Nginx Reference

April 21, 2026 ยท View on GitHub

Role In Scenario

Nginx provides the HTTP and HTTPS surface for pbx1. It serves the default landing page, browser softphone, voicemail artifacts, exported user-agent data, and the Let's Encrypt webroot flow.

  • ports: 80/TCP and 443/TCP
  • network mode: host
  • certificates are read from data/certs
  • the shared voicemail, wwwlog, and acme-challenge volumes are mounted into the document root
  • the running image also exposes release metadata at /__version

Key Files

FilePurpose
build/nginx/config/sites-available/default.pbx1site definitions, exposed paths, and access rules
build/nginx/config/options-ssl-nginx.confTLS defaults
build/nginx/web-pbx1/static site content
compose/pbx1.ymlvolume mounts, env vars, and health check
VERSIONstack release tag used by published images

Intentionally Vulnerable Behavior

  • /voicemail/ has fancy directory indexing enabled via the fancyindex module
  • /call/ serves the browser softphone over HTTPS so browsers can access the microphone; HTTP requests are redirected to HTTPS with a 301
  • /logs/useragents exposes client-controlled data exported from MySQL
  • /secret/ is blocked externally (returns a custom 403.html error page) but reachable on the loopback-only server block used in the TURN relay exercise
  • the public landing page links to /call/, /logs/, and /secret/
  • /__version returns the versioned-image metadata for the running nginx image

Verification

. ./.env
curl "http://$PUBLIC_IPV4/"
curl -I "http://$PUBLIC_IPV4/voicemail/"
curl "http://$PUBLIC_IPV4/__version"
./scripts/compose.sh --scenario pbx1 logs nginx

On a native Linux Docker host, curl http://127.0.0.1/ is also a useful local-bind check. On Colima or another Linux VM workflow, prefer the bridged PUBLIC_IPV4 from .env for host-side verification because it matches the VM's real service identity. Current Colima releases may also forward those listeners onto macOS 127.0.0.1, but that is a convenience path rather than the canonical DVRTC endpoint.