-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathNginxChecker.cpp
More file actions
334 lines (273 loc) · 9.66 KB
/
Copy pathNginxChecker.cpp
File metadata and controls
334 lines (273 loc) · 9.66 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
/**
*
* @file NginxChecker.cpp
* @author Gaspard Kirira
*
* Copyright 2026, Gaspard Kirira. All rights reserved.
* https://github.com/vixcpp/vix
* Use of this source code is governed by a MIT license
* that can be found in the License file.
*
* Vix.cpp
*/
#include <vix/cli/commands/proxy/NginxChecker.hpp>
#include <vix/cli/commands/proxy/NginxOutput.hpp>
#ifdef VIX_CLI_HAS_CRYPTO
#include <vix/crypto/certificate.hpp>
#endif
#include <cstdlib>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <sstream>
#include <string>
namespace fs = std::filesystem;
namespace vix::commands::proxy::nginx_checker
{
namespace
{
bool run_cmd(const std::string &cmd)
{
return std::system(cmd.c_str()) == 0;
}
bool file_contains(
const fs::path &path,
const std::string &needle)
{
std::ifstream in(path);
if (!in)
return false;
std::ostringstream ss;
ss << in.rdbuf();
return ss.str().find(needle) != std::string::npos;
}
std::string http_upstream(const NginxProxyConfig &cfg)
{
return "proxy_pass http://127.0.0.1:" + std::to_string(cfg.httpPort);
}
std::string websocket_upstream(const NginxProxyConfig &cfg)
{
return "proxy_pass http://127.0.0.1:" +
std::to_string(cfg.websocketPort) +
"/";
}
bool site_enabled(const NginxProxyConfig &cfg)
{
std::error_code ec;
if (!fs::exists(cfg.sitesEnabledPath, ec))
return false;
if (!fs::is_symlink(cfg.sitesEnabledPath, ec))
return false;
const fs::path target = fs::read_symlink(cfg.sitesEnabledPath, ec);
if (ec)
return false;
return target == cfg.sitesAvailablePath;
}
bool check_required_content(const NginxProxyConfig &cfg)
{
bool ok = true;
if (!file_contains(cfg.sitesAvailablePath, "server_name " + cfg.domain))
{
nginx_output::error(std::cerr, "Missing or wrong server_name.");
nginx_output::fix(std::cerr, "run `vix proxy nginx init`");
ok = false;
}
if (!file_contains(cfg.sitesAvailablePath, http_upstream(cfg)))
{
nginx_output::error(std::cerr, "Missing or wrong HTTP upstream port.");
nginx_output::fix(std::cerr, "check production.proxy.http.port in vix.json, then run `vix proxy nginx init`");
ok = false;
}
if (!file_contains(cfg.sitesAvailablePath, "proxy_set_header Host $host") ||
!file_contains(cfg.sitesAvailablePath, "proxy_set_header X-Real-IP $remote_addr") ||
!file_contains(cfg.sitesAvailablePath, "proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for") ||
!file_contains(cfg.sitesAvailablePath, "proxy_set_header X-Forwarded-Proto $scheme"))
{
nginx_output::error(std::cerr, "Missing X-Forwarded proxy headers.");
nginx_output::fix(std::cerr, "run `vix proxy nginx init`");
ok = false;
}
if (!file_contains(cfg.sitesAvailablePath, "proxy_connect_timeout 10s") ||
!file_contains(cfg.sitesAvailablePath, "proxy_send_timeout 60s") ||
!file_contains(cfg.sitesAvailablePath, "proxy_read_timeout 60s"))
{
nginx_output::error(std::cerr, "Missing HTTP proxy timeouts.");
nginx_output::fix(std::cerr, "run `vix proxy nginx init`");
ok = false;
}
if (cfg.websocketEnabled)
{
if (!file_contains(cfg.sitesAvailablePath, "location = " + cfg.websocketPath))
{
nginx_output::error(std::cerr, "Missing WebSocket location.");
nginx_output::fix(std::cerr, "check production.proxy.websocket.path in vix.json, then run `vix proxy nginx init`");
ok = false;
}
if (!file_contains(cfg.sitesAvailablePath, websocket_upstream(cfg)))
{
nginx_output::error(std::cerr, "Missing or wrong WebSocket upstream port.");
nginx_output::fix(std::cerr, "check production.proxy.websocket.port in vix.json, then run `vix proxy nginx init`");
ok = false;
}
if (!file_contains(cfg.sitesAvailablePath, "proxy_set_header Upgrade $http_upgrade") ||
!file_contains(cfg.sitesAvailablePath, "proxy_set_header Connection \"upgrade\""))
{
nginx_output::error(std::cerr, "Missing WebSocket upgrade headers.");
nginx_output::fix(std::cerr, "run `vix proxy nginx init`");
ok = false;
}
if (!file_contains(cfg.sitesAvailablePath, "proxy_read_timeout 3600s") ||
!file_contains(cfg.sitesAvailablePath, "proxy_send_timeout 3600s") ||
!file_contains(cfg.sitesAvailablePath, "proxy_buffering off"))
{
nginx_output::error(std::cerr, "Missing WebSocket proxy timeouts.");
nginx_output::fix(std::cerr, "run `vix proxy nginx init`");
ok = false;
}
}
if (cfg.tlsEnabled)
{
if (!file_contains(cfg.sitesAvailablePath, "ssl_certificate " + cfg.certificatePath.string()) ||
!file_contains(cfg.sitesAvailablePath, "ssl_certificate_key " + cfg.certificateKeyPath.string()))
{
nginx_output::error(std::cerr, "Missing or wrong TLS certificate paths.");
nginx_output::fix(std::cerr, "check production.proxy.tls in vix.json, then run `vix proxy nginx init`");
ok = false;
}
if (!file_contains(cfg.sitesAvailablePath, "return 301 https://$host$request_uri"))
{
nginx_output::error(std::cerr, "Missing HTTPS redirect.");
nginx_output::fix(std::cerr, "run `vix proxy nginx init`");
ok = false;
}
}
return ok;
}
}
bool check_tls_certificate(const NginxProxyConfig &cfg)
{
if (!cfg.tlsEnabled)
return true;
#ifndef VIX_CLI_HAS_CRYPTO
nginx_output::error(
std::cerr,
"TLS certificate checks are not available in this build.");
nginx_output::fix(
std::cerr,
"rebuild the Vix CLI with the crypto module enabled");
return false;
#else
bool ok = true;
const auto cert = vix::crypto::inspect_certificate(cfg.certificatePath);
if (!cert.ok())
{
nginx_output::error(
std::cerr,
"TLS certificate check failed: " + std::string(cert.error().message));
nginx_output::fix(
std::cerr,
"check production.proxy.tls.certificate in vix.json");
return false;
}
const auto &info = cert.value();
if (!info.validFormat)
{
nginx_output::error(std::cerr, "TLS certificate has an invalid format.");
nginx_output::fix(std::cerr, "replace the certificate with a valid PEM X.509 certificate");
ok = false;
}
if (info.expired)
{
nginx_output::error(std::cerr, "TLS certificate is expired.");
nginx_output::fix(std::cerr, "renew the certificate, then run `vix proxy nginx init`");
ok = false;
}
if (!vix::crypto::certificate_matches_domain(info, cfg.domain))
{
nginx_output::error(std::cerr, "TLS certificate does not match proxy domain.");
nginx_output::fix(std::cerr, "check production.proxy.domain and production.proxy.tls.certificate in vix.json");
ok = false;
}
if (ok)
nginx_output::ok(std::cout, "tls certificate looks good");
return ok;
#endif
}
int check(const NginxProxyConfig &cfg)
{
const bool enabled = site_enabled(cfg);
nginx_output::print_check_summary(std::cout, cfg, enabled);
bool ok = true;
if (cfg.domain.empty())
{
nginx_output::error(std::cerr, "Missing proxy domain.");
nginx_output::fix(std::cerr, "add production.proxy.domain to vix.json");
ok = false;
}
if (!fs::exists(cfg.sitesAvailablePath))
{
nginx_output::error(
std::cerr,
"Nginx site file not found: " + cfg.sitesAvailablePath.string());
nginx_output::fix(std::cerr, "run `vix proxy nginx init`");
return 1;
}
if (!enabled)
{
nginx_output::error(std::cerr, "Nginx site is not enabled.");
nginx_output::fix(
std::cerr,
"sudo ln -sfn " +
cfg.sitesAvailablePath.string() +
" " +
cfg.sitesEnabledPath.string());
ok = false;
}
if (!check_required_content(cfg))
ok = false;
if (!check_tls_certificate(cfg))
ok = false;
if (!run_cmd("command -v nginx >/dev/null 2>&1"))
{
nginx_output::error(std::cerr, "Nginx is not installed or not available in PATH.");
nginx_output::fix(std::cerr, "install nginx, then run `vix proxy nginx init`");
ok = false;
}
else if (!run_cmd("sudo nginx -t"))
{
nginx_output::error(std::cerr, "Nginx config is invalid.");
nginx_output::fix(std::cerr, "sudo nginx -t");
ok = false;
}
else
{
nginx_output::ok(std::cout, "nginx config is valid");
}
if (!ok)
return 1;
nginx_output::ok(std::cout, "proxy config looks good");
return 0;
}
int reload(const NginxProxyConfig &cfg)
{
nginx_output::print_reload_summary(std::cout, cfg);
const int check_code = check(cfg);
if (check_code != 0)
{
nginx_output::error(std::cerr, "Proxy check failed. Nginx reload aborted.");
nginx_output::fix(std::cerr, "run `vix proxy nginx check`");
return check_code;
}
if (!run_cmd("sudo systemctl reload nginx"))
{
nginx_output::error(std::cerr, "Failed to reload Nginx.");
if (!run_cmd("systemctl is-active --quiet nginx"))
nginx_output::fix(std::cerr, "sudo systemctl start nginx");
else
nginx_output::fix(std::cerr, "sudo systemctl reload nginx");
return 1;
}
nginx_output::ok(std::cout, "nginx reloaded");
return 0;
}
}