Bunkerized-Nginx
Infrastructure
nginx docker image
SHOW HN2020
How HN took it
4 positive, 14 neutral or asking, 0 mixed, 24 critical, out of 42 comments about the project. Thread score -0.48.
Idea: 4 for, 7 againstExecution: 0 for, 8 againstDesign: 0 for, 5 againstPerformance: 0 for, 2 againstPrivacy: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for hardening a self-hosted or production reverse proxy
From 2 comments
Hmm, looks like it would serve a very similar role as Caddy does for me right now (though my Caddy SSO w/ JWT is something I'd have to recreate). I wish this had existed a few…
joshstrange on HNAgreed, I’ll probably keep using Caddy for my self-hosted apps but this looks like a nice alternative for more production-facing things.
joshstrange on HN
Configurable via environment variables and open source
From 1 comment
If you only read the HN comments, you will probably not check this repo out. Well you should: - everything is easily configurable by env vars so the features that some are hating…
iRomain on HN
Objections
Blocking Tor, proxies and countries is not effective and hurts legitimate users
From 3 comments
> Block TOR, proxies, bad user-agents, countries Does this really help? Especially blocking TOR and whole countries seems bad. As for blocking user-agents: why? Sorta seems like…
SahAssar on HN> You block TOR. More complaints that some users cannot access, but other than that no more complaints about spam. Sure, if this worked. But it's not 2010 any more. Simple stuff…
phil21 on HN> Block TOR sadface At least have a good reason for doing this instead of outright doing it for 'Security'. As far as I'm concerned you've made the site less privacy friendly. At…
dmix on HN
Too much complexity and configuration makes it less secure
From 3 comments
Hundreds of configurable parameters, thousands of lines of code ... Are you sure that this is actually more secure?
throwaway4good on HNA more secure (and much simpler to maintain) version would be just running nginx from your repos without all these extra things. nginx is secure by default. The insecurity comes…
superkuh on HNKeeping systems lean, with little possibilities for configuration errors, can help keep them secure. This Bloatware certainly not.
burrnii on HN
Docker container design violates best practices and runs as root
From 3 comments
Shouldn't the Dockerfile have a USER directive, so it doesn't use root by default?
gui77aume on HNIt violates a lot of principles of using containers. There's no separation of concerns here, builds aren't reproducible, it hijacks logging for its own setup, appears to allow…
uponcoffee on HNThe linked repo. I mostly agree with you that most of this should be in containers; I should have been more clear to what part of your comment I was addressing. In regards to…
uponcoffee on HN
Session cookies may be reusable without IP binding in the captcha flow
From 1 comment
From what I understand, when a user completes a captcha, you set a session cookie, using resty.session, which I assume is this library:…
progval on HN
Requests
Provide a config file or config generator instead of only a Docker image
From 1 comment
I'd prefer if this were not offered as a docker image, but rather as a configuration file or config file generator, akin to what mozilla does for recommended SSL settings [0]. A…
TheDong on HN
Use CAP_NET_BIND_SERVICE instead of running as root
From 1 comment
It's better to run as a non-root user, and use the CAP_NET_BIND_SERVICE capability (see capabilities(7)) to allow only the minimal privileges necessary to bind to a low-numbered…
otterley on HN
Add a CSP walkthrough or generator
From 1 comment
For folks interested in further reading, I like this guide for hardening nginx: https://github.com/trimstray/nginx-admins-handbook Seems some very critical security mechanisms…
jchook on HN
Questions
Why block Tor and user agents?
From 2 comments
> Block TOR, proxies, bad user-agents, countries Does this really help? Especially blocking TOR and whole countries seems bad. As for blocking user-agents: why? Sorta seems like…
SahAssar on HNFrom the list of features: > Block TOR Why the hell should I block TOR? I better block users from mass testing passwords on my login masks, but do not distinguish them of their…
ktpsns on HN
Is the Caddy v2 migration path possible?
From 1 comment
Have you looked into how to migrate this to caddy v2?
efrecon on HN
Alternatives named
Caddy
From 2 comments
Hmm, looks like it would serve a very similar role as Caddy does for me right now (though my Caddy SSO w/ JWT is something I'd have to recreate). I wish this had existed a few…
joshstrange on HNAlso using Caddy as a reverse proxy for a number of containers. This is definitely an attractive alternative. Really isn’t of concern at my current scale, but Nginx offers some…
bransonf on HN
nginx installed from distro repos
From 1 comment
A more secure (and much simpler to maintain) version would be just running nginx from your repos without all these extra things. nginx is secure by default. The insecurity comes…
superkuh on HN
Mozilla SSL config generator
From 1 comment
I'd prefer if this were not offered as a docker image, but rather as a configuration file or config file generator, akin to what mozilla does for recommended SSL settings [0]. A…
TheDong on HN