ops: version isolated subscription gateway configuration

gateway-admin.conf

@@ -0,0 +1,29 @@
+user nginx;
+worker_processes 1;
+pid /var/run/nginx.pid;
+events { worker_connections 256; }
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    server_tokens off;
+    server {
+        listen 64444 ssl;
+        ssl_certificate /etc/letsencrypt/live/c2.deeplink-subscribe.com/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/c2.deeplink-subscribe.com/privkey.pem;
+        root /var/www/html;
+        index index.php;
+        location / { try_files $uri /index.php$is_args$args; }
+        location ~ ^/api/[a-z_]+\.php$ {
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_pass 127.0.0.1:9000;
+        }
+        location ~ \.php$ {
+            try_files $uri /index.php$is_args$args;
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_pass 127.0.0.1:9000;
+        }
+        location ~ /\. { deny all; }
+    }
+}

gateway-http.conf

@@ -0,0 +1,6 @@
+server {
+    listen 80;
+    server_name c2.deeplink-subscribe.com;
+    location ^~ /.well-known/acme-challenge/ { root /var/lib/dpl-sgw/acme; }
+    location / { return 404; }
+}

gateway-nginx.conf

@@ -0,0 +1,34 @@
+user nginx;
+worker_processes 1;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+events { worker_connections 1024; }
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    include /etc/nginx/subscribe/real_ip.conf;
+    # Do not record subscription credentials in access logs.
+    log_format main '$remote_addr [$time_local] "$request_method subscription" $status $body_bytes_sent "$http_user_agent"';
+    access_log /var/log/subscribe/access.log main;
+    error_log /var/log/subscribe/error.log crit;
+    sendfile on;
+    keepalive_timeout 65;
+    server_tokens off;
+    resolver 1.1.1.1 valid=60s ipv6=off;
+    resolver_timeout 5s;
+    map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+    include /etc/nginx/subscribe/cloud_geo.conf;
+    include /etc/nginx/subscribe/whitelist.conf;
+    include /etc/nginx/subscribe/ua_custom.conf;
+    include /etc/nginx/subscribe/ua_whitelist.conf;
+    server { listen 80 default_server; return 444; }
+    server {
+        listen 443 ssl;
+        ssl_certificate /etc/nginx/ssl/cert.pem;
+        ssl_certificate_key /etc/nginx/ssl/key.pem;
+        ssl_protocols TLSv1.2 TLSv1.3;
+        include /etc/nginx/subscribe/blacklist.conf;
+        include /etc/nginx/subscribe/protect.conf;
+        location / { return 404; }
+    }
+}

gateway-proxy.conf

@@ -0,0 +1,15 @@
+proxy_set_header Host c2.deeplink-subscribe.com;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $remote_addr;
+proxy_set_header X-Forwarded-Proto https;
+proxy_http_version 1.1;
+proxy_ssl_server_name on;
+proxy_ssl_name c2.deeplink-subscribe.com;
+proxy_ssl_verify on;
+proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
+proxy_connect_timeout 10s;
+proxy_read_timeout 60s;
+proxy_hide_header Cache-Control;
+add_header Cache-Control "private, no-store" always;
+proxy_no_cache 1;
+proxy_cache_bypass 1;

gateway-site.conf

@@ -0,0 +1,26 @@
+server {
+    listen 80;
+    server_name c2.deeplink-subscribe.com;
+    location ^~ /.well-known/acme-challenge/ { root /var/lib/dpl-sgw/acme; }
+    location / { return 301 https://$host$request_uri; }
+}
+server {
+    listen 443 ssl;
+    server_name c2.deeplink-subscribe.com;
+    ssl_certificate /etc/letsencrypt/live/c2.deeplink-subscribe.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/c2.deeplink-subscribe.com/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    # Public gateway serves subscriptions only; administration stays on loopback.
+    access_log off;
+    error_log /var/log/nginx/dpl-subscribe-error.log crit;
+    location ~ ^/s/([^/]+)/?$ {
+        rewrite ^/s/([^/]+)/?$ /api/v1/client/subscribe?token=$1 break;
+        proxy_pass https://127.0.0.1:18443;
+        include /etc/nginx/dpl-subscribe-proxy.conf;
+    }
+    location = /api/v1/client/subscribe {
+        proxy_pass https://127.0.0.1:18443;
+        include /etc/nginx/dpl-subscribe-proxy.conf;
+    }
+    location / { return 404; }
+}

gateway.compose.yml

@@ -0,0 +1,50 @@
+name: dpl-sgw
+services:
+  gateway:
+    image: sha256:d8807a5b2442bc25ce4fbc1312354b9dcbb0f538d75181ef735f4ea980760e70
+    pull_policy: never
+    container_name: dpl-subscribe-gateway
+    restart: unless-stopped
+    mem_limit: 160m
+    cpus: 0.5
+    ports:
+      - "127.0.0.1:18080:80"
+      - "127.0.0.1:18443:443"
+    environment:
+      V2B_BACKEND: https://dp-link.net
+      V2B_HOST: dp-link.net
+      REAL_IP_HEADER: X-Real-IP
+      AXISNOW_TRUSTED_IPS: 172.28.31.1
+    volumes:
+      - config:/etc/nginx/subscribe
+      - logs:/var/log/subscribe
+      - /etc/letsencrypt:/etc/letsencrypt:ro
+      - /var/lib/dpl-sgw/ssl:/etc/nginx/ssl:ro
+      - ./gateway-nginx.conf:/etc/nginx/templates-src/nginx.conf:ro
+    networks: [dpl]
+    logging: {driver: json-file, options: {max-size: "5m", max-file: "2"}}
+  admin:
+    image: sha256:31ff8ea3e8f958a835edbd1579709017da75b742ff3a5984ea59d12ea0775577
+    pull_policy: never
+    container_name: dpl-subscribe-admin
+    restart: unless-stopped
+    mem_limit: 128m
+    cpus: 0.5
+    ports:
+      - "127.0.0.1:16444:64444"
+    env_file: /var/lib/dpl-sgw/admin.env
+    volumes:
+      - config:/etc/nginx/subscribe
+      - logs:/var/log/subscribe
+      - /etc/letsencrypt:/etc/letsencrypt:ro
+      - ./gateway-admin.conf:/etc/nginx/nginx.conf:ro
+    networks: [dpl]
+    logging: {driver: json-file, options: {max-size: "5m", max-file: "2"}}
+volumes:
+  config: {name: dpl_sgw_config}
+  logs: {name: dpl_sgw_logs}
+networks:
+  dpl:
+    name: dpl_sgw_net
+    ipam:
+      config: [{subnet: 172.28.31.0/24}]