From b2d22f3836f01d140d534b131aed9b112db94285 Mon Sep 17 00:00:00 2001 From: Matthew Lopez <73856503+MatthewL246@users.noreply.github.com> Date: Sat, 11 May 2024 00:53:13 +0000 Subject: [PATCH] Disable unused and broken nginx SSL support It was causing timing issues in CI because of mitmproxy's certificate generation. Making this work for real will require compiling nginx from source anyway. --- compose.yml | 6 ------ config/nginx.conf | 12 ++---------- config/nginx/account.conf | 1 - config/nginx/boss.conf | 1 - config/nginx/cdn.conf | 1 - config/nginx/default.conf | 1 - config/nginx/juxtaposition.conf | 1 - config/nginx/miiverse-api.conf | 1 - config/nginx/minio.conf | 1 - config/nginx/redirect.conf | 1 - config/nginx/website.conf | 1 - 11 files changed, 2 insertions(+), 25 deletions(-) diff --git a/compose.yml b/compose.yml index e316e7b..e72f570 100644 --- a/compose.yml +++ b/compose.yml @@ -40,8 +40,6 @@ services: ports: # HTTP - 80:80 - # HTTPS (supports TLSv1.0 for Wii U) - - 443:443 volumes: - type: bind source: ./config/nginx.conf @@ -54,10 +52,6 @@ services: - type: bind source: ./logs/nginx/ target: /var/log/nginx/ - - type: volume - source: mitmproxy-pretendo-data - target: /etc/nginx/mitmproxy-certs - read_only: true networks: default: internal: diff --git a/config/nginx.conf b/config/nginx.conf index 4339b1f..ef8379c 100644 --- a/config/nginx.conf +++ b/config/nginx.conf @@ -13,9 +13,8 @@ http { include /etc/nginx/mime.types; default_type application/octet-stream; - log_format main '$remote_addr - $remote_user [$time_local] ($ssl_protocol ' - '$ssl_cipher) $host "$request" $status $body_bytes_sent "$http_referer" ' - '"$http_user_agent" $request_time'; + log_format main '$remote_addr - $remote_user [$time_local] $host "$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" "$http_x_forwarded_for" $request_time'; access_log /var/log/nginx/access.log main; access_log /dev/stdout main; @@ -28,12 +27,5 @@ http { resolver 127.0.0.11 valid=600s; - ssl_certificate /etc/nginx/mitmproxy-certs/mitmproxy-ca-cert.pem; - ssl_certificate_key /etc/nginx/mitmproxy-certs/mitmproxy-ca.pem; - - # The Wii U needs to connect using TLSv1.0 - ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; - ssl_ciphers DEFAULT:ECDHE-RSA-AES128-SHA:@SECLEVEL=0; - include /etc/nginx/conf.d/*.conf; } diff --git a/config/nginx/account.conf b/config/nginx/account.conf index 1d52452..322c14a 100644 --- a/config/nginx/account.conf +++ b/config/nginx/account.conf @@ -1,6 +1,5 @@ server { listen 80; - listen 443 ssl; server_name account.pretendo.cc c.account.pretendo.cc conntest.pretendo.cc cbvc.cdn.pretendo.cc nasc.pretendo.cc datastore.pretendo.cc api.pretendo.cc assets.pretendo.cc; diff --git a/config/nginx/boss.conf b/config/nginx/boss.conf index 176f78d..644acc4 100644 --- a/config/nginx/boss.conf +++ b/config/nginx/boss.conf @@ -1,6 +1,5 @@ server { listen 80; - listen 443 ssl; server_name npdi.cdn.pretendo.cc npdl.cdn.pretendo.cc npfl.c.app.pretendo.cc nppl.c.app.pretendo.cc nppl.app.pretendo.cc npts.app.pretendo.cc; diff --git a/config/nginx/cdn.conf b/config/nginx/cdn.conf index 67003a9..1f6e199 100644 --- a/config/nginx/cdn.conf +++ b/config/nginx/cdn.conf @@ -1,6 +1,5 @@ server { listen 80; - listen 443 ssl; server_name cdn.pretendo.cc mii.olv.pretendo.cc pretendo-cdn.b-cdn.net; set $upstream http://pn-cdn.minio.pretendo.cc; diff --git a/config/nginx/default.conf b/config/nginx/default.conf index f811eb4..d127cc5 100644 --- a/config/nginx/default.conf +++ b/config/nginx/default.conf @@ -1,6 +1,5 @@ server { listen 80 default_server; - listen 443 ssl default_server; location / { return 404; diff --git a/config/nginx/juxtaposition.conf b/config/nginx/juxtaposition.conf index e19feee..4c39ebc 100644 --- a/config/nginx/juxtaposition.conf +++ b/config/nginx/juxtaposition.conf @@ -1,6 +1,5 @@ server { listen 80; - listen 443 ssl; server_name juxt.pretendo.network juxt-test.pretendo.network juxt-dev.pretendo.network portal.olv.pretendo.cc portal-test.olv.pretendo.cc portal-dev.olv.pretendo.cc ctr.olv.pretendo.cc ctr-test.olv.pretendo.cc ctr-dev.olv.pretendo.cc; diff --git a/config/nginx/miiverse-api.conf b/config/nginx/miiverse-api.conf index 1a87be3..36aa0ee 100644 --- a/config/nginx/miiverse-api.conf +++ b/config/nginx/miiverse-api.conf @@ -1,6 +1,5 @@ server { listen 80; - listen 443 ssl; server_name api.olv.pretendo.cc api-test.olv.pretendo.cc api-dev.olv.pretendo.cc discovery.olv.pretendo.cc discovery-test.olv.pretendo.cc discovery-dev.olv.pretendo.cc; diff --git a/config/nginx/minio.conf b/config/nginx/minio.conf index 7ffb02b..cdc6b79 100644 --- a/config/nginx/minio.conf +++ b/config/nginx/minio.conf @@ -5,7 +5,6 @@ server { # it based on the endpoint it is configured with, and the server calculates it based on the Host header it recieves. # So, if the client send a request using port 9000 but the reverse proxy sends a Host header without a port, the # signature will not match. Limiting the reverse proxy to listen only on default ports fixes this. - listen 443 ssl; server_name minio.pretendo.cc pn-cdn.minio.pretendo.cc pn-boss.minio.pretendo.cc super-mario-maker.minio.pretendo.cc; set $upstream http://minio:9000; diff --git a/config/nginx/redirect.conf b/config/nginx/redirect.conf index 75cea79..ff8283a 100644 --- a/config/nginx/redirect.conf +++ b/config/nginx/redirect.conf @@ -1,6 +1,5 @@ server { listen 80; - listen 443 ssl; server_name pretendo.cc www.pretendo.cc; location / { diff --git a/config/nginx/website.conf b/config/nginx/website.conf index 3a79710..1e020ba 100644 --- a/config/nginx/website.conf +++ b/config/nginx/website.conf @@ -1,6 +1,5 @@ server { listen 80; - listen 443 ssl; server_name pretendo.network www.pretendo.network; set $upstream http://website:8080;