Update to 2024-09-26 12:00

roles/nomad/templates/jwks-proxy.conf.j2

@@ -0,0 +1,63 @@
+worker_processes  auto;
+
+error_log  {{ nomad_root_dir }}/log/jwks-proxy-error.log notice;
+pid        /run/nomad/nomad-jwks-proxy.pid;
+
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+  proxy_temp_path {{ nomad_root_dir }}/tmp/proxy_temp;
+  client_body_temp_path {{ nomad_root_dir }}/tmp/client_temp;
+  fastcgi_temp_path {{ nomad_root_dir }}/tmp/fastcgi_temp;
+  uwsgi_temp_path {{ nomad_root_dir }}/tmp/uwsgi_temp;
+  scgi_temp_path {{ nomad_root_dir }}/tmp/scgi_temp;
+
+  include       /etc/nginx/mime.types;
+  default_type  application/octet-stream;
+
+  log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+  access_log  {{ nomad_root_dir }}/log/jwks-proxy-access.log  main;
+
+  sendfile        on;
+  #tcp_nopush     on;
+
+  keepalive_timeout  65;
+
+  server {
+    listen {{ nomad_services.jwks_proxy.port }} ssl;
+  
+    proxy_ssl_certificate {{ nomad_conf.tls.cert_file }};
+    proxy_ssl_certificate_key {{ nomad_conf.tls.key_file }};
+    proxy_ssl_verify on;
+    proxy_ssl_name localhost;
+    proxy_ssl_trusted_certificate {{ nomad_conf.tls.ca_file }};
+      
+    ssl_certificate {{ nomad_conf.tls.cert_file }};
+    ssl_certificate_key {{ nomad_conf.tls.key_file }};
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_session_cache shared:SSL:10m;
+    ssl_session_timeout 1h;
+    ssl_session_tickets off;
+    gzip on;
+    gzip_types
+      text/plain;
+    gzip_vary on;
+  
+    server_tokens off;
+  
+    if ($request_method !~ ^(GET|HEAD|OPTIONS)$ ) {
+      return 405;
+    }
+    location /.well-known/jwks.json {
+      proxy_pass https://localhost:{{ nomad_services.http.port }};
+    }
+  }
+}

roles/nomad/templates/jwks-proxy.service.j2

@@ -0,0 +1,22 @@
+[Unit]
+Description=Nomad JWKS proxy
+After=syslog.target network-online.target remote-fs.target nss-lookup.target nomad.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User={{ nomad_user }}
+Group={{ nomad_user }}
+PIDFile=/run/nomad/nomad-jwks-proxy.pid
+ExecStartPre=/sbin/nginx -t -c {{ nomad_root_dir }}/jwks-proxy/nginx.conf -e /dev/null
+ExecStartPre=/bin/rm -f /run/nomad/nomad-jwks-proxy.pid
+ExecStart=/sbin/nginx -c {{ nomad_root_dir }}/jwks-proxy/nginx.conf -g "daemon off;" -e /dev/null
+ExecReload=/bin/kill -s HUP $MAINPID
+ExecStop=/bin/kill -s QUIT $MAINPID
+PrivateTmp=true
+Restart=on-failure
+StartLimitInterval=0
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target

roles/nomad/templates/logrotate.conf.j2

@@ -0,0 +1,12 @@
+{{ nomad_root_dir }}/log/*log {
+    create 0644 {{ nomad_user }} {{ nomad_user }}
+    daily
+    rotate 60
+    missingok
+    notifempty
+    compress
+    sharedscripts
+    postrotate
+        /bin/kill -USR1 `cat {{ nomad_root_dir }}/tmp/nomad-jwks-proxy.pid 2>/dev/null` 2>/dev/null || true
+    endscript
+}