fix(ns-ui): removing static nginx file for 443 locations

packages/ns-ui/Makefile

@@ -62,8 +62,6 @@ define Package/ns-ui/install
 	$(INSTALL_DIR) $(1)/www-ns
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_DIR) $(1)/usr/sbin
-	$(INSTALL_DIR) $(1)/etc/nginx/conf.d
-	$(INSTALL_CONF) ./files/00ns.locations $(1)/etc/nginx/conf.d/
 	$(INSTALL_CONF) ./files/config $(1)/etc/config/ns-ui
 	$(INSTALL_BIN) ./files/ns-ui $(1)/usr/sbin
 	$(INSTALL_DIR) $(1)/etc/init.d

packages/ns-ui/files/ns-ui

@@ -9,14 +9,59 @@ set -e
 
 NSUI_FILE=/etc/nginx/conf.d/00ns.locations
 NSUI_EXTRA_FILE=/etc/nginx/conf.d/ns-ui.conf
+NSUI_API_LOCATIONS_FILE=/etc/nginx/conf.d/ns-ui-api.inc
 LUCI_FILE=/etc/nginx/conf.d/luci.locations
 
+# Shared API locations, included by both the default and extra ns-ui instances
+# This is being put here instead of statically due to the following issue:
+# https://github.com/NethServer/nethsecurity/issues/1834
+cat <<'EOF' > "$NSUI_API_LOCATIONS_FILE"
+# body size limits on unauthenticated routes to prevent memory exhaustion
+location = /api/login {
+	client_max_body_size 32k;
+	proxy_set_header Host $host;
+	proxy_set_header X-Forwarded-For $remote_addr;
+	proxy_pass http://127.0.0.1:8090;
+}
+
+location = /api/logout {
+	client_max_body_size 1k;
+	proxy_set_header Host $host;
+	proxy_set_header X-Forwarded-For $remote_addr;
+	proxy_pass http://127.0.0.1:8090;
+}
+
+location = /api/2fa/otp-verify {
+	client_max_body_size 32k;
+	proxy_set_header Host $host;
+	proxy_set_header X-Forwarded-For $remote_addr;
+	proxy_pass http://127.0.0.1:8090;
+}
+
+location /api/ {
+	proxy_set_header Host $host;
+	proxy_set_header X-Forwarded-For $remote_addr;
+	proxy_pass http://127.0.0.1:8090/api/;
+	proxy_read_timeout 180s;
+}
+EOF
+
 # Manage default ns-ui instance on port 443
 nsui_enable=$(uci -q get ns-ui.config.nsui_enable)
+rm -f "$NSUI_FILE.disabled"
 if [ "$nsui_enable" == "1" ]; then
-    [ -f "$NSUI_FILE.disabled" ] && mv -f "$NSUI_FILE.disabled" "$NSUI_FILE"
+    cat <<EOF > "$NSUI_FILE"
+# NethSecurity UI and API
+
+location / {
+	root /www-ns;
+	try_files \$uri \$uri/ /index.html;
+}
+
+include $NSUI_API_LOCATIONS_FILE;
+EOF
 else
-    [ -f "$NSUI_FILE" ] && mv -f "$NSUI_FILE" "$NSUI_FILE.disabled"
+    rm -f "$NSUI_FILE"
 fi
 
 # Manage default luci instance on port 443
@@ -55,34 +100,7 @@ server {
 		try_files \$uri \$uri/ /index.html;
 	}
 
-	# body size limits on unauthenticated routes to prevent memory exhaustion
-	location = /api/login {
-		client_max_body_size 32k;
-		proxy_set_header Host \$host;
-		proxy_set_header X-Forwarded-For \$remote_addr;
-		proxy_pass http://127.0.0.1:8090;
-	}
-
-	location = /api/logout {
-		client_max_body_size 1k;
-		proxy_set_header Host \$host;
-		proxy_set_header X-Forwarded-For \$remote_addr;
-		proxy_pass http://127.0.0.1:8090;
-	}
-
-	location = /api/2fa/otp-verify {
-		client_max_body_size 32k;
-		proxy_set_header Host \$host;
-		proxy_set_header X-Forwarded-For \$remote_addr;
-		proxy_pass http://127.0.0.1:8090;
-	}
-
-	location /api/ {
-		proxy_set_header Host \$host;
-        proxy_set_header X-Forwarded-For \$remote_addr;
-		proxy_pass http://127.0.0.1:8090/api/;
-		proxy_read_timeout 180s;
-	}
+	include $NSUI_API_LOCATIONS_FILE;
 }
 EOF
 else