Nginx Web Server Setup
Relevant source files
The following files were used as context for generating this wiki page:
The Nginx web server, identified as the repo-web service, provides an HTTP interface for the OPSI software repository. It serves packaged .opsi archives and repository metadata to OPSI clients and administrators. The server operates in a read-only capacity, mounting the repository directory to deliver files without exposing the internal builder state or the Docker socket.
Sources: README.md:14-16, docker-compose.yml:43-48
Architecture and Data Flow
The repo-web service uses the nginx:stable-alpine image. It functions as the public-facing side of the repository architecture. While the repo-builder service generates and updates packages, Nginx remains a static file server that provides directory listings and file downloads.
The diagram above shows the relationship between the builder, the physical repository storage, and the Nginx web server.
Sources: README.md:14-16, docker-compose.yml:33-51
Server Configuration
The Nginx server is configured via nginx/default.conf. It listens on port 80 inside the container, which is mapped to a configurable host port (default 8088). The configuration enforces strict access controls to ensure the repository remains secure and read-only.
Access Controls and Security
Nginx limits interactions to GET and HEAD requests only. All other methods are denied. It explicitly blocks access to hidden files (files starting with a dot). The server also implements the X-Content-Type-Options: nosniff header to prevent MIME type sniffing.
Sources: nginx/default.conf:1-14, docker-compose.yml:44-46
Directory Listing
The server enables autoindex, allowing users to browse the repository contents through a web browser. It uses UTF-8 charset encoding and defaults to application/octet-stream for file downloads to ensure .opsi packages are handled correctly as binary data.
Sources: nginx/default.conf:5-8
Configuration Summary
The following table summarizes the primary Nginx configuration parameters defined in the environment and configuration files.
| Parameter | Type | Default Value | Description |
|---|---|---|---|
HTTP_PORT | Environment Variable | 8088 | Host port mapped to Nginx port 80 |
HTTP_BIND_ADDRESS | Environment Variable | 0.0.0.0 | Host IP address to bind for the HTTP service |
root | Nginx Directive | /usr/share/nginx/html | Internal container path for repository data |
autoindex | Nginx Directive | on | Enables directory listing for repository navigation |
Sources: docker-compose.yml:44-46, README.md:92-93, nginx/default.conf:4-5
Service Security Profile
The Nginx container runs with a restricted security profile in the Docker Compose environment to minimize the attack surface:
- Read-Only Filesystem: The container filesystem is read-only, except for specific
tmpfsmounts for volatile data. - Capability Drop: All Linux capabilities are dropped (
ALL), and only specific networking and ownership capabilities are added back. - No Privilege Escalation: The
no-new-privilegessecurity option is enabled. - Healthcheck: A built-in healthcheck uses
wgetto verify the server is responding on the local interface every 30 seconds.
Sources: docker-compose.yml:46-62
Implementation Snippet
The following snippet shows the core server block configuration used to serve the repository data.
server {
listen 80;
server_name _;
root /usr/share/nginx/html;
autoindex on;
autoindex_exact_size off;
charset utf-8;
default_type application/octet-stream;
add_header X-Content-Type-Options nosniff always;
location / {
limit_except GET HEAD { deny all; }
try_files $uri $uri/ =404;
}
location ~ /\. { deny all; }
}
Sources: nginx/default.conf:1-15
Conclusion
The Nginx web server setup provides a lightweight, secure, and read-only gateway to the OPSI repository. By utilizing standard Alpine-based Nginx images and strict request filtering, the system ensures that software packages are accessible for deployment while protecting the integrity of the underlying repository structure.