From: Sophie Brun <sophie@offensive-security.com>
Date: Fri, 20 May 2022 10:06:07 +0200
Subject: Adapt nginx config for Kali

Adapt the nginx config to use it outtside of a Docker container.
Use specific paths like /var/lib/defectdojo to allow the user _defectdojo
to read, write or modify the directories and files.
---
 nginx/nginx.conf     | 26 ++++++++++++++------------
 nginx/nginx_TLS.conf | 17 +++++++----------
 2 files changed, 21 insertions(+), 22 deletions(-)

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 711954d..1ece4cb 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -1,5 +1,5 @@
 worker_processes auto;
-error_log /var/log/nginx/error.log warn;
+error_log /var/log/defectdojo/error.log warn;
 pid /var/run/defectdojo/nginx.pid;
 events {
   worker_connections  1024;
@@ -10,13 +10,15 @@ http {
   log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for"';
-  access_log /var/log/nginx/access.log main;
+  access_log /var/log/defectdojo/access.log main;
+  client_body_temp_path /var/lib/defectdojo/body;
+  fastcgi_temp_path /var/lib/defectdojo/fastcgi;
+  proxy_temp_path /var/lib/defectdojo/proxy;
+  scgi_temp_path /var/lib/defectdojo/scgi;
+  uwsgi_temp_path /var/lib/defectdojo/uwsgi;
   client_max_body_size 800m;
   sendfile on;
   keepalive_timeout 65;
-  upstream uwsgi_server {
-    include /run/defectdojo/uwsgi_server;
-  }
   # Disable metrics auth for localhost (for nginx prometheus exporter)
   geo $metrics_auth_bypass {
     127.0.0.1/32 "off";
@@ -35,11 +37,11 @@ http {
       root /usr/share/nginx/html;
     }
     location /static/ {
-      alias /usr/share/nginx/html/static/;
+      alias /usr/lib/defectdojo/dojo/static/;
     }
     location / {
-      include /run/defectdojo/uwsgi_pass;
-      include /etc/nginx/wsgi_params;
+      uwsgi_pass 127.0.0.1:3031;
+      include /etc/defectdojo/wsgi_params;
       uwsgi_read_timeout 1800;
     }
     location /django_metrics {
@@ -47,8 +49,8 @@ http {
       # variables METRICS_HTTP_AUTH_USER and METRICS_HTTP_AUTH_PASSWORD
       #auth_basic $metrics_auth_bypass;
       #auth_basic_user_file /etc/nginx/.htpasswd;
-      include /run/defectdojo/uwsgi_pass;
-      include /etc/nginx/wsgi_params;
+      uwsgi_pass 127.0.0.1:3031;
+      include /etc/defectdojo/wsgi_params;
       uwsgi_read_timeout 1800;
     }
     location /nginx_status {
@@ -68,8 +70,8 @@ http {
     location = /uwsgi_health {
       limit_except GET { deny all; }
       rewrite /.+ /login?force_login_form&next=/ break;
-      include /run/defectdojo/uwsgi_pass;
-      include /etc/nginx/wsgi_params;
+      uwsgi_pass 127.0.0.1:3031;
+      include /etc/defectdojo/wsgi_params;
       access_log off;
     }
 
diff --git a/nginx/nginx_TLS.conf b/nginx/nginx_TLS.conf
index 2b2bd18..a91ff72 100644
--- a/nginx/nginx_TLS.conf
+++ b/nginx/nginx_TLS.conf
@@ -15,9 +15,6 @@ http {
   client_max_body_size 800m;
   sendfile on;
   keepalive_timeout 65;
-  upstream uwsgi_server {
-    include /run/defectdojo/uwsgi_server;
-  }
   server {
       listen 8080;
       location / {
@@ -50,11 +47,11 @@ http {
         root                    /usr/share/nginx/html;
     }
     location /static/ {
-      alias /usr/share/nginx/html/static/;
+      alias /usr/lib/defectdojo/dojo/static/;
     }
     location / {
-      include /run/defectdojo/uwsgi_pass;
-      include /etc/nginx/wsgi_params;
+      uwsgi_pass 127.0.0.1:3031;
+      include /etc/nginx/uswgi_params;
       uwsgi_read_timeout 1800;
 
       # an HTTP header important enough to have its own Wikipedia entry:
@@ -78,8 +75,8 @@ http {
       # variables METRICS_HTTP_AUTH_USER and METRICS_HTTP_AUTH_PASSWORD
       #auth_basic $metrics_auth_bypass;
       #auth_basic_user_file /etc/nginx/.htpasswd;
-      include /run/defectdojo/uwsgi_pass;
-      include /etc/nginx/wsgi_params;
+      uwsgi_pass 127.0.0.1:3031;
+      include /etc/nginx/uswgi_params;
       uwsgi_read_timeout 1800;
 
       # an HTTP header important enough to have its own Wikipedia entry:
@@ -130,8 +127,8 @@ http {
     location = /uwsgi_health {
       limit_except GET { deny all; }
       rewrite /.+ /login?force_login_form&next=/ break;
-      include /run/defectdojo/uwsgi_pass;
-      include /etc/nginx/wsgi_params;
+      uwsgi_pass 127.0.0.1:3031;
+      include /etc/nginx/uswgi_params;
       access_log off;
     }
     error_page 500 502 503 504 /50x.html;
