read/write support by nginx

[hboetes]

After a bit of googling I found, and tested this method to create two local account types: read and write. Testing it shows this method works as I expected, so I'd like to share this with you with the idea that

• Somebody else might find it useful
• Somebody can show me how to improve this recipe.

server {
    listen [::]:80;
    listen 80;

    server_name  registry.example.com;

    # Letsencrypt needs http for acme challenges
    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        alias  /var/www/acme/.well-known/acme-challenge/;
        allow all;
    }

    location / {
        return 301 https://registry.example.com$request_uri;
    }
}

server {
    listen [::]:443 ssl;
    listen 443 ssl;

    ssl_certificate_key /etc/letsencrypt/live/registry.example.com/privkey.pem;
    ssl_certificate     /etc/letsencrypt/live/registry.example.com/fullchain.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    server_name  registry.example.com;

    add_header          Strict-Transport-Security "max-age=31536000;includeSubDomains" always;

    # Original recipe found here:
    # https://gist.github.com/JanKoppe/292d193d60d2fd3f05fde4d27652d46f
    location / {
        location / {
          auth_basic           "read";
          auth_basic_user_file /etc/nginx/htpasswd_read;
          limit_except GET {
            auth_basic           "write";
            auth_basic_user_file /etc/nginx/htpasswd_write;
          }
          proxy_pass         http://127.0.0.1:5000/;
          proxy_redirect     off;
          proxy_set_header   Host             $host;
          proxy_set_header   X-Real-IP        $remote_addr;
          proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
          proxy_set_header  X-Forwarded-Proto $scheme;
          proxy_read_timeout                  900;
        }
    }

    location /browser {
          auth_basic           "read";
          auth_basic_user_file /etc/nginx/htpasswd_read;
          limit_except GET {
            auth_basic           "write";
            auth_basic_user_file /etc/nginx/htpasswd_write;
          }
          proxy_pass        http://127.0.0.1:8080/;
          proxy_redirect    off;
          proxy_set_header  Host              $host;
          proxy_set_header  X-Real-IP         $remote_addr;
          proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
          proxy_set_header  X-Forwarded-Proto $scheme;
          proxy_read_timeout                  900;
    }
}