mk6i-open-oscar-server/config/ssl/nginx.conf

worker_processes  auto;
error_log         /dev/stdout info;
pid               /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include      /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format http '$time_iso8601 $remote_addr "$request" $status -> $upstream_addr '
                    'sent=$body_bytes_sent ssl=$ssl_protocol/$ssl_cipher '
                    'dur=$request_time';
    access_log /dev/stdout http;

    # POST / is the Kerberos auth endpoint; every other request that isn't
    # static content belongs to the Web API.
    map "$request_method $uri" $backend {
        default  webapi;
        "POST /" kerberos;
    }

    upstream kerberos {
        server open-oscar-server:1088;
    }

    upstream webapi {
        server open-oscar-server:8081;
        # The Flash client sends a request per keystroke burst and polls every
        # 500ms. Without a pool every one of those opens a new connection to the
        # server, and a connect that stalls costs the client its event loop.
        keepalive 32;
    }

    server {
        listen 80;
        listen 443 ssl;

        ssl_protocols             SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        # allow legacy ciphers required by 2000s-era AIM clients
        ssl_ciphers               ALL:!aNULL;
        ssl_prefer_server_ciphers off;

        ssl_certificate           /etc/nginx/certs/server.pem;
        ssl_certificate_key       /etc/nginx/certs/server.pem;
        ssl_dhparam               /etc/nginx/dhparam.pem;

        ssl_session_cache         shared:HTTPSSL:10m;
        ssl_session_timeout       5m;
        ssl_session_tickets       off;

        client_max_body_size      10m;
        # relative Location headers, so redirects keep the requested port.
        absolute_redirect         off;
        # required for the upstream keepalive pool
        proxy_http_version        1.1;
        proxy_set_header          Connection "";
        proxy_set_header          Host $http_host;
        proxy_set_header          X-Real-IP $remote_addr;
        proxy_set_header          X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header          X-Forwarded-Proto $scheme;
        proxy_connect_timeout     10s;
        # /aim/fetchEvents long-polls for up to 60 seconds.
        proxy_read_timeout        120s;
        proxy_send_timeout        120s;

        # load static web content for AIM web clients
        location = /client {
            return 301 /client/;
        }

        location ^~ /client/ {
            root            /srv;
            index           index.html;
            # js and css are the only assets big enough to be worth
            # compressing; the images already are.
            gzip            on;
            gzip_types      text/css application/javascript;
            gzip_min_length 1024;
            gzip_vary       on;
        }

        # client trust material: the root CA and the AIM 6.x NSS database.
        # The whole certs dir is mounted under /srv/certs, so only expose
        # these paths and never the server's private key.
        location = /certs/ca.crt {
            root      /srv;
        }

        location = /certs/nss {
            return 301 /certs/nss/;
        }

        location ^~ /certs/nss/ {
            root      /srv;
            autoindex on;
        }

        location ^~ /certs/ {
            return 404;
        }

        # route remaining traffic to the backend selected by $backend
        location / {
            proxy_pass http://$backend;
        }
    }
}

stream {
    log_format proxy '$remote_addr -> $upstream_addr $protocol $status '
                     'ssl=$ssl_protocol/$ssl_cipher sent=$bytes_sent '
                     'recv=$bytes_received dur=$session_time';
    access_log /dev/stdout proxy;

    ssl_protocols             SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers               ALL:!aNULL;
    ssl_prefer_server_ciphers off;

    ssl_certificate           /etc/nginx/certs/server.pem;
    ssl_certificate_key       /etc/nginx/certs/server.pem;
    ssl_dhparam               /etc/nginx/dhparam.pem;

    ssl_session_cache         shared:STREAMSSL:10m;
    ssl_session_timeout       5m;
    ssl_session_tickets       off;

    proxy_connect_timeout     10s;
    # a client going away ends the whole session rather than leaving the
    # upstream half open.
    proxy_half_close          off;
    # clients send FLAP keep-alive frames every couple of minutes, so a
    # connection quiet for this long is dead.
    proxy_timeout             10m;

    # BOS SSL listener
    server {
        listen     5193 ssl;
        proxy_pass open-oscar-server:5191;
    }
}