Reverse proxy Beta

# Ask the gate; if the gate does not answer or fails with 5xx, let the request through
location = /_o3o_auth {
    internal;
    proxy_pass http://o3o-gate:8070/o3o/auth;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;       # raw URI, not decoded
    proxy_set_header X-Original-Method $request_method;
    proxy_set_header X-O3O-Stage $o3o_stage;
    proxy_connect_timeout 2s;
    proxy_read_timeout 5s;
    proxy_intercept_errors on;
    error_page 500 502 503 504 = /_o3o_failopen;   # fail-open, only when the gate fails
}
location = /_o3o_failopen { internal; return 204; }

# EVERY WebSocket upgrade of an editing session goes through here
location ~ ^/cool/(.*/)?ws(/.*)?$ {                     # catches /cool/ws, a trailing / and segments after ws
    set $o3o_stage ws;
    auth_request /_o3o_auth;
    proxy_pass http://o3o-online:9980;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_read_timeout 36000s;
}

# Keep the editing server's admin, metrics and conversion API closed
location ^~ /browser/dist/admin        { return 404; }
location ~ ^/browser/[^/]+/admin(/|$)  { return 404; }   # admin console under the version hash
location ^~ /cool/adminws              { return 404; }   # prefix, not exact match: also blocks trailing-slash forms
location ^~ /cool/getMetrics           { return 404; }
location ^~ /cool/convert-to           { return 404; }   # external conversions go through POST /v1/convert
location ^~ /lool/convert-to           { return 404; }

# The rest of /cool/ (and /lool/ likewise): WebSocket upgrades are not forwarded
location /cool/ {
    proxy_pass http://o3o-online:9980;
    proxy_http_version 1.1;
    proxy_set_header Upgrade "";                        # drop Upgrade and Connection
    proxy_set_header Connection "";
    proxy_set_header Host $http_host;
}

# The root goes to the gate; every other path returns 404
location = / { return 302 /o3o/; }
location /   { return 404; }

BASE=https://office.example.com

# Every line must return 404
for path in /cool/adminws /cool/adminws/ /cool/adminws/x /cool/getMetrics /cool/getMetrics/ /cool/getMetrics/x \
            /browser/dist/admin/admin.html /cool/convert-to /cool/convert-to/pdf /lool/convert-to /o3o/auth /o3o/wopi/files/x; do
  printf '%-32s %s\n' "$path" "$(curl -s -o /dev/null --path-as-is -w '%{http_code}' "$BASE$path")"
done

# WebSocket handshakes: no line may return 101
WS=(--http1.1 -H 'Connection: Upgrade' -H 'Upgrade: websocket' -H 'Sec-WebSocket-Version: 13' -H 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==')
for path in /cool/not-a-url/ws /cool/not-a-url/ws/ /cool/%252Fx/ws /cool/adminws/ /cool/getMetrics/ /cool/clipboard; do
  printf '%-32s %s\n' "$path" "$(curl -s -o /dev/null --path-as-is --max-time 5 -w '%{http_code}' "${WS[@]}" "$BASE$path")"
done

# /etc/nginx/conf.d/o3o.conf
map $http_upgrade $connection_upgrade { default upgrade; '' close; }

server {
    listen 80;
    server_name office.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name office.example.com;
    ssl_certificate     /etc/letsencrypt/live/office.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/office.example.com/privkey.pem;

    client_max_body_size 0;          # no limit here; O3O enforces file sizes per edition

    location / {
        proxy_pass http://127.0.0.1:8080;   # o3o-proxy's O3O_PROXY_PORT
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;   # keeps the port too; do not use $host
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_read_timeout 36000s;       # idle WebSockets are not cut after 60 seconds
        proxy_send_timeout 36000s;
        proxy_request_buffering off;
        proxy_buffering off;
    }
}

O3O_PUBLIC_URL=https://office.example.com
O3O_ONLINE_SERVER_NAME=office.example.com
O3O_ONLINE_SSL_TERMINATION=true

# traefik.yml (static configuration)
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: 0s      # the 60-second default cuts WebSockets and long uploads
        idleTimeout: 3600s

providers:
  file:
    filename: /etc/traefik/dynamic.yml

certificatesResolvers:
  le:
    acme:
      email: admin@example.com
      storage: /acme/acme.json
      httpChallenge:
        entryPoint: web
---
# dynamic.yml (dynamic configuration)
http:
  routers:
    o3o:
      rule: Host(`office.example.com`)
      entryPoints: [websecure]
      service: o3o
      tls:
        certResolver: le
  services:
    o3o:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: http://127.0.0.1:8080   # o3o-proxy's O3O_PROXY_PORT