voxpupuli / puppet-nginx

Puppet Module to manage NGINX on various UNIXes
https://forge.puppet.com/puppet/nginx
MIT License
471 stars 881 forks source link

Location priority does not work when location is specified on server->locations #1428

Open davidc opened 3 years ago

davidc commented 3 years ago

Affected Puppet, Ruby, OS and module versions/distributions

How to reproduce (e.g Puppet code you use)

nginx::nginx_servers:
  sub.domain.net:
    listen_ip: 1.2.3.4
    ipv6_enable: true
    ipv6_listen_ip: '1:2:3::4'
    listen_port: 80
    ssl_redirect: true
    access_log: /usr/local/www/sub.domain.net/logs/access.log
    error_log: /usr/local/www/sub.domain.net/logs/error.log
    proxy: http://127.0.0.1:5002
    locations:
      acme-challenge:
        priority: 450
        ssl_only: false
        location: '/.well-known/acme-challenge/'
        location_alias: '/var/www/html/.well-known/acme-challenge/'

What are you seeing

server {
  listen 1:2:3:4:80;
  listen [1:2:3::4]:80 default ipv6only=on;

  server_name           sub.domain.net;

  access_log            /usr/local/www/sub.domain.net/logs/access.log combined;
  error_log             /usr/local/www/sub.domain.net/logs/error.log;

  location / {
    return 301 https://$host$request_uri;
  }

  location /.well-known/acme-challenge/ {
    alias /var/www/html/.well-known/acme-challenge/;
    index     index.html index.htm index.php;
  }
}

What behaviour did you expect instead

The user-defined location should be before the default location because it has a lower priority value.

Output log

Any additional information you'd like to impart

davidc commented 3 years ago

(I also tried 550 in case I got the priority the wrong way around)

davidc commented 3 years ago

This also puts it in the wrong order:

  acme-challenge:
    priority: 450
    ssl_only: false
    location: '/.well-known/acme-challenge/'
    server: 'sub.domain.net'
    location_alias: '/var/www/html/.well-known/acme-challenge/'
davidc commented 3 years ago

It is put in the correct order with ssl_only: true but of course then it is only generated on the SSL version of the server.