[tor-commits] [meek/master] Add Yawning's Nginx reflector configuration.

[dcf at torproject.org]

commit 2cce35a5624cc0d93d1c2919c74519a854608c81
Author: David Fifield <david at bamsoftware.com>
Date:   Sat Dec 6 18:37:43 2014 -0800

    Add Yawning's Nginx reflector configuration.
    
    Copied from https://trac.torproject.org/projects/tor/wiki/doc/meek#UsingnginxinsteadofGoogleAppEnginePHPetc,
    which I am about to delete.
---
 README                   |    3 +++
 nginx/README             |    9 ++++++++
 nginx/nginx.conf.example |   53 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 65 insertions(+)

diff --git a/README b/README
index 4348942..72b8cb7 100644
--- a/README
+++ b/README
@@ -58,6 +58,9 @@ latencytest:
 A test program for App Engine that measures roundtrip times to different
 destinations.
 
+nginx:
+A reflector configuration for Nginx.
+
 php:
 A php reflector similar to the appengine one above. Ideally, it can be run on
 any platform that supports php. A public instance is at:
diff --git a/nginx/README b/nginx/README
new file mode 100644
index 0000000..24a224d
--- /dev/null
+++ b/nginx/README
@@ -0,0 +1,9 @@
+The file nginx.conf.example is an example configuration file for Nginx
+that shows how to run multiple virtual-host domain names, with one of
+them reflecting to an instance of meek-server. Clients can front behind
+one of the ordinary domain names in order to reach the reflector domain.
+
+Here is the matching client torrc configuration:
+	UseBridges 1
+	Bridge meek 0.0.2.0:1 url=https://meek-reflect.example.com/ front=www.example.com
+	ClientTransportPlugin meek exec ./meek-client --log meek-client.log
diff --git a/nginx/nginx.conf.example b/nginx/nginx.conf.example
new file mode 100644
index 0000000..0f0b4db
--- /dev/null
+++ b/nginx/nginx.conf.example
@@ -0,0 +1,53 @@
+# The configuration for the normal HTTPS server
+server {
+	# Set default_server so that real content gets served by default
+#	listen 443 default_server;
+	listen [::]:443 default_server;
+	server_name www.example.com;
+
+	# Boilerplate for SSL, adjust as appropriate.
+	ssl on;
+	ssl_certificate /etc/ssl/nginx/example.com.crt;
+	ssl_certificate_key /etc/ssl/nginx/example.com.key;
+	ssl_session_timeout 5m;
+	ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
+	ssl_ciphers !RC4:HIGH:!MD5:!aNULL:!DH;
+	ssl_prefer_server_ciphers on;
+
+	# Blah blah blah, normal site specific config
+	root /usr/share/nginx/www;
+	index index.html index.htm;
+	location / {
+		index index.html;
+	}
+}
+
+# Configuration for the reflector
+server {
+#	listen 443;
+	listen [::]:443;
+
+	# This does not need to be a real name, but it MUST be distinct from
+	# the host used for real content.
+	server_name meek-reflect.example.com;
+
+	# Boilerplate for SSL/TLS (copy/paste from the other server block)
+	ssl on;
+	ssl_certificate /etc/ssl/nginx/example.com.crt;
+	ssl_certificate_key /etc/ssl/nginx/example.com.key;
+	ssl_session_timeout 5m;
+	ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
+	ssl_ciphers !RC4:HIGH:!MD5:!aNULL:!DH;
+	ssl_prefer_server_ciphers on;
+
+	# This is where the magic happens
+	location / {
+		# Proxy traffic all traffic received with the meek Host to
+		# a meek-server instance.
+		proxy_pass http://meek.bamsoftware.com:7002;
+
+		# Disable logging for the reflector.
+		access_log off;
+		error_log /dev/null;
+	}
+}