgba(255, 255, 255, 0.091), 612px 1073px 0 0px rgba(255, 255, 255, 0.204), 1429px 317px 0 0px rgba(255, 255, 255, 0.735), 645px 1043px 0 0px rgba(255, 255, 255, 0.611), 577px 584px 0 0px rgba(255, 255, 255, 0.258), 429px 526px 0 0px rgba(255, 255, 255, 0.852), 927px 23px 0 0px rgba(255, 255, 255, 0.893), 795px 1475px 0 0px rgba(255, 255, 255, 0.653), 925px 330px 0 0px rgba(255, 255, 255, 0.359), 1028px 670px 0 0px rgba(255, 255, 255, 0.537), 1262px 278px 0 0px rgba(255, 255, 255, 0.695), 571px 666px 0 0px rgba(255, 255, 255, 0.75), 1078px 999px 0 0px rgba(255, 255, 255, 0.751), 1125px 1368px 0 0px rgba(255, 255, 255, 0.001), 1267px 1108px 0 0px rgba(255, 255, 255, 0.103), 1287px 916px 0 0px rgba(255, 255, 255, 0.162), 1524px 1440px 0 0px rgba(255, 255, 255, 0.539), 1411px 196px 0 0px rgba(255, 255, 255, 0.205), 1674px 50px 0 0px rgba(255, 255, 255, 0.38), 29px 1556px 0 0px rgba(255, 255, 255, 0.156), 1498px 189px 0 0px rgba(255, 255, 255, 0.138), 328px 1570px 0 0px rgba(255, 255, 255, 0.82), 485px 614px 0 0px rgba(255, 255, 255, 0.17), 1704px 682px 0 0px rgba(255, 255, 255, 0.271), 88px 542px 0 0px rgba(255, 255, 255, 0.402), 869px 1770px 0 0px rgba(255, 255, 255, 0.823), 1322px 1662px 0 0px rgba(255, 255, 255, 0.678), 1133px 690px 0 0px rgba(255, 255, 255, 0.937), 34px 93px 0 0px rgba(255, 255, 255, 0.926), 1587px 1647px 0 0px rgba(255, 255, 255, 0.729), 1524px 1535px 0 0px rgba(255, 255, 255, 0.255), 847px 1397px 0 0px rgba(255, 255, 255, 0.791), 492px 1368px 0 0px rgba(255, 255, 255, 0.414), 1327px 1655px 0 0px rgba(255, 255, 255, 0.677), 818px 516px 0 0px rgba(255, 255, 255, 0.603), 174px 267px 0 0px rgba(255, 255, 255, 0.337), 779px 606px 0 0px rgba(255, 255, 255, 0.332), 594px 1486px 0 0px rgba(255, 255, 255, 0.086), 155px 45px 0 0px rgba(255, 255, 255, 0.071), 322px 412px 0 0px rgba(255, 255, 255, 0.841), 1083px 981px 0 0px rgba(255, 255, 255, 0.125), 695px 1721px 0 0px rgba(255, 255, 255, 0.458), 788px 321px 0 0px rgba(255, 255, 255, 0.917), 343px 1396px 0 0px rgba(255, 255, 255, 0.549), 595px 1215px 0 0px rgba(255, 255, 255, 0.315), 1156px 363px 0 0px rgba(255, 255, 255, 0.32), 446px 1082px 0 0px rgba(255, 255, 255, 0.17), 1674px 1409px 0 0px rgba(255, 255, 255, 0.05), 541px 184px 0 0px rgba(255, 255, 255, 0.45), 1748px 106px 0 0px rgba(255, 255, 255, 0.072), 1023px 1267px 0 0px rgba(255, 255, 255, 0.256), 1370px 616px 0 0px rgba(255, 255, 255, 0.725), 1325px 929px 0 0px rgba(255, 255, 255, 0.035), 422px 592px 0 0px rgba(255, 255, 255, 0.422), 282px 955px 0 0px rgba(255, 255, 255, 0.154), 75px 1105px 0 0px rgba(255, 255, 255, 0.421), 956px 1233px 0 0px rgba(255, 255, 255, 0.718), 1419px 1707px 0 0px rgba(255, 255, 255, 0.077), 1625px 1090px 0 0px rgba(255, 255, 255, 0.028), 613px 1686px 0 0px rgba(255, 255, 255, 0.069), 846px 1171px 0 0px rgba(255, 255, 255, 0.568), 439px 1625px 0 0px rgba(255, 255, 255, 0.944), 857px 1776px 0 0px rgba(255, 255, 255, 0.016), 1368px 480px 0 0px rgba(255, 255, 255, 0.72), 367px 1774px 0 0px rgba(255, 255, 255, 0.068), 1010px 90px 0 0px rgba(255, 255, 255, 0.097), 737px 1775px 0 0px rgba(255, 255, 255, 0.026), 451px 1378px 0 0px rgba(255, 255, 255, 0.608), 1212px 1341px 0 0px rgba(255, 255, 255, 0.11), 1249px 1677px 0 0px rgba(255, 255, 255, 0.429), 1705px 1151px 0 0px rgba(255, 255, 255, 0.25), 1362px 1098px 0 0px rgba(255, 255, 255, 0.872), 432px 148px 0 0px rgba(255, 255, 255, 0.942), 1470px 979px 0 0px rgba(255, 255, 255, 0.11), 1778px 392px 0 0px rgba(255, 255, 255, 0.908), 883px 460px 0 0px rgba(255, 255, 255, 0.165), 803px 794px 0 0px rgba(255, 255, 255, 0.046), 546px 1327px 0 0px rgba(255, 255, 255, 0.832), 1749px 1692px 0 0px rgba(255, 255, 255, 0.609), 414px 210px 0 0px rgba(255, 255, 255, 0.647), 1038px 411px 0 0px rgba(255, 255, 255, 0.647), 655px 956px 0 0px rgba(255, 255, 255, 0.416), 664px 918px 0 0px rgba(255, 255, 255, 0.357), 1761px 279px 0 0px rgba(255, 255, 255, 0.295), 988px 922px 0 0px rgba(255, 255, 255, 0.221), 1706px 1323px 0 0px rgba(255, 255, 255, 0.316), 456px 1558px 0 0px rgba(255, 255, 255, 0.622), 1466px 874px 0 0px rgba(255, 255, 255, 0.361), 653px 482px 0 0px rgba(255, 255, 255, 0.288), 1071px 1728px 0 0px rgba(255, 255, 255, 0.861), 1726px 1145px 0 0px rgba(255, 255, 255, 0.043), 1154px 1519px 0 0px rgba(255, 255, 255, 0.859), 1268px 1174px 0 0px rgba(255, 255, 255, 0.904), 874px 1485px 0 0px rgba(255, 255, 255, 0.54), 381px 1579px 0 0px rgba(255, 255, 255, 0.075), 765px 836px 0 0px rgba(255, 255, 255, 0.639), 440px 900px 0 0px rgba(255, 255, 255, 0.849), 461px 25px 0 0px rgba(255, 255, 255, 0.653), 345px 539px 0 0px rgba(255, 255, 255, 0.268), 365px 1201px 0 0px rgba(255, 255, 255, 0.955), 1110px 921px 0 0px rgba(255, 255, 255, 0.079), 1410px 331px 0 0px rgba(255, 255, 255, 0.741), 919px 560px 0 0px rgba(255, 255, 255, 0.409), 149px 287px 0 0px rgba(255, 255, 255, 0.747), 559px 1331px 0 0px rgba(255, 255, 255, 0.373), 1206px 870px 0 0px rgba(255, 255, 255, 0.037), 1103px 1522px 0 0px rgba(255, 255, 255, 0.096), 1152px 1410px 0 0px rgba(255, 255, 255, 0.067), 106px 302px 0 0px rgba(255, 255, 255, 0.43), 1558px 1368px 0 0px rgba(255, 255, 255, 0.647), 1020px 59px 0 0px rgba(255, 255, 255, 0.091), 339px 1007px 0 0px rgba(255, 255, 255, 0.256), 1225px 41px 0 0px rgba(255, 255, 255, 0.216), 935px 466px 0 0px rgba(255, 255, 255, 0.545), 35px 560px 0 0px rgba(255, 255, 255, 0.639), 1664px 1756px 0 0px rgba(255, 255, 255, 0.655), 1012px 1641px 0 0px rgba(255, 255, 255, 0.154), 1616px 493px 0 0px rgba(255, 255, 255, 0.134), 1639px 131px 0 0px rgba(255, 255, 255, 0.323), 494px 334px 0 0px rgba(255, 255, 255, 0.701), 338px 1746px 0 0px rgba(255, 255, 255, 0.082), 50px 27px 0 0px rgba(255, 255, 255, 0.525), 939px 635px 0 0px rgba(255, 255, 255, 0.591), 516px 1550px 0 0px rgba(255, 255, 255, 0.085), 1346px 1257px 0 0px rgba(255, 255, 255, 0.027), 537px 38px 0 0px rgba(255, 255, 255, 0.514), 1254px 876px 0 0px rgba(255, 255, 255, 0.305), 1260px 898px 0 0px rgba(255, 255, 255, 0.588), 1331px 1685px 0 0px rgba(255, 255, 255, 0.667), 1423px 582px 0 0px rgba(255, 255, 255, 0.327), 1012px 1033px 0 0px rgba(255, 255, 255, 0.697), 1506px 1273px 0 0px rgba(255, 255, 255, 0.673), 708px 1510px 0 0px rgba(255, 255, 255, 0.809), 754px 1151px 0 0px rgba(255, 255, 255, 0.213), 920px 112px 0 0px rgba(255, 255, 255, 0.743), 1770px 518px 0 0px rgba(255, 255, 255, 0.467), 1309px 375px 0 0px rgba(255, 255, 255, 0.342), 1559px 1340px 0 0px rgba(255, 255, 255, 0.341), 1724px 720px 0 0px rgba(255, 255, 255, 0.651), 305px 1044px 0 0px rgba(255, 255, 255, 0.553), 127px 1045px 0 0px rgba(255, 255, 255, 0.68), 81px 1275px 0 0px rgba(255, 255, 255, 0.02), 643px 919px 0 0px rgba(255, 255, 255, 0.533), 1559px 586px 0 0px rgba(255, 255, 255, 0.913), 1558px 966px 0 0px rgba(255, 255, 255, 0.466), 1288px 714px 0 0px rgba(255, 255, 255, 0.04), 241px 840px 0 0px rgba(255, 255, 255, 0.206), 769px 1556px 0 0px rgba(255, 255, 255, 0.956), 1436px 678px 0 0px rgba(255, 255, 255, 0.853), 1580px 257px 0 0px rgba(255, 255, 255, 0.056), 1517px 424px 0 0px rgba(255, 255, 255, 0.53), 1654px 1040px 0 0px rgba(255, 255, 255, 0.838), 257px 35px 0 0px rgba(255, 255, 255, 0.062), 293px 1602px 0 0px rgba(255, 255, 255, 0.766), 1218px 528px 0 0px rgba(255, 255, 255, 0.806), 1542px 1555px 0 0px rgba(255, 255, 255, 0.358), 931px 563px 0 0px rgba(255, 255, 255, 0.547), 391px 191px 0 0px rgba(255, 255, 255, 0.67), 1100px 151px 0 0px rgba(255, 255, 255, 0.85), 63px 837px 0 0px rgba(255, 255, 255, 0.817), 1198px 384px 0 0px rgba(255, 255, 255, 0.376), 1700px 37px 0 0px rgba(255, 255, 255, 0.254), 903px 61px 0 0px rgba(255, 255, 255, 0.12), 1224px 616px 0 0px rgba(255, 255, 255, 0.008), 611px 765px 0 0px rgba(255, 255, 255, 0.258), 378px 651px 0 0px rgba(255, 255, 255, 0.152), 1729px 826px 0 0px rgba(255, 255, 255, 0.056), 1213px 1171px 0 0px rgba(255, 255, 255, 0.532), 816px 942px 0 0px rgba(255, 255, 255, 0.566), 1505px 841px 0 0px rgba(255, 255, 255, 0.979), 1287px 787px 0 0px rgba(255, 255, 255, 0.638), 769px 1401px 0 0px rgba(255, 255, 255, 0.344), 693px 1053px 0 0px rgba(255, 255, 255, 0.462), 228px 340px 0 0px rgba(255, 255, 255, 0.216), 994px 631px 0 0px rgba(255, 255, 255, 0.475), 317px 902px 0 0px rgba(255, 255, 255, 0.483), 1267px 235px 0 0px rgba(255, 255, 255, 0.686), 345px 462px 0 0px rgba(255, 255, 255, 0.079), 935px 885px 0 0px rgba(255, 255, 255, 0.304), 618px 414px 0 0px rgba(255, 255, 255, 0.045), 1362px 414px 0 0px rgba(255, 255, 255, 0.685), 1577px 715px 0 0px rgba(255, 255, 255, 0.423), 1132px 394px 0 0px rgba(255, 255, 255, 0.986), 1561px 1024px 0 0px rgba(255, 255, 255, 0.169), 1411px 1747px 0 0px rgba(255, 255, 255, 0.809), 753px 6px 0 0px rgba(255, 255, 255, 0.817), 1564px 1613px 0 0px rgba(255, 255, 255, 0.932), 505px 1748px 0 0px rgba(255, 255, 255, 0.614), 1298px 641px 0 0px rgba(255, 255, 255, 0.185), 822px 1724px 0 0px rgba(255, 255, 255, 0.835), 271px 1508px 0 0px rgba(255, 255, 255, 0.451), 857px 669px 0 0px rgba(255, 255, 255, 0.853), 1524px 1021px 0 0px rgba(255, 255, 255, 0.918), 573px 736px 0 0px rgba(255, 255, 255, 0.895), 398px 472px 0 0px rgba(255, 255, 255, 0.232), 970px 1223px 0 0px rgba(255, 255, 255, 0.776), 1775px 320px 0 0px rgba(255, 255, 255, 0.715), 1383px 839px 0 0px rgba(255, 255, 255, 0.227), 83px 211px 0 0px rgba(255, 255, 255, 0.17), 1440px 579px 0 0px rgba(255, 255, 255, 0.478), 220px 510px 0 0px rgba(255, 255, 255, 0.178), 375px 1357px 0 0px rgba(255, 255, 255, 0.515), 1778px 181px 0 0px rgba(255, 255, 255, 0.96), 466px 239px 0 0px rgba(255, 255, 255, 0.669), 1035px 1277px 0 0px rgba(255, 255, 255, 0.585), 1327px 1363px 0 0px rgba(255, 255, 255, 0.699), 941px 1183px 0 0px rgba(255, 255, 255, 0.411), 135px 343px 0 0px rgba(255, 255, 255, 0.139), 243px 1272px 0 0px rgba(255, 255, 255, 0.817), 1722px 328px 0 0px rgba(255, 255, 255, 0.313);
115 |             border-radius: 100px;
116 |         }
117 | 
118 |         .solar-syst div {
119 |             border-radius: 1000px;
120 |             top: 50%;
121 |             left: 50%;
122 |             position: absolute;
123 |             z-index: 999;
124 |         }
125 | 
126 |         .solar-syst div:not(.sun) {
127 |             border: 1px solid rgba(102, 166, 229, 0.12);
128 |         }
129 | 
130 |         .solar-syst div:not(.sun):before {
131 |             left: 50%;
132 |             border-radius: 100px;
133 |             content: "";
134 |             position: absolute;
135 |         }
136 | 
137 |         .solar-syst div:not(.asteroids-belt):before {
138 |             -webkit-box-shadow: inset 0 6px 0 -2px rgba(0, 0, 0, 0.25);
139 |             box-shadow: inset 0 6px 0 -2px rgba(0, 0, 0, 0.25);
140 |         }
141 | 
142 |         .sun {
143 |             background: radial-gradient(ellipse at center, #ffd000 1%, #f9b700 39%, #f9b700 39%, #e06317 100%);
144 |             height: 40px;
145 |             width: 40px;
146 |             margin-top: -20px;
147 |             margin-left: -20px;
148 |             background-clip: padding-box;
149 |             border: 0 !important;
150 |             background-position: -28px -103px;
151 |             background-size: 175%;
152 |             -webkit-box-shadow: 0 0 10px 2px rgba(255, 107, 0, 0.4), 0 0 22px 11px rgba(255, 203, 0, 0.13);
153 |             box-shadow: 0 0 10px 2px rgba(255, 107, 0, 0.4), 0 0 22px 11px rgba(255, 203, 0, 0.13);
154 |         }
155 | 
156 |         .mercury {
157 |             height: 70px;
158 |             width: 70px;
159 |             margin-top: -35px;
160 |             margin-left: -35px;
161 |             -webkit-animation: orb 7.1867343561s linear infinite;
162 |             animation: orb 7.1867343561s linear infinite;
163 |         }
164 | 
165 |         .mercury:before {
166 |             height: 4px;
167 |             width: 4px;
168 |             background: #9f5e26;
169 |             margin-top: -2px;
170 |             margin-left: -2px;
171 |         }
172 | 
173 |         .venus {
174 |             height: 100px;
175 |             width: 100px;
176 |             margin-top: -50px;
177 |             margin-left: -50px;
178 |             -webkit-animation: orb 18.4555338265s linear infinite;
179 |             animation: orb 18.4555338265s linear infinite;
180 |         }
181 | 
182 |         .venus:before {
183 |             height: 8px;
184 |             width: 8px;
185 |             background: #BEB768;
186 |             margin-top: -4px;
187 |             margin-left: -4px;
188 |         }
189 | 
190 |         .earth {
191 |             height: 145px;
192 |             width: 145px;
193 |             margin-top: -72.5px;
194 |             margin-left: -72.5px;
195 |             -webkit-animation: orb 30s linear infinite;
196 |             animation: orb 30s linear infinite;
197 |         }
198 | 
199 |         .earth:before {
200 |             height: 6px;
201 |             width: 6px;
202 |             background: #11abe9;
203 |             margin-top: -3px;
204 |             margin-left: -3px;
205 |         }
206 | 
207 |         .earth:after {
208 |             position: absolute;
209 |             content: "";
210 |             height: 18px;
211 |             width: 18px;
212 |             left: 50%;
213 |             top: 0px;
214 |             margin-left: -9px;
215 |             margin-top: -9px;
216 |             border-radius: 100px;
217 |             -webkit-box-shadow: 0 -10px 0 -8px grey;
218 |             box-shadow: 0 -10px 0 -8px grey;
219 |             -webkit-animation: orb 2.2440352158s linear infinite;
220 |             animation: orb 2.2440352158s linear infinite;
221 |         }
222 | 
223 |         .mars {
224 |             height: 190px;
225 |             width: 190px;
226 |             margin-top: -95px;
227 |             margin-left: -95px;
228 |             -webkit-animation: orb 56.4261314589s linear infinite;
229 |             animation: orb 56.4261314589s linear infinite;
230 |         }
231 | 
232 |         .mars:before {
233 |             height: 6px;
234 |             width: 6px;
235 |             background: #cf3921;
236 |             margin-top: -3px;
237 |             margin-left: -3px;
238 |         }
239 | 
240 |         .jupiter {
241 |             height: 340px;
242 |             width: 340px;
243 |             margin-top: -170px;
244 |             margin-left: -170px;
245 |             -webkit-animation: orb 355.7228171013s linear infinite;
246 |             animation: orb 355.7228171013s linear infinite;
247 |         }
248 | 
249 |         .jupiter:before {
250 |             height: 18px;
251 |             width: 18px;
252 |             background: #c76e2a;
253 |             margin-top: -9px;
254 |             margin-left: -9px;
255 |         }
256 | 
257 |         .saturn {
258 |             height: 440px;
259 |             width: 440px;
260 |             margin-top: -220px;
261 |             margin-left: -220px;
262 |             -webkit-animation: orb 882.6952471456s linear infinite;
263 |             animation: orb 882.6952471456s linear infinite;
264 |         }
265 | 
266 |         .saturn:before {
267 |             height: 12px;
268 |             width: 12px;
269 |             background: #e7c194;
270 |             margin-top: -6px;
271 |             margin-left: -6px;
272 |         }
273 | 
274 |         .saturn:after {
275 |             position: absolute;
276 |             content: "";
277 |             height: 2.34%;
278 |             width: 4.676%;
279 |             left: 50%;
280 |             top: 0px;
281 |             -webkit-transform: rotateZ(-52deg);
282 |             transform: rotateZ(-52deg);
283 |             margin-left: -2.3%;
284 |             margin-top: -1.2%;
285 |             border-radius: 50% 50% 50% 50%;
286 |             -webkit-box-shadow: 0 1px 0 1px #987641, 3px 1px 0 #987641, -3px 1px 0 #987641;
287 |             box-shadow: 0 1px 0 1px #987641, 3px 1px 0 #987641, -3px 1px 0 #987641;
288 |             -webkit-animation: orb 882.6952471456s linear infinite;
289 |             animation: orb 882.6952471456s linear infinite;
290 |             animation-direction: reverse;
291 |             -webkit-transform-origin: 52% 60%;
292 |             transform-origin: 52% 60%;
293 |         }
294 | 
295 |         .uranus {
296 |             height: 520px;
297 |             width: 520px;
298 |             margin-top: -260px;
299 |             margin-left: -260px;
300 |             -webkit-animation: orb 2512.4001967933s linear infinite;
301 |             animation: orb 2512.4001967933s linear infinite;
302 |         }
303 | 
304 |         .uranus:before {
305 |             height: 10px;
306 |             width: 10px;
307 |             background: #b5e3e3;
308 |             margin-top: -5px;
309 |             margin-left: -5px;
310 |         }
311 | 
312 |         .neptune {
313 |             height: 630px;
314 |             width: 630px;
315 |             margin-top: -315px;
316 |             margin-left: -315px;
317 |             -webkit-animation: orb 4911.7838624549s linear infinite;
318 |             animation: orb 4911.7838624549s linear infinite;
319 |         }
320 | 
321 |         .neptune:before {
322 |             height: 10px;
323 |             width: 10px;
324 |             background: #175e9e;
325 |             margin-top: -5px;
326 |             margin-left: -5px;
327 |         }
328 | 
329 |         .asteroids-belt {
330 |             opacity: .7;
331 |             border-color: transparent !important;
332 |             height: 300px;
333 |             width: 300px;
334 |             margin-top: -150px;
335 |             margin-left: -150px;
336 |             -webkit-animation: orb 179.9558282773s linear infinite;
337 |             animation: orb 179.9558282773s linear infinite;
338 |             overflow: hidden;
339 |         }
340 | 
341 |         .asteroids-belt:before {
342 |             top: 50%;
343 |             height: 210px;
344 |             width: 210px;
345 |             margin-left: -105px;
346 |             margin-top: -105px;
347 |             background: transparent;
348 |             border-radius: 140px !important;
349 |             box-shadow: 21px 52px 0 -104px rgba(255, 255, 255, 0.073), -19px -129px 0 -104px rgba(255, 255, 255, 0.707), 144px -84px 0 -104px rgba(255, 255, 255, 0.586), 88px -123px 0 -104px rgba(255, 255, 255, 0.487), -142px 70px 0 -104px rgba(255, 255, 255, 0.62), 115px 70px 0 -104px rgba(255, 255, 255, 0.697), -133px -53px 0 -104px rgba(255, 255, 255, 0.28), -54px 40px 0 -104px rgba(255, 255, 255, 0.264), 81px -86px 0 -104px rgba(255, 255, 255, 0.521), 70px -36px 0 -104px rgba(255, 255, 255, 0.907), -113px -71px 0 -104px rgba(255, 255, 255, 0.808), -122px -45px 0 -104px rgba(255, 255, 255, 0.699), 110px 129px 0 -104px rgba(255, 255, 255, 0.289), -55px -96px 0 -104px rgba(255, 255, 255, 0.667), -31px -48px 0 -104px rgba(255, 255, 255, 0.688), -111px 14px 0 -104px rgba(255, 255, 255, 0.063), 71px -107px 0 -104px rgba(255, 255, 255, 0.105), -94px 18px 0 -104px rgba(255, 255, 255, 0.345), 96px 52px 0 -104px rgba(255, 255, 255, 0.131), -128px 26px 0 -104px rgba(255, 255, 255, 0.554), -32px -69px 0 -104px rgba(255, 255, 255, 0.552), -39px 113px 0 -104px rgba(255, 255, 255, 0.66), 42px 55px 0 -104px rgba(255, 255, 255, 0.055), 28px -17px 0 -104px rgba(255, 255, 255, 0.846), 97px -51px 0 -104px rgba(255, 255, 255, 0.274), -93px -144px 0 -104px rgba(255, 255, 255, 0.884), -74px -144px 0 -104px rgba(255, 255, 255, 0.985), 62px -39px 0 -104px rgba(255, 255, 255, 0.22), -97px -111px 0 -104px rgba(255, 255, 255, 0.713), -141px -35px 0 -104px rgba(255, 255, 255, 0.307), -78px -111px 0 -104px rgba(255, 255, 255, 0.363), 68px 36px 0 -104px rgba(255, 255, 255, 0.331), 121px 111px 0 -104px rgba(255, 255, 255, 0.202), -96px 11px 0 -104px rgba(255, 255, 255, 0.583), 18px 46px 0 -104px rgba(255, 255, 255, 0.483), -42px 24px 0 -104px rgba(255, 255, 255, 0.39), 28px 87px 0 -104px rgba(255, 255, 255, 0.592), 76px 84px 0 -104px rgba(255, 255, 255, 0.384), 133px -66px 0 -104px rgba(255, 255, 255, 0.492), 113px -55px 0 -104px rgba(255, 255, 255, 0.728), -20px -142px 0 -104px rgba(255, 255, 255, 0.928), 17px 45px 0 -104px rgba(255, 255, 255, 0.916), 99px -81px 0 -104px rgba(255, 255, 255, 0.484), -66px 53px 0 -104px rgba(255, 255, 255, 0.773), 23px -41px 0 -104px rgba(255, 255, 255, 0.466), -117px 84px 0 -104px rgba(255, 255, 255, 0.58), 119px 10px 0 -104px rgba(255, 255, 255, 0.836), -48px 68px 0 -104px rgba(255, 255, 255, 0.267), 83px -83px 0 -104px rgba(255, 255, 255, 0.786), 126px -79px 0 -104px rgba(255, 255, 255, 0.042), -109px -74px 0 -104px rgba(255, 255, 255, 0.242), 6px 68px 0 -104px rgba(255, 255, 255, 0.578), -61px 0px 0 -104px rgba(255, 255, 255, 0.694), -131px -18px 0 -104px rgba(255, 255, 255, 0.861), 78px -53px 0 -104px rgba(255, 255, 255, 0.767), -86px -43px 0 -104px rgba(255, 255, 255, 0.899), 54px 22px 0 -104px rgba(255, 255, 255, 0.838), 32px 96px 0 -104px rgba(255, 255, 255, 0.638), 107px -127px 0 -104px rgba(255, 255, 255, 0.459), -133px -46px 0 -104px rgba(255, 255, 255, 0.78), 77px 17px 0 -104px rgba(255, 255, 255, 0.495), 57px -10px 0 -104px rgba(255, 255, 255, 0.526), -111px -34px 0 -104px rgba(255, 255, 255, 0.158), 13px -20px 0 -104px rgba(255, 255, 255, 0.26), 135px -117px 0 -104px rgba(255, 255, 255, 0.348), 48px -45px 0 -104px rgba(255, 255, 255, 0.134), -24px 95px 0 -104px rgba(255, 255, 255, 0.502), 76px -46px 0 -104px rgba(255, 255, 255, 0.473), -19px 80px 0 -104px rgba(255, 255, 255, 0.072), 71px 145px 0 -104px rgba(255, 255, 255, 0.586), -57px 125px 0 -104px rgba(255, 255, 255, 0.852), 80px -80px 0 -104px rgba(255, 255, 255, 0.808), 85px 48px 0 -104px rgba(255, 255, 255, 0.647), 120px -24px 0 -104px rgba(255, 255, 255, 0.997), -114px 6px 0 -104px rgba(255, 255, 255, 0.548), -35px -74px 0 -104px rgba(255, 255, 255, 0.298), -114px 21px 0 -104px rgba(255, 255, 255, 0.108), 16px -108px 0 -104px rgba(255, 255, 255, 0.646), -122px -143px 0 -104px rgba(255, 255, 255, 0.842), 21px 85px 0 -104px rgba(255, 255, 255, 0.731), -45px -86px 0 -104px rgba(255, 255, 255, 0.397), 59px 46px 0 -104px rgba(255, 255, 255, 0.729), 122px 140px 0 -104px rgba(255, 255, 255, 0.942), 71px -9px 0 -104px rgba(255, 255, 255, 0.488), 67px -101px 0 -104px rgba(255, 255, 255, 0.922), -85px 118px 0 -104px rgba(255, 255, 255, 0.255), 143px -36px 0 -104px rgba(255, 255, 255, 0.607), -91px -9px 0 -104px rgba(255, 255, 255, 0.271), -103px 70px 0 -104px rgba(255, 255, 255, 0.856), 81px -71px 0 -104px rgba(255, 255, 255, 0.194), -90px -61px 0 -104px rgba(255, 255, 255, 0.557), -54px 27px 0 -104px rgba(255, 255, 255, 0.713), 50px 70px 0 -104px rgba(255, 255, 255, 0.082), -20px -133px 0 -104px rgba(255, 255, 255, 0.681), 30px 32px 0 -104px rgba(255, 255, 255, 0.106), 20px -54px 0 -104px rgba(255, 255, 255, 0.95), -44px 115px 0 -104px rgba(255, 255, 255, 0.524), 20px -28px 0 -104px rgba(255, 255, 255, 0.393), 40px -118px 0 -104px rgba(255, 255, 255, 0.519), 18px 82px 0 -104px rgba(255, 255, 255, 0.268), 143px 85px 0 -104px rgba(255, 255, 255, 0.758), -21px -52px 0 -104px rgba(255, 255, 255, 0.87), -57px 18px 0 -104px rgba(255, 255, 255, 0.199), -97px 28px 0 -104px rgba(255, 255, 255, 0.061), 41px 108px 0 -104px rgba(255, 255, 255, 0.239), 6px -136px 0 -104px rgba(255, 255, 255, 0.637), 101px 33px 0 -104px rgba(255, 255, 255, 0.186), -107px -37px 0 -104px rgba(255, 255, 255, 0.463), -113px -82px 0 -104px rgba(255, 255, 255, 0.068), 15px 88px 0 -104px rgba(255, 255, 255, 0.119), -128px 72px 0 -104px rgba(255, 255, 255, 0.215), -30px 61px 0 -104px rgba(255, 255, 255, 0.829), 9px 6px 0 -104px rgba(255, 255, 255, 0.15), -95px -64px 0 -104px rgba(255, 255, 255, 0.575), -79px -50px 0 -104px rgba(255, 255, 255, 0.181), -93px 95px 0 -104px rgba(255, 255, 255, 0.371), -28px 38px 0 -104px rgba(255, 255, 255, 0.126), 125px -44px 0 -104px rgba(255, 255, 255, 0.424), -142px -92px 0 -104px rgba(255, 255, 255, 0.128), 52px 16px 0 -104px rgba(255, 255, 255, 0.548), 82px 122px 0 -104px rgba(255, 255, 255, 0.75), -104px -43px 0 -104px rgba(255, 255, 255, 0.017), 23px 27px 0 -104px rgba(255, 255, 255, 0.936), -52px -131px 0 -104px rgba(255, 255, 255, 0.223), -120px -90px 0 -104px rgba(255, 255, 255, 0.179), 125px 124px 0 -104px rgba(255, 255, 255, 0.917), 62px -128px 0 -104px rgba(255, 255, 255, 0.597), 82px 92px 0 -104px rgba(255, 255, 255, 0.823), -32px -107px 0 -104px rgba(255, 255, 255, 0.17), 137px -65px 0 -104px rgba(255, 255, 255, 0.151), 25px 2px 0 -104px rgba(255, 255, 255, 0.547), 57px -84px 0 -104px rgba(255, 255, 255, 0.919), -50px -38px 0 -104px rgba(255, 255, 255, 0.924), 4px 44px 0 -104px rgba(255, 255, 255, 0.514), -80px 15px 0 -104px rgba(255, 255, 255, 0.86), 101px -101px 0 -104px rgba(255, 255, 255, 0.894), -70px 145px 0 -104px rgba(255, 255, 255, 0.388), -8px -137px 0 -104px rgba(255, 255, 255, 0.136), -24px -27px 0 -104px rgba(255, 255, 255, 0.787), -117px -36px 0 -104px rgba(255, 255, 255, 0.965), -65px 100px 0 -104px rgba(255, 255, 255, 0.724), 115px -50px 0 -104px rgba(255, 255, 255, 0.155), -41px 32px 0 -104px rgba(255, 255, 255, 0.627), -120px -104px 0 -104px rgba(255, 255, 255, 0.467), 105px 74px 0 -104px rgba(255, 255, 255, 0.521), 11px 15px 0 -104px rgba(255, 255, 255, 0.574), -116px 92px 0 -104px rgba(255, 255, 255, 0.328), -1px -98px 0 -104px rgba(255, 255, 255, 0.541), 109px -104px 0 -104px rgba(255, 255, 255, 0.169), -127px -133px 0 -104px rgba(255, 255, 255, 0.815), -35px 35px 0 -104px rgba(255, 255, 255, 0.333), -25px 28px 0 -104px rgba(255, 255, 255, 0.822), 145px -108px 0 -104px rgba(255, 255, 255, 0.978), 124px 144px 0 -104px rgba(255, 255, 255, 0.903), 44px 28px 0 -104px rgba(255, 255, 255, 0.328), 32px -79px 0 -104px rgba(255, 255, 255, 0.98), 19px 105px 0 -104px rgba(255, 255, 255, 0.594), 129px -126px 0 -104px rgba(255, 255, 255, 0.868), 129px 33px 0 -104px rgba(255, 255, 255, 0.679), 32px 30px 0 -104px rgba(255, 255, 255, 0.942), -78px 101px 0 -104px rgba(255, 255, 255, 0.804), 106px 104px 0 -104px rgba(255, 255, 255, 0.102), -2px -137px 0 -104px rgba(255, 255, 255, 0.092), 0px 65px 0 -104px rgba(255, 255, 255, 0.59), -121px 102px 0 -104px rgba(255, 255, 255, 0.001), 79px -18px 0 -104px rgba(255, 255, 255, 0.469), -27px -103px 0 -104px rgba(255, 255, 255, 0.45), -79px -39px 0 -104px rgba(255, 255, 255, 0.314), -88px 37px 0 -104px rgba(255, 255, 255, 0.833), -61px -27px 0 -104px rgba(255, 255, 255, 0.122), -70px -125px 0 -104px rgba(255, 255, 255, 0.477), 103px 79px 0 -104px rgba(255, 255, 255, 0.345), 25px 14px 0 -104px rgba(255, 255, 255, 0.796), -131px 22px 0 -104px rgba(255, 255, 255, 0.752), -115px -79px 0 -104px rgba(255, 255, 255, 0.143), -47px -54px 0 -104px rgba(255, 255, 255, 0.688), 58px -63px 0 -104px rgba(255, 255, 255, 0.423), -62px -46px 0 -104px rgba(255, 255, 255, 0.224), 122px -54px 0 -104px rgba(255, 255, 255, 0.847), -122px -57px 0 -104px rgba(255, 255, 255, 0.706), -8px -99px 0 -104px rgba(255, 255, 255, 0.696), 95px -27px 0 -104px rgba(255, 255, 255, 0.255), -10px -25px 0 -104px rgba(255, 255, 255, 0.357), -90px 67px 0 -104px rgba(255, 255, 255, 0.23), -65px 132px 0 -104px rgba(255, 255, 255, 0.695), -74px 122px 0 -104px rgba(255, 255, 255, 0.804), 51px -34px 0 -104px rgba(255, 255, 255, 0.232), -87px 20px 0 -104px rgba(255, 255, 255, 0.232), 42px 58px 0 -104px rgba(255, 255, 255, 0.477), 85px -124px 0 -104px rgba(255, 255, 255, 0.343), 102px 1px 0 -104px rgba(255, 255, 255, 0.674), 134px -116px 0 -104px rgba(255, 255, 255, 0.23), -110px 63px 0 -104px rgba(255, 255, 255, 0.876), 13px 55px 0 -104px rgba(255, 255, 255, 0.33), -102px 16px 0 -104px rgba(255, 255, 255, 0.896), -31px 53px 0 -104px rgba(255, 255, 255, 0.102), -142px 49px 0 -104px rgba(255, 255, 255, 0.451), 9px -61px 0 -104px rgba(255, 255, 255, 0.451), -35px 14px 0 -104px rgba(255, 255, 255, 0.751), 122px 145px 0 -104px rgba(255, 255, 255, 0.31), 142px -25px 0 -104px rgba(255, 255, 255, 0.893), -61px 141px 0 -104px rgba(255, 255, 255, 0.643), 4px -1px 0 -104px rgba(255, 255, 255, 0.114), -52px 113px 0 -104px rgba(255, 255, 255, 0.747), -128px 132px 0 -104px rgba(255, 255, 255, 0.606), 2px -131px 0 -104px rgba(255, 255, 255, 0.911), -129px 34px 0 -104px rgba(255, 255, 255, 0.735), 43px 139px 0 -104px rgba(255, 255, 255, 0.802), -99px -114px 0 -104px rgba(255, 255, 255, 0.688), 113px 141px 0 -104px rgba(255, 255, 255, 0.931), 132px -117px 0 -104px rgba(255, 255, 255, 0.913), -33px -15px 0 -104px rgba(255, 255, 255, 0.048), 82px -88px 0 -104px rgba(255, 255, 255, 0.191), 79px 40px 0 -104px rgba(255, 255, 255, 0.735), -120px -127px 0 -104px rgba(255, 255, 255, 0.895), 83px -9px 0 -104px rgba(255, 255, 255, 0.459), 26px 27px 0 -104px rgba(255, 255, 255, 0.958), -133px 48px 0 -104px rgba(255, 255, 255, 0.203), -85px -50px 0 -104px rgba(255, 255, 255, 0.23), 113px 65px 0 -104px rgba(255, 255, 255, 0.377), 52px -48px 0 -104px rgba(255, 255, 255, 0.763), -48px -130px 0 -104px rgba(255, 255, 255, 0.056), 137px 132px 0 -104px rgba(255, 255, 255, 0.796), 73px -43px 0 -104px rgba(255, 255, 255, 0.874), -121px -115px 0 -104px rgba(255, 255, 255, 0.522), -97px 128px 0 -104px rgba(255, 255, 255, 0.843), -8px -103px 0 -104px rgba(255, 255, 255, 0.304), 137px 75px 0 -104px rgba(255, 255, 255, 0.973), 100px 69px 0 -104px rgba(255, 255, 255, 0.298), 21px -83px 0 -104px rgba(255, 255, 255, 0.853), 25px 81px 0 -104px rgba(255, 255, 255, 0.42), 44px 68px 0 -104px rgba(255, 255, 255, 0.023), -90px 140px 0 -104px rgba(255, 255, 255, 0.123), -83px 0px 0 -104px rgba(255, 255, 255, 0.903), 111px 49px 0 -104px rgba(255, 255, 255, 0.326), 32px 134px 0 -104px rgba(255, 255, 255, 0.762), -65px 61px 0 -104px rgba(255, 255, 255, 0.793), 24px -144px 0 -104px rgba(255, 255, 255, 0.996), -52px -120px 0 -104px rgba(255, 255, 255, 0.56), 131px 91px 0 -104px rgba(255, 255, 255, 0.593), 131px -94px 0 -104px rgba(255, 255, 255, 0.08), 142px -132px 0 -104px rgba(255, 255, 255, 0.91), 134px -91px 0 -104px rgba(255, 255, 255, 0.149), 12px 139px 0 -104px rgba(255, 255, 255, 0.261), -41px -48px 0 -104px rgba(255, 255, 255, 0.855), -70px -21px 0 -104px rgba(255, 255, 255, 0.744), -32px 9px 0 -104px rgba(255, 255, 255, 0.811), -127px -38px 0 -104px rgba(255, 255, 255, 0.586), 123px -71px 0 -104px rgba(255, 255, 255, 0.964), -70px -37px 0 -104px rgba(255, 255, 255, 0.914), -15px -48px 0 -104px rgba(255, 255, 255, 0.003), 87px 43px 0 -104px rgba(255, 255, 255, 0.272), -80px 135px 0 -104px rgba(255, 255, 255, 0.378), 90px -32px 0 -104px rgba(255, 255, 255, 0.325), -80px 44px 0 -104px rgba(255, 255, 255, 0.399), -70px 142px 0 -104px rgba(255, 255, 255, 0.312), -49px -108px 0 -104px rgba(255, 255, 255, 0.138), 47px 145px 0 -104px rgba(255, 255, 255, 0.97), -110px -104px 0 -104px rgba(255, 255, 255, 0.379), 88px 60px 0 -104px rgba(255, 255, 255, 0.784), 82px 23px 0 -104px rgba(255, 255, 255, 0.533), -45px -101px 0 -104px rgba(255, 255, 255, 0.2), 130px 14px 0 -104px rgba(255, 255, 255, 0.81), -37px 144px 0 -104px rgba(255, 255, 255, 0.274), -58px 24px 0 -104px rgba(255, 255, 255, 0.809), 110px -144px 0 -104px rgba(255, 255, 255, 0.481), 112px -80px 0 -104px rgba(255, 255, 255, 0.78), -60px -33px 0 -104px rgba(255, 255, 255, 0.213), -48px 102px 0 -104px rgba(255, 255, 255, 0.042), 5px -139px 0 -104px rgba(255, 255, 255, 0.237), 53px -42px 0 -104px rgba(255, 255, 255, 0.5), 130px 69px 0 -104px rgba(255, 255, 255, 0.236), -2px 116px 0 -104px rgba(255, 255, 255, 0.949), -3px -6px 0 -104px rgba(255, 255, 255, 0.711), -13px -45px 0 -104px rgba(255, 255, 255, 0.101), -49px -125px 0 -104px rgba(255, 255, 255, 0.777), -122px -35px 0 -104px rgba(255, 255, 255, 0.496), 123px -35px 0 -104px rgba(255, 255, 255, 0.355), -29px -93px 0 -104px rgba(255, 255, 255, 0.112), -36px -79px 0 -104px rgba(255, 255, 255, 0.809), -109px -40px 0 -104px rgba(255, 255, 255, 0.4), -63px 60px 0 -104px rgba(255, 255, 255, 0.617), 28px -34px 0 -104px rgba(255, 255, 255, 0.527), 37px -36px 0 -104px rgba(255, 255, 255, 0.913), 132px -12px 0 -104px rgba(255, 255, 255, 0.668), 18px -79px 0 -104px rgba(255, 255, 255, 0.06), -108px -111px 0 -104px rgba(255, 255, 255, 0.85), 128px -61px 0 -104px rgba(255, 255, 255, 0.885), 57px -7px 0 -104px rgba(255, 255, 255, 0.696), 53px 91px 0 -104px rgba(255, 255, 255, 0.656), -50px -57px 0 -104px rgba(255, 255, 255, 0.952), -35px -100px 0 -104px rgba(255, 255, 255, 0.808), -116px 95px 0 -104px rgba(255, 255, 255, 0.073), -11px -143px 0 -104px rgba(255, 255, 255, 0.835), -32px 66px 0 -104px rgba(255, 255, 255, 0.467), -41px -32px 0 -104px rgba(255, 255, 255, 0.222), 145px 7px 0 -104px rgba(255, 255, 255, 0.911), 44px -64px 0 -104px rgba(255, 255, 255, 0.567), -84px 138px 0 -104px rgba(255, 255, 255, 0.952), 56px 139px 0 -104px rgba(255, 255, 255, 0.053), -6px 122px 0 -104px rgba(255, 255, 255, 0.07), -20px 72px 0 -104px rgba(255, 255, 255, 0.371), -138px -14px 0 -104px rgba(255, 255, 255, 0.35), 86px 136px 0 -104px rgba(255, 255, 255, 0.469), 106px 20px 0 -104px rgba(255, 255, 255, 0.438), 143px -80px 0 -104px rgba(255, 255, 255, 0.97), -130px -21px 0 -104px rgba(255, 255, 255, 0.514), 77px -110px 0 -104px rgba(255, 255, 255, 0.173), -32px 54px 0 -104px rgba(255, 255, 255, 0.657), 111px -66px 0 -104px rgba(255, 255, 255, 0.649), -93px 52px 0 -104px rgba(255, 255, 255, 0.096), 68px 12px 0 -104px rgba(255, 255, 255, 0.764), -65px 28px 0 -104px rgba(255, 255, 255, 0.707), -31px -105px 0 -104px rgba(255, 255, 255, 0.632), -33px -1px 0 -104px rgba(255, 255, 255, 0.998), -6px -8px 0 -104px rgba(255, 255, 255, 0.543), -70px 23px 0 -104px rgba(255, 255, 255, 0.037), 94px -106px 0 -104px rgba(255, 255, 255, 0.914), 71px -47px 0 -104px rgba(255, 255, 255, 0.332), 120px -120px 0 -104px rgba(255, 255, 255, 0.53), 47px -2px 0 -104px rgba(255, 255, 255, 0.162), -5px 58px 0 -104px rgba(255, 255, 255, 0.812), 81px -124px 0 -104px rgba(255, 255, 255, 0.362), 4px -64px 0 -104px rgba(255, 255, 255, 0.052), -72px 93px 0 -104px rgba(255, 255, 255, 0.203), -136px 53px 0 -104px rgba(255, 255, 255, 0.621), 100px -12px 0 -104px rgba(255, 255, 255, 0.542), -120px 32px 0 -104px rgba(255, 255, 255, 0.792), 29px 72px 0 -104px rgba(255, 255, 255, 0.323), 64px -47px 0 -104px rgba(255, 255, 255, 0.454), -128px 121px 0 -104px rgba(255, 255, 255, 0.819), 81px 91px 0 -104px rgba(255, 255, 255, 0.21), -91px -8px 0 -104px rgba(255, 255, 255, 0.549), 16px 101px 0 -104px rgba(255, 255, 255, 0.65), -46px 107px 0 -104px rgba(255, 255, 255, 0.374), -22px -44px 0 -104px rgba(255, 255, 255, 0.664), -105px -98px 0 -104px rgba(255, 255, 255, 0.968), 30px 12px 0 -104px rgba(255, 255, 255, 0.333), -3px -137px 0 -104px rgba(255, 255, 255, 0.162), -91px -4px 0 -104px rgba(255, 255, 255, 0.754), 35px -108px 0 -104px rgba(255, 255, 255, 0.977), 144px -89px 0 -104px rgba(255, 255, 255, 0.661), -91px -75px 0 -104px rgba(255, 255, 255, 0.542), 109px -44px 0 -104px rgba(255, 255, 255, 0.978), -32px 123px 0 -104px rgba(255, 255, 255, 0.968), -9px 68px 0 -104px rgba(255, 255, 255, 0.135), -10px 57px 0 -104px rgba(255, 255, 255, 0.863), -142px -109px 0 -104px rgba(255, 255, 255, 0.878), 84px 91px 0 -104px rgba(255, 255, 255, 0.915), -122px -63px 0 -104px rgba(255, 255, 255, 0.622), 62px 120px 0 -104px rgba(255, 255, 255, 0.645), 36px -124px 0 -104px rgba(255, 255, 255, 0.985), -85px -80px 0 -104px rgba(255, 255, 255, 0.634), -48px 99px 0 -104px rgba(255, 255, 255, 0.268), -125px 30px 0 -104px rgba(255, 255, 255, 0.556), -131px 10px 0 -104px rgba(255, 255, 255, 0.281), 41px -8px 0 -104px rgba(255, 255, 255, 0.61), -29px 105px 0 -104px rgba(255, 255, 255, 0.798), 13px 123px 0 -104px rgba(255, 255, 255, 0.049), 43px 108px 0 -104px rgba(255, 255, 255, 0.781), -110px 94px 0 -104px rgba(255, 255, 255, 0.009), -38px -60px 0 -104px rgba(255, 255, 255, 0.677), 16px 83px 0 -104px rgba(255, 255, 255, 0.012), 17px -15px 0 -104px rgba(255, 255, 255, 0.596), 72px -102px 0 -104px rgba(255, 255, 255, 0.847), 79px 71px 0 -104px rgba(255, 255, 255, 0.377), 109px 65px 0 -104px rgba(255, 255, 255, 0.165), 4px 107px 0 -104px rgba(255, 255, 255, 0.728), 6px -76px 0 -104px rgba(255, 255, 255, 0.38), 51px -28px 0 -104px rgba(255, 255, 255, 0.456), -136px -34px 0 -104px rgba(255, 255, 255, 0.548), -4px -12px 0 -104px rgba(255, 255, 255, 0.297), -44px -107px 0 -104px rgba(255, 255, 255, 0.737), 88px -58px 0 -104px rgba(255, 255, 255, 0.989), 2px -69px 0 -104px rgba(255, 255, 255, 0.961), -86px -11px 0 -104px rgba(255, 255, 255, 0.385), 46px 131px 0 -104px rgba(255, 255, 255, 0.113), -28px -66px 0 -104px rgba(255, 255, 255, 0.269), -16px 125px 0 -104px rgba(255, 255, 255, 0.134), 115px 65px 0 -104px rgba(255, 255, 255, 0.644), 54px -68px 0 -104px rgba(255, 255, 255, 0.78), -122px 111px 0 -104px rgba(255, 255, 255, 0.957), 50px -85px 0 -104px rgba(255, 255, 255, 0.887), -85px -113px 0 -104px rgba(255, 255, 255, 0.237), -48px -1px 0 -104px rgba(255, 255, 255, 0.389), 116px 73px 0 -104px rgba(255, 255, 255, 0.959), -98px 81px 0 -104px rgba(255, 255, 255, 0.892), -129px -94px 0 -104px rgba(255, 255, 255, 0.548), 10px 138px 0 -104px rgba(255, 255, 255, 0.199), -49px 28px 0 -104px rgba(255, 255, 255, 0.234);
350 |         }
351 | 
352 |         .pluto {
353 |             height: 780px;
354 |             width: 780px;
355 |             margin-top: -450px;
356 |             margin-left: -320px;
357 |             -webkit-animation: orb 7439.7074054575s linear infinite;
358 |             animation: orb 7439.7074054575s linear infinite;
359 |         }
360 | 
361 |         .pluto:before {
362 |             height: 3px;
363 |             width: 3px;
364 |             background: #fff;
365 |             margin-top: -1.5px;
366 |             margin-left: -1.5px;
367 |         }
368 | 
369 |         @-webkit-keyframes orb {
370 |             from {
371 |                 -webkit-transform: rotate(0deg);
372 |                 transform: rotate(0deg);
373 |             }
374 |             to {
375 |                 -webkit-transform: rotate(-360deg);
376 |                 transform: rotate(-360deg);
377 |             }
378 |         }
379 | 
380 |         @keyframes orb {
381 |             from {
382 |                 -webkit-transform: rotate(0deg);
383 |                 transform: rotate(0deg);
384 |             }
385 |             to {
386 |                 -webkit-transform: rotate(-360deg);
387 |                 transform: rotate(-360deg);
388 |             }
389 |         }
390 |     </style>
391 | </head>
392 | <body>
393 |     <div class='description'>
394 |         <h1>{{status}}<br>{{status_msg}}</h1>
395 |         <hr>
396 |         <p class='author'>
397 |             Animation based on
398 |             <a href="https://codepen.io/kowlor/pen/ZYYQoy">Solar System</a>
399 |             by <a href="https://codepen.io/kowlor/">Malik Dellidj</a>
400 |         </p>
401 |     </div>
402 |     <div class='solar-syst'>
403 |         <div class='sun'></div>
404 |         <div class='mercury'></div>
405 |         <div class='venus'></div>
406 |         <div class='earth'></div>
407 |         <div class='mars'></div>
408 |         <div class='jupiter'></div>
409 |         <div class='saturn'></div>
410 |         <div class='uranus'></div>
411 |         <div class='neptune'></div>
412 |         <div class='pluto'></div>
413 |         <div class='asteroids-belt'></div>
414 |     </div>
415 | </body>
416 | </html>
417 | 


--------------------------------------------------------------------------------