Skip to content

Commit af3cd94

Browse files
Yenthe666Yenthe666
committed
Init nginx config file
Creates an https certificate and reverse proxy for the Odoo.
1 parent fa9148e commit af3cd94

File tree

1 file changed

+159
-0
lines changed

1 file changed

+159
-0
lines changed

‎nginx_install.sh‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
#!/bin/bash
2+
3+
##
4+
# This script creates a self-signed certificate and configuration file for Nginx.
5+
# Nginx is used as a reverse proxy for Odoo.
6+
#
7+
# For examples:
8+
# subdomain1.website.com -> using the Odoo database1.
9+
# subdomain2.website.com -> using the Odoo database2.
10+
# When a database name is mussing the database with the same name as the subdomain will be used, depending on the database
11+
# parameter of the Odoo configuration file.
12+
##
13+
14+
if [ -z $1 ]; then
15+
echo "Missing subdomain!"
16+
echo "Usage: odoo_nginx subdomain [database]"
17+
echo "For example: ./odoo_nginx my.website.com TheDatabaseName"
18+
exit 0
19+
fi
20+
21+
NGINX_CONFIG_DIR=/etc/nginx
22+
DOMAIN="$1"
23+
DB=$2
24+
25+
SSL_DIR=$NGINX_CONFIG_DIR/ssl/$DOMAIN
26+
DOMAIN_CONFIG=$NGINX_CONFIG_DIR/sites/"$DOMAIN.conf"
27+
28+
#echo "Setup domain "$DOMAIN" with database "$2" - $DOMAIN_CONFIG, SSL=$SSL_DIR"
29+
30+
#echo "Create Self-signed cert"
31+
mkdir -p $SSL_DIR
32+
mkdir -p $NGINX_CONFIG_DIR/sites
33+
34+
openssl ecparam -out $SSL_DIR/nginx.key -name prime256v1 -genkey
35+
openssl req -new -key $SSL_DIR/nginx.key -out $SSL_DIR/csr.pem -subj "/C=VN/ST=DONG BAC BO/L=HA NOI/O=ERPHanoi/OU=IT Department/CN=$DOMAIN"
36+
openssl req -x509 -nodes -days 1000 -key $SSL_DIR/nginx.key -in $SSL_DIR/csr.pem -out $SSL_DIR/nginx.pem
37+
# openssl dhparam -out $SSL_DIR/dhparam.pem 4096 # This take long time
38+
39+
if [ -z $DB ]; then
40+
DB_STR=""
41+
else
42+
DB_STR="proxy_set_header X-Custom-Referrer \"$DB\";"
43+
fi
44+
45+
echo -e "* Create $DOAMIN's nginx config file at $DOMAIN_CONFIG"
46+
47+
cat <<EOF > $DOMAIN_CONFIG
48+
##
49+
# You should look at the following URL's in order to grasp a solid understanding
50+
# of Nginx configuration files in order to fully unleash the power of Nginx.
51+
# http://wiki.nginx.org/Pitfalls
52+
# http://wiki.nginx.org/QuickStart
53+
# http://wiki.nginx.org/Configuration
54+
#
55+
# Generally, you will want to move this file somewhere, and start with a clean
56+
# file but keep this around for reference. Or just disable in sites-enabled.
57+
#
58+
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
59+
##
60+
##
61+
# Configuration file for each subdomain <=> database.
62+
# Should use with http.py patch, which using HTTP_X_CUSTOM_REFERRER as database name
63+
# See https://github.com/halybang/odoo/blob/9.0/openerp/http.py
64+
#
65+
##
66+
server {
67+
# Redirect all request to ssl
68+
listen 80;
69+
server_name $DOMAIN;
70+
# Strict Transport Security
71+
add_header Strict-Transport-Security max-age=2592000;
72+
return 301 https://\$host\$request_uri;
73+
}
74+
server {
75+
# Enable SSL
76+
listen 443 ssl;
77+
server_name $DOMAIN;
78+
79+
#root /var/www/html;
80+
# Add index.php to the list if you are using PHP
81+
#index index.html index.htm index.nginx-debian.html;
82+
83+
# Set log files
84+
access_log /var/log/nginx/$DOMAIN.access.log;
85+
error_log /var/log/nginx/$DOMAIN.error.log;
86+
87+
keepalive_timeout 60;
88+
client_max_body_size 100m;
89+
90+
# SSL Configuration
91+
# Self signed certs generated by the ssl-cert package
92+
ssl on;
93+
ssl_certificate $SSL_DIR/nginx.pem;
94+
ssl_certificate_key $SSL_DIR/nginx.key;
95+
#ssl_dhparam $SSL_DIR/dhparam.pem;
96+
ssl_prefer_server_ciphers on;
97+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
98+
ssl_session_cache shared:SSL:1m;
99+
ssl_session_timeout 10m;
100+
ssl_ciphers HIGH:!ADH:!MD5;
101+
#ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
102+
#ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
103+
104+
# increase proxy buffer to handle some OpenERP web requests
105+
proxy_buffers 16 64k;
106+
proxy_buffer_size 128k;
107+
# general proxy settings
108+
# force timeouts if the backend dies
109+
proxy_connect_timeout 600s;
110+
proxy_send_timeout 600s;
111+
proxy_read_timeout 600s;
112+
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
113+
114+
# set headers
115+
proxy_set_header X-Real-IP \$remote_addr;
116+
proxy_set_header Host \$host;
117+
proxy_set_header X-Forwarded-Host \$http_host;
118+
proxy_set_header X-Forward-For \$proxy_add_x_forwarded_for;
119+
# Let the OpenERP web service know that we’re using HTTPS, otherwise
120+
# it will generate URL using http:// and not https://
121+
proxy_set_header X-Forwarded-Proto https;
122+
proxy_set_header Front-End-Https On;
123+
# Point to real database name
124+
#proxy_set_header X-Custom-Referrer "databasename";
125+
$DB_STR
126+
127+
# by default, do not forward anything
128+
# proxy_redirect off;
129+
proxy_buffering off;
130+
location / {
131+
#try_files \$uri \$uri/ @proxy;
132+
proxy_pass http://odoo9;
133+
proxy_redirect default;
134+
}
135+
location /longpolling {
136+
proxy_pass http://odoo9-im;
137+
}
138+
139+
# cache some static data in memory for 60mins.
140+
# under heavy load this should relieve stress on the OpenERP web interface a bit.
141+
location ~* /web/static/ {
142+
proxy_cache_valid 200 60m;
143+
proxy_buffering on;
144+
expires 864000;
145+
#try_files $uri $uri/ @proxy;
146+
proxy_pass http://odoo9;
147+
#proxy_redirect default;
148+
#proxy_redirect off;
149+
}
150+
location @proxy {
151+
proxy_pass http://odoo9;
152+
proxy_redirect default;
153+
#proxy_redirect off;
154+
}
155+
location ~ /\.ht {
156+
deny all;
157+
}
158+
}
159+
EOF

0 commit comments

Comments
 (0)