nginx.conf

# Copyright (c) 2024 Battelle Energy Alliance, LLC.  All rights reserved.

daemon off;

worker_processes 1;

events { worker_connections 1024; }

http {

  include /etc/nginx/mime.types;
  sendfile on;

  client_max_body_size 20m;

  fastcgi_buffers 16 64k;
  fastcgi_buffer_size 256k;
  fastcgi_read_timeout 300s;
  fastcgi_busy_buffers_size 384k;
  fastcgi_request_buffering off;

  proxy_connect_timeout 180s;
  proxy_read_timeout 300s;
  proxy_send_timeout 300s;
  proxy_buffer_size 512k;
  proxy_buffers 16 4m;
  proxy_busy_buffers_size 16m;

  # if LDAP authentication is enabled, this will configure the ldap_server section
  include /etc/nginx/nginx_ldap_rt.conf;

  upstream arkime {
    server arkime:8005;
  }

  upstream api {
    server api:5000;
  }

  upstream upload {
    server upload:80;
  }

  upstream htadmin {
    server htadmin:80;
  }

  upstream dashboards {
    server dashboards:5601;
  }

  upstream dashboards-maps {
    server dashboards-helper:28991;
  }

  upstream opensearch {
    server opensearch:9200;
  }

  upstream logstash-stats {
    server logstash:9600;
  }

  upstream netbox {
    server netbox:8080;
  }

  upstream extracted-file-http-server {
    server file-monitor:8440;
  }

  # health check ("here I am") without authentication
  server {
    listen 8443;
    include /etc/nginx/nginx_ssl_config.conf;

    location / {
      add_header Content-Type text/plain;
      return 200 'Malcolm\n';
    }
  }

  # Main web interface
  server {
    listen 443;
    include /etc/nginx/nginx_ssl_config.conf;

    # favicon, logos, banners, etc.
    include /etc/nginx/nginx_image_aliases.conf;

    # HTTP basic user management (doesn't use nginx_auth_rt as it does its own auth directly)
    location /auth {
      proxy_pass http://htadmin;
      proxy_redirect off;
      proxy_set_header Accept-Encoding "";
      proxy_set_header Host htadmin.malcolm.local;
      rewrite ^/auth/?(.*) /$1 break;
      subs_filter_types '*';
      subs_filter '(src|action|href)="([\w\.-]+\.(php|css|js))' '$1="/auth/$2' gir;
      subs_filter 'href="styles/' 'href="/auth/styles/' gi;
      subs_filter 'src="script/' 'src="/auth/script/' gi;
      subs_filter '/fonts/glyphicons' '/auth/fonts/glyphicons' gi;
    }
    location ~* ^/(htadmin|admin_login)(\.php)\b(.*) {
      proxy_pass http://htadmin/$1$2$3;
      proxy_redirect off;
      proxy_set_header Accept-Encoding "";
      proxy_set_header Host htadmin.malcolm.local;
      subs_filter_types '*';
      subs_filter '(src|action|href)="([\w\.-]+\.(php|css|js))' '$1="/auth/$2' gir;
      subs_filter 'href="styles/' 'href="/auth/styles/' gi;
      subs_filter 'src="script/' 'src="/auth/script/' gi;
      subs_filter '/fonts/glyphicons' '/auth/fonts/glyphicons' gi;
    }

    # Malcolm readme
    location /readme {
      include /etc/nginx/nginx_auth_rt.conf;
      root /usr/share/nginx/html;
      try_files $uri $uri/index.html;
    }

    # Malcolm file upload
    location /upload {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      rewrite ^/upload(.*)/?$ /$1 break;
      proxy_pass http://upload;
      proxy_redirect off;
      proxy_set_header Host upload.malcolm.local;
      proxy_request_buffering off;
      proxy_buffering off;
      client_max_body_size 50G;
    }
    location /server/php {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      proxy_pass http://upload/server/php;
      proxy_redirect off;
      proxy_set_header Host upload.malcolm.local;
      proxy_request_buffering off;
      proxy_buffering off;
      client_max_body_size 50G;
    }

    # Arkime -> Dashboards shortcut
    location ~* ^/idark2dash(.*) {
      include /etc/nginx/nginx_auth_rt.conf;
      set $filter_start_time now-1d;
      if ($arg_start != '') {
        set $filter_start_time \'$arg_start\';
      }

      set $filter_stop_time now;
      if ($arg_stop != '') {
        set $filter_stop_time \'$arg_stop\';
      }

      set $filter_field undefined;
      if ($arg_field != '') {
        set $filter_field $arg_field;
      }

      set $filter_value undefined;
      if ($arg_value != '') {
        set $filter_value $arg_value;
      }

      rewrite ^/idark2dash/(.*) /dashboards/app/discover#/?_g=(refreshInterval:(pause:!t,value:0),time:(from:$filter_start_time,mode:absolute,to:$filter_stop_time))&_a=(columns:!(_source),filters:!((meta:(alias:!n,disabled:!f,index:'sessions2-*',key:$filter_field,negate:!f,params:(query:'$filter_value',type:phrase),type:phrase,value:'$filter_value'),query:(match:($filter_field:(query:'$filter_value',type:phrase))))),index:'sessions2-*',interval:auto,query:(language:lucene,query:''),sort:!(firstPacket,desc)) redirect;
      proxy_pass http://dashboards;
      proxy_redirect off;
      proxy_set_header Host dashboards.malcolm.local;
    }

    # Dashboards -> Arkime shortcut
    location ~* /iddash2ark/(.*) {
      rewrite ^.*/iddash2ark/(.*) /sessions?expression=($1) redirect;
      proxy_pass https://arkime;
      proxy_ssl_verify off;
      proxy_redirect off;
      proxy_set_header Host arkime.malcolm.local;
      proxy_set_header http_auth_http_user $authenticated_user;
      proxy_set_header Authorization "";
    }

    # Dashboards/Arkime -> extracted file download
    location ~* /dl-extracted-files/(.*) {
      rewrite ^.*/dl-extracted-files/(.*) /extracted-files/$1 redirect;
      proxy_pass http://extracted-file-http-server;
      proxy_redirect off;
      proxy_set_header Host file-monitor.malcolm.local;
    }

    # already prepended /dashboards to match the server.basePath in OpenSearch Dashboards's YML config file
    location /dashboards {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://dashboards;
      proxy_redirect off;
      proxy_set_header Host dashboards.malcolm.local;
    }

    # offline region maps for dashboards
    location /world.geojson {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://dashboards-maps;
      proxy_redirect off;
      proxy_set_header Host dashboards-helper.malcolm.local;
    }

    location ~* ^/extracted-files\b(.*) {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://extracted-file-http-server$1;
      proxy_redirect off;
      proxy_set_header Host file-monitor.malcolm.local;
    }

    # netbox
    location /netbox {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://netbox;
      proxy_redirect off;
      proxy_set_header Host netbox.malcolm.local;
      proxy_set_header X-Forwarded-Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Remote-Auth $authenticated_user;
    }

    # Fix cyberchef JS module(s)
    # https://localhost/arkime/session/190924-KgO9H30qhdREw7ltsDXn1Rgp/modules/Regex.js
    location ~* ^/arkime/session/.*/(modules/.*\.js) {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_hide_header Content-Type;
      proxy_set_header Content-Type "application/javascript";
      add_header Content-Type "application/javascript";
      default_type application/javascript;
      add_header X-Content-Type-Options 'nosniff';
      proxy_pass https://arkime/cyberchef/$1;
      proxy_ssl_verify off;
      proxy_redirect off;
      proxy_set_header Host arkime.malcolm.local;
      proxy_set_header http_auth_http_user $authenticated_user;
      proxy_set_header Authorization "";
    }

    # passthrough Logstash statistics from the Malcolm API
    location /mapi/logstash/ {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://logstash-stats/_node/stats/;
      proxy_redirect off;
    }

    # passthrough OpenSearch from the Malcolm API
    location /mapi/opensearch/ {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://opensearch/;
      proxy_redirect off;
      proxy_set_header Host os.malcolm.local;
      client_max_body_size 50m;
    }

    # passthrough NetBox from the Malcolm API
    location /mapi/netbox/ {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://netbox/netbox/api/;
      proxy_redirect off;
      proxy_set_header Host netbox.malcolm.local;
      proxy_set_header X-Forwarded-Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Remote-Auth $authenticated_user;
    }

    # Malcolm API
    location /mapi {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass http://api;
      proxy_redirect off;
      proxy_set_header Host api.malcolm.local;
    }

    # Arkime
    location / {
      include /etc/nginx/nginx_auth_rt.conf;
      proxy_pass https://arkime;
      proxy_ssl_verify off;
      proxy_redirect off;
      proxy_set_header Host arkime.malcolm.local;
      proxy_set_header http_auth_http_user $authenticated_user;
      proxy_set_header Authorization "";
    }
  }

  # OpenSearch API
  server {
    listen 9200;
    include /etc/nginx/nginx_ssl_config.conf;

    # use either auth_basic or auth_ldap
    include /etc/nginx/nginx_auth_rt.conf;

    # favicon, logos, banners, etc.
    include /etc/nginx/nginx_image_aliases.conf;

    location / {
      proxy_pass http://opensearch;
      proxy_redirect off;
      proxy_set_header Host os.malcolm.local;
      client_max_body_size 50m;
    }
  }

}