From abb725be85cb3c932b7931b4fd50599b26ed3ed6 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Thu, 3 Sep 2026 14:42:33 -0500 Subject: [PATCH] =?UTF-8?q?feat(oam):=20nginx=20vhost=20SoR=20=E2=80=94=20?= =?UTF-8?q?OAM=20docker=20UIs=20behind=20fleet=20TLS=20[#697]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 4 subdomain vhosts proxying to local docker ports; SAN cert from fleet CA; workstation chain-verified (ssl_verify=0 all four). Detail: https://projects.knownelement.com/issues/697 --- oam/oam-ui-nginx.vhost | 60 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 oam/oam-ui-nginx.vhost diff --git a/oam/oam-ui-nginx.vhost b/oam/oam-ui-nginx.vhost new file mode 100644 index 0000000..a76c6a1 --- /dev/null +++ b/oam/oam-ui-nginx.vhost @@ -0,0 +1,60 @@ +# tsys-librenms nginx vhost for the OAM docker UIs — deployed 2026-09-03 [#697] +# cert: oam-ui.knel.net (SANs: smokeping/netdisco/oxidized/unpoller.knel.net) from fleet CA +# IaC codification tracked via #454 (AWX lane); this file is the config SoR copy. + +server { + listen 443 ssl; + server_name smokeping.knel.net; + ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain; + ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key; + + location / { + proxy_pass http://127.0.0.1:8081; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_http_version 1.1; + } +} +server { + listen 443 ssl; + server_name netdisco.knel.net; + ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain; + ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key; + + location / { + proxy_pass http://127.0.0.1:8082; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_http_version 1.1; + } +} +server { + listen 443 ssl; + server_name oxidized.knel.net; + ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain; + ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key; + + location / { + proxy_pass http://127.0.0.1:8083; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_http_version 1.1; + } +} +server { + listen 443 ssl; + server_name unpoller.knel.net; + ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain; + ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key; + + location / { + proxy_pass http://127.0.0.1:8084; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_http_version 1.1; + } +}