Copy
sudo apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
sudo echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" | tee /etc/apt/sources.list.d/nginx.list
sudo apt update
sudo apt install nginx-module-njs

Copy
# Explicitly map external host names to internal ones.  
# This could be done with a regex, but being explicit is clearer
map $host $internal_host {
    admin.[EXTERNAL_DOMAIN]             admin.[INTERNAL_DOMAIN];    
    api.[EXTERNAL_DOMAIN]               api.[INTERNAL_DOMAIN];    
    auth.[EXTERNAL_DOMAIN]              auth.[INTERNAL_DOMAIN]; 
    home.[EXTERNAL_DOMAIN]               home.[INTERNAL_DOMAIN];
    [INSTANCE_ID].manage.[EXTERNAL_DOMAIN]  [INSTANCE_ID].manage.[INTERNAL_DOMAIN];
}

server {
    set $domain_in '[EXTERNAL_DOMAIN]';
    set $domain_out '[INTERNAL_DOMAIN]';

    # Internal DNS Server for upstream proxy
    resolver [INTERNAL_DNS_SERVER];
    server_name *.$domain_in;

    # Path to a root folder for the web server, here we use /var/www/html
    root /var/www/html;

    # Some of the upstream header responses are large, increase the buffer size to accommodate 
    proxy_busy_buffers_size   512k;
    proxy_buffers   4 512k;
    proxy_buffer_size   256k;

    # Set the path were Nginx scripts are stored.
    js_path /etc/nginx/njs;

    # Import the functions from the mas_rewrites.js script.
    js_import main from mas_rewrites.js;

    # Replace the query values and return the result to the $query variable.
    js_set $query main.replace_query;

    location / {
        # Call the cookies_filter function in the mas_rewrites.js script.
        js_header_filter main.cookies_filter;

        # Call the body_filter function in the mas_rewrites.js script.
        js_body_filter main.body_filter; 

        # Call the rewrite_cookie function and store the result to the $rewritten_cookie variable
        js_set $rewritten_cookie main.rewrite_cookie;
        proxy_ssl_name                $host;
        proxy_pass                    https://$internal_host$uri$query;
        proxy_ssl_verify              off;
        proxy_ssl_server_name         on;
        proxy_ssl_session_reuse       on;
        proxy_set_header              Host $internal_host;
        proxy_set_header              X-Real-IP $remote_addr;
        proxy_set_header              X-Forwarded-For $proxy_add_x_forwarded_for;
        
        # Do not accept upstream gzip otherwise replacement doesn't work.
        proxy_set_header Accept-Encoding "";

        # Replace the Cookie header with the rewritten version.
        proxy_set_header Cookie $rewritten_cookie;
        
        # Replace the internal domain (e.g. sharptree.local) with the external domain (e.g. sharptree.io)
        proxy_cookie_domain mas.$domain_out mas.$domain_in;
        add_header x-public-uri $host;       

        add_header Access-Control-Allow-Origin $http_origin;
        add_header Access-Control-Allow-Methods "POST,GET,HEAD,PUT,OPTIONS";
        add_header Access-Control-Allow-Credentials true;
        add_header Access-Control-Expose-Headers csrftoken;
        add_header Access-Control-Allow-Headers "authorization, content-type, maxauth, x-public-uri" ;

        sub_filter_types *
        sub_filter_once off;
        sub_filter "$domain_out" "$domain_in";
   }

    listen 443 ssl; 
    ssl_certificate [PATH_TO_SSL_CERTIFICATE]; 
    ssl_certificate_key [PATH_TO_SSL_CERTIFICATE_KEY];
}

server {
    // SSL redirect
    if ($host = [EXTERNAL_DOMAIN]) {
        return 301 https://$host$request_uri;
    } 

    server_name [EXTERNAL_DOMAIN] ;
    listen 80;
    return 404; 
}

Copy
sudo nano /etc/nginx/sites-available/mas.sharptree.io

Copy
sudo mkdir -p /etc/nginx/njs

Copy
sudo nano /etc/nginx/njs/mas_rewrites.js

Copy
import qs from 'querystring';

function rewrite_cookie(r) {
    var cookies = r.headersIn['Cookie'];

    if (cookies) {
        return cookies.split(r.variables.domain_in).join(r.variables.domain_out);
    } else {
        return "";
    }
}

function cookies_filter(r) {
    var cookies = r.headersOut['Set-Cookie'];

    if (cookies) {
        r.headersOut['Set-Cookie'] = cookies.map(c => c.replace(r.variables.domain_out, r.variables.domain_in));
    }

    var location = r.headersOut.location;

    if (location) {
        r.headersOut.location = location.split(r.variables.domain_out).join(r.variables.domain_in);
    }

    // There are missing entries for gstatic and walkme in the out of the box implementation, 
    // fixing that here and also adding the appropriate internal references.
    r.headersOut['content-security-policy'] = "default-src 'self' https://*." + r.variables.domain_in + "; img-src https: data:;  font-src 'self' data: https://fonts.gstatic.com https://1.www.s81c.com ; script-src https://cdn.walkme.com 'unsafe-eval' 'unsafe-inline' https://*." + r.variables.domain_in + "; object-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src https://*." + r.variables.domain_in + " https://*.walkme.com ;"

    // If future versions of MAS fix the CSP issues:
    // * Comment out the line above, as it is no longer necessary
    // * Uncomment the code below to simply swap domains where needed.

    // var content_security_policy = r.headersOut["content-security-policy"];
    // if (content_security_policy) {
    //     r.headersOut["content-security-policy"] = content_security_policy.split(r.variables.domain_out).join(r.variables.domain_in);
    // }
}

function body_filter(r, data, flags) {
    // for string data replace the out domain (e.g. sharptree.local) with the in domain (e.g. sharptree.io)
    if (typeof data === 'string') {
        r.sendBuffer(data.split(r.variables.domain_out).join(r.variables.domain_in), flags);
    } else {
        r.sendBuffer(data, flags);
    }
}

function replace_query(r) {
    if (typeof r.variables.args !== 'undefined') {
        let query = qs.parse(r.variables.args);
        if (query['redirect_uri']) {
            query['redirect_uri'] = query['redirect_uri'].replace(r.variables.domain_in, r.variables.domain_out);
        }
        return "?" + qs.stringify(query);
    }
    return "";
}

export default { cookies_filter, body_filter, replace_query, rewrite_cookie };

Copy
sudo ln -s /etc/nginx/sites-available/mas.sharptree.io /etc/nginx/sites-enabled/mas.sharptree.io

Copy
sudo systemctl restart nginx