mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 02:18:40 +03:00
78 lines
3.8 KiB
Plaintext
78 lines
3.8 KiB
Plaintext
# Grafana monitoring proxy — add inside the `server { listen 80; }` block in apps.conf
|
|
# Place BEFORE the generic location /app/androidcast_project/ block.
|
|
#
|
|
# Access flow:
|
|
# Browser → FE nginx (TLS) → artc0 BE nginx :80 → cast04:3000 (Grafana)
|
|
# auth_request validates PHP session on each request.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# ── Internal auth_request endpoint (not directly accessible) ────────────
|
|
location = /app/androidcast_project/api/grafana-auth-check.php {
|
|
internal;
|
|
include fastcgi_params;
|
|
fastcgi_pass unix:/run/php-fpm.socket;
|
|
fastcgi_param SCRIPT_FILENAME /var/www/localhost/htdocs/apps/app/androidcast_project/api/grafana-auth-check.php;
|
|
fastcgi_param SCRIPT_NAME /app/androidcast_project/api/grafana-auth-check.php;
|
|
fastcgi_param REQUEST_URI $request_uri;
|
|
# Forward the original session cookie so the PHP script can read it
|
|
fastcgi_param HTTP_COOKIE $http_cookie;
|
|
}
|
|
|
|
# ── Redirect bare paths to trailing slash ────────────────────────────────
|
|
location = /app/androidcast_project/monitor {
|
|
return 301 /app/androidcast_project/monitor/;
|
|
}
|
|
|
|
location = /app/androidcast_project/alertmanager {
|
|
return 301 /app/androidcast_project/alertmanager/;
|
|
}
|
|
|
|
# ── Alertmanager UI at cast04:9093 via auth_request ──────────────────────
|
|
location /app/androidcast_project/alertmanager/ {
|
|
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
|
auth_request_set $grafana_user $upstream_http_x_webauth_user;
|
|
error_page 401 = @monitor_login_redirect;
|
|
|
|
proxy_pass http://10.7.16.239:9093/;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_read_timeout 120;
|
|
proxy_send_timeout 120;
|
|
}
|
|
|
|
# ── Grafana at cast04:3000 via auth_request ───────────────────────────────
|
|
location /app/androidcast_project/monitor/ {
|
|
# Validate PHP session before allowing through
|
|
auth_request /app/androidcast_project/api/grafana-auth-check.php;
|
|
|
|
# Capture username from auth response header and forward to Grafana
|
|
auth_request_set $grafana_user $upstream_http_x_webauth_user;
|
|
|
|
# Redirect to login if not authenticated
|
|
error_page 401 = @monitor_login_redirect;
|
|
|
|
proxy_pass http://10.7.16.239:3000/;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
# Pass authenticated user to Grafana auth proxy
|
|
proxy_set_header X-WEBAUTH-USER $grafana_user;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_read_timeout 300;
|
|
proxy_send_timeout 300;
|
|
# WebSocket support (Grafana live)
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
|
|
# ── Login redirect for unauthenticated monitor access ────────────────────
|
|
location @monitor_login_redirect {
|
|
return 302 /app/androidcast_project/login?redirect=$request_uri;
|
|
}
|