diff --git a/sources/python/main.py b/sources/python/main.py index d59913e..0a1dbae 100644 --- a/sources/python/main.py +++ b/sources/python/main.py @@ -58,17 +58,31 @@ def deploy_container(name, token, cloud, port, upstream_ip, upstream_port, label os.makedirs(f"{host_dir}/etc", exist_ok=True) os.makedirs(f"{host_dir}/nginx", exist_ok=True) # Write default nginx config if not exists - nginx_conf = f"{host_dir}/nginx/nginx.conf" + nginx_conf = f"{host_dir}/nginx/default.conf" if not os.path.exists(nginx_conf): with open(nginx_conf, "w") as f: - f.write(f"""load_module /opt/wallarm/modules/nginx_v1.26.3_s0ff5dffff/ngx_http_wallarm_module.so; -events {{ worker_connections 10240; }} -http {{ - wallarm_mode {mode}; - server {{ - listen {port}; - location /wallarm-status {{ wallarm_status on; }} - location / {{ proxy_pass http://{upstream_ip}:{upstream_port}; }} + f.write(f"""server {{ + listen {port}; + server_name _; + set_real_ip_from 10.0.0.0/8; + real_ip_header X-Real-IP; + real_ip_recursive on; + + location /wallarm-status {{ + wallarm_status on; + allow 127.0.0.0/8; + deny all; + }} + location /health {{ + access_log off; + return 200 "healthy\n"; + }} + location / {{ + proxy_pass http://{upstream_ip}:{upstream_port}; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; }} }} """) @@ -80,7 +94,7 @@ http {{ --name {container} \ --restart unless-stopped \ -p {port}:{port} \ - -v {host_dir}/nginx:/etc/nginx -v {host_dir}/etc:/opt/wallarm/etc \ + -v {host_dir}/nginx:/etc/nginx/http.d:ro -v {host_dir}/etc:/opt/wallarm/etc \ -p {monitoring_port}:{monitoring_port} \ -e WALLARM_API_TOKEN={token} \ -e WALLARM_API_HOST={api_host} \