v3.1.3: Merge pull request #90 from UKHomeOffice/change-quay-account

Migrate to nginx-proxy's dedicated Quay.io account

v3.1.2: Merge pull request #89 from UKHomeOffice/downgrade-to-sh

Downgrade publish.sh to vanilla Bourne shell

v3.1.1: Merge pull request #88 from UKHomeOffice/push-to-quay

Push to Quay.io

Update NGINX and other dependencies

Also allows for disabling the Sysdig metrics server.

v3.0.1: Merge pull request #81 from UKHomeOffice/update-ports-in-readme

Update exposed ports in README

No longer run as root

We no longer run as root as a result we have had to change the default listen ports.

BREAKING CHANGES:

• Default HTTP listen port is now 10080.
• Default HTTPS listen port is now 10443.
• We provide some extra headers (for security reasons) that could affect browser behaviour.

Upstream TLS certificates

Merge pull request #64 from UKHomeOffice/verify-upstream

Add support for verifying the upstream server's cert

v2.0.2: Bugfix: Proxy protocol doesn't mix with NAXSI

Fixes a bug in which requests blocked by NAXSI came back as a 502 rather
than a 418 when running with proxy protocol enabled. This is because the
/RequestDenied route proxies to localhost but doesn't know to speak
proxy protocol.

This has been fixed by giving NAXSI its own private port (defaults to 10418) that
never expects proxy protocol.

Also makes the port configurable via an environment variable.

This may also be useful for SysDig.

Custom error pages support with SSI (+ bugfix)

Error pages must now be mounted in with a .shtml extension. For example, if you want to intercept status code 505 then you must mount in /usr/local/openresty/nginx/html/505.shtml.

Server-side includes allow error pages to be templated and to include some information on the failed request, such as a timestamp.

Custom error pages support with SSI

Error pages must now be mounted in with a .shtml extension. For example, if you want to intercept status code 505 then you must mount in /usr/local/openresty/nginx/html/505.shtml.

Server-side includes allow error pages to be templated and to include some information on the failed request, such as a timestamp.