WIP: admin_panel: add featurefeature/admin_panel

2 files changed, 84 insertions, 1 deletions

diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml
index 86dfc74..922df75 100644
--- a/nginx/docker-compose.yaml
+++ b/nginx/docker-compose.yaml
@@ -24,6 +24,7 @@ services:
       monitoring_network:
       nexus_network:
       authelia_network:
+      admin_network:
 
 networks:
   #write each stack network (or connect it manually later)
@@ -45,4 +46,7 @@ networks:
   authelia_network:
     name: authelia_network
     external: true
+  admin_network:
+    name: admin_network
+    external: true
 
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 2c9f4cf..52bb590 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -45,7 +45,7 @@ server {
     listen 80;
     listen [::]:80;
 
-    server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol nexus.swave.lol registry.swave.lol auth.swave.lol;
+    server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol nexus.swave.lol registry.swave.lol auth.swave.lol admin.swave.lol;
 
     location / {
         rewrite ^ https://$host$request_uri? permanent;
@@ -524,3 +524,82 @@ server {
         proxy_set_header X-Forwarded-Host $http_host;
     }
 }
+
+# Admin Panel — admin.swave.lol
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    server_name admin.swave.lol;
+
+    server_tokens off;
+
+    ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+    ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+    ssl_buffer_size 8k;
+
+    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers on;
+
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+    ssl_ecdh_curve secp384r1;
+    ssl_session_tickets off;
+
+    # OCSP stapling
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.8.8;
+
+    charset utf-8;
+
+    # WebSocket support
+    location /ws {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://admin-panel:3000/ws;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 86400;
+    }
+
+    location / {
+        auth_request /_authelia-auth;
+        auth_request_set $authelia_user $upstream_http_remote_user;
+        proxy_pass http://admin-panel:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Authelia forward-auth subrequest endpoint
+    location = /_authelia-auth {
+        internal;
+        resolver 127.0.0.11 valid=30s;
+        set $authelia_upstream http://authelia:9091/api/verify;
+        proxy_pass $authelia_upstream;
+        proxy_pass_request_body off;
+        proxy_set_header Content-Length "";
+        proxy_set_header Cookie $http_cookie;
+        proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+        proxy_set_header X-Forwarded-Method $request_method;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Uri $request_uri;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    error_page 401 = @authelia_login_redirect;
+    location @authelia_login_redirect {
+        return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+    }
+}