diff options
| author | John Estabrook <jestabro@vyos.io> | 2026-09-02 08:37:55 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-02 08:37:55 -0500 |
| commit | ccd46229b1e2501662e92dc3af03442dac8cd9c6 (patch) | |
| tree | ba80d40245ae3a2e7cd93ced5409e4ed9471dbbe /data/templates/https/nginx.default.j2 | |
| parent | 07c75ec9a9b2f59e3d0050e9c76893242a379679 (diff) | |
| parent | 71ea2f3d9f654f1b3ab9e08fa6cdff4447b3fc0a (diff) | |
| download | vyos-1x-ccd46229b1e2501662e92dc3af03442dac8cd9c6.tar.gz vyos-1x-ccd46229b1e2501662e92dc3af03442dac8cd9c6.zip | |
Merge pull request #5381 from omnom62/T8989-rest-api-bearer
http-api: T8989: add REST Bearer token authentication
Diffstat (limited to 'data/templates/https/nginx.default.j2')
| -rw-r--r-- | data/templates/https/nginx.default.j2 | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/data/templates/https/nginx.default.j2 b/data/templates/https/nginx.default.j2 index e0ebe79fc..0f1a79ad7 100644 --- a/data/templates/https/nginx.default.j2 +++ b/data/templates/https/nginx.default.j2 @@ -48,14 +48,24 @@ server { ssl_prefer_server_ciphers on; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK'; +{% if certificates.mtls_ca_path is vyos_defined %} + # mTLS - client certificate verification + ssl_client_certificate {{ certificates.mtls_ca_path }}; + ssl_verify_client {{ "on" if certificates.verify_client == "required" else certificates.verify_client }}; + ssl_verify_depth 2; +{% endif %} # proxy settings for HTTP API, if enabled; 503, if not - location ~ ^/(retrieve|configure|config-file|image|import-pki|container-image|generate|show|reboot|reset|poweroff|ping|traceroute|info|docs|openapi.json|redoc|graphql|renew) { + location ~ ^/(retrieve|configure|config-file|image|import-pki|container-image|generate|show|reboot|reset|poweroff|ping|traceroute|info|docs|openapi.json|redoc|graphql|renew|token) { {% if api is vyos_defined %} proxy_pass http://unix:/run/api.sock; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 600; proxy_buffering off; +{% if certificates.mtls_ca_path is vyos_defined %} + proxy_set_header X-Client-Verify $ssl_client_verify; + proxy_set_header X-Client-DN $ssl_client_s_dn; +{% endif %} {% else %} return 503; {% endif %} |