Merge pull request #25 from gobengo/nginx_sub_path

Nginx sub path

README.md

@@ -35,3 +35,14 @@ Create a Post `./bin/create-post`
 ## Demo
 
 * [Official demo](https://distbin.com/)
+
+
+## Configuration
+
+Configure distbin with the following environment variables:
+
+* `DB_DIR` - path to a directory in which distbin should read/write data
+* `PORT` - HTTP Port for distbin to listen on
+* `EXTERNAL_URL` - The public-facing base URL that distbin is deployed at, e.g. `http://yourdomain.com/distbin/`
+* `INTERNAL_URL` - If distbin is running with a network configuration such that it cannot make requests to the `EXTERNAL_URL`, all outgoing requests to the `EXTERNAL_URL` will be replaced with this `INTERNAL_URL`. See [./etc/distbin-nginx-subpath/docker-compose.yml](./etc/distbin-nginx-subpath/docker-compose.yml) for an example.
+* `DISTBIN_DELIVER_TO_LOCALHOST` - default: false in production - Whether or not to allow distbin to make requests to `localhost` URLs. This is discouraged in [the security considerations of the ActivityPub spec](https://www.w3.org/TR/activitypub/#security-localhost)

bin/client-address.ts

@@ -26,6 +26,6 @@ async function main() {
     )))
   const urlBody = await readableToString(urlResponse)
   const fetchedObject = JSON.parse(urlBody)
-  const targets = objectTargets(fetchedObject, 0)
+  const targets = objectTargets(fetchedObject, 0, false, (u: string) => u)
   logger.info("", { targets })
 }

bin/server.ts

@@ -48,6 +48,7 @@ async function runServer() {
   }
 
   const externalUrl = distbinConfig.externalUrl || `http://localhost:${port}`
+  const internalUrl = distbinConfig.internalUrl || `http://localhost:${port}`
   const apiHandler = distbin(Object.assign(
     distbinConfig,
     ( ! distbinConfig.externalUrl ) && { externalUrl },
@@ -79,7 +80,10 @@ async function runServer() {
   }
 
   // html
-  const htmlServer = http.createServer(logMiddleware(distbinHtml.createHandler({ apiUrl: apiServerUrl, externalUrl })))
+  const htmlServer = http.createServer(logMiddleware(distbinHtml.createHandler({
+    apiUrl: apiServerUrl,
+    externalUrl,
+    internalUrl })))
   const htmlServerUrl = await listen(htmlServer)
 
   // mainServer delegates to htmlHandler or distbin api handler based on Accept header
@@ -114,7 +118,7 @@ async function runServer() {
   // listen
   const mainServerUrl = await listen(mainServer, port)
   /* tslint:disable-next-line:no-console */
-  console.log(mainServerUrl)
+  console.log(externalUrl)
   // now just like listen
   await new Promise(() => {
     // pass

config/index.ts

@@ -12,6 +12,7 @@ interface IDistbinConfig {
     activities: IAsyncMap<string, any>
     deliverToLocalhost: Boolean
     externalUrl?: string
+    internalUrl?: string
     inbox: IAsyncMap<string, any>
     inboxFilter: InboxFilter
     port?: number
@@ -26,6 +27,7 @@ export default async (): Promise<IDistbinConfig> => {
             ? JSON.parse(process.env.DISTBIN_DELIVER_TO_LOCALHOST)
             : process.env.NODE_ENV !== 'production',
         externalUrl: process.env.EXTERNAL_URL,
+        internalUrl: process.env.INTERNAL_URL,
         inbox: new JSONFileMapAsync(path.join(dbDir, 'inbox/')),
         inboxFilter: objectContentFilter(['viagra']),
         port: parsePort(process.env.PORT || process.env.npm_package_config_port),

etc/distbin-nginx-subpath/README.md

@@ -0,0 +1,13 @@
+# distbin/etc/distbin-nginx-subpath
+
+This demonstrates how to host distbin at a 'subpath' like `yourdomain.com/yourSubpath`.
+
+Motivated by this GitHub issue: https://github.com/gobengo/distbin/issues/20
+
+It uses nginx as a reverse-proxy. End-user requests first hit nginx. If the HTTP request path starts with '/distbin/', nginx will remove that prefix from the request and forward the request to the running distbin process along a private network.
+
+distbin itself is run with the environment variable `EXTERNAL_URL=http://localhost:8001/distbin/` set. This allows distbin to render links to the prefixed URL without having to resort to bug-prone URL rewriting of the distbin-html HTML.
+
+## Usage
+
+From this directory, `docker-compose up` and access `http://localhost:8001`.

etc/distbin-nginx-subpath/docker-compose.yml

@@ -0,0 +1,39 @@
+version: "3.4"
+
+networks:
+  public: {}
+  private: {}
+
+volumes:
+  distbin-db: {}
+
+services:
+  distbin-subpath-distbin:
+    command: npm run start:ts-node
+    environment:
+    # Because with this docker networking setup, the running container cannot access EXTERNAL_URL
+    - INTERNAL_URL=http://distbin-subpath-distbin:80/
+    - EXTERNAL_URL=http://localhost:8001/distbin/
+    - NODE_DEBUG=distbin
+    - LOG_LEVEL=debug
+    # - DISTBIN_DELIVER_TO_LOCALHOST=false
+    build: ../../
+    networks:
+    - private
+    ports:
+    - 80
+    volumes:
+    - distbin-db:/distbin-db:rw
+    # - .:/home/distbin/app
+
+  distbin-subpath:
+    depends_on:
+    - distbin-subpath-distbin
+    image: nginx:latest
+    networks:
+    - public
+    - private
+    volumes:
+    - ./nginx.conf:/etc/nginx/nginx.conf
+    ports:
+      - 8001:80

etc/distbin-nginx-subpath/nginx.conf

@@ -0,0 +1,28 @@
+events { worker_connections 1024; }
+
+http { 
+    sendfile on;
+    rewrite_log on;
+    error_log /dev/stdout notice;
+    access_log /dev/stdout;
+    ignore_invalid_headers off;
+
+    # upstream distbin-subpath-distbin {
+    #     server distbin-subpath-distbin:80;
+    # }
+
+    server {
+        location /distbin/ {
+            rewrite           ^/distbin/(.*) /$1 break;
+            proxy_pass         http://distbin-subpath-distbin/;
+            proxy_pass_request_headers      on;
+            proxy_redirect     ~^/(.*) $scheme://$http_host/distbin/$1;
+            proxy_set_header   Host $http_host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            # proxy_set_header   X-Forwarded-Host $server_name;
+            # proxy_set_header X-Forwarded-Host $host;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}