-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
OLMIS-2957, provide better nginx.conf
Override the nginx.conf that comes in the base image with one more suitable to our deployment topology (AWS single host on linux) and document how an implementation should override our configuration in case they're on a different topology.
- Loading branch information
Showing
5 changed files
with
165 additions
and
117 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,125 +1,33 @@ | ||
| {{ $loaded_services := services }} | ||
| {{ $resources := tree (env "RESOURCES_PATH") }} | ||
| user nginx; | ||
| worker_processes 1; | ||
|
|
||
| {{ range $loaded_services }} | ||
| {{- if in .Tags (env "SERVICE_TAG") -}} | ||
| {{- $current_service := service .Name "any" -}} | ||
| {{- if not (eq (len $current_service) 0) }} | ||
| upstream {{ .Name }} { | ||
| least_conn; | ||
| {{ range $current_service }}server {{ .Address }}:{{ .Port }}; | ||
| {{ end }} | ||
| } | ||
| {{ end -}} | ||
| {{- end -}} | ||
| {{ end }} | ||
| error_log /var/log/nginx/error.log warn; | ||
| pid /var/run/nginx.pid; | ||
|
|
||
| log_format upstream_time '$remote_addr - $remote_user [$time_local] ' | ||
| '"$request" $status $body_bytes_sent ' | ||
| '"$http_referer" "$http_user_agent" ' | ||
| '$request_time $upstream_connect_time ' | ||
| '$upstream_header_time $upstream_response_time ' | ||
| '$pipe'; | ||
|
|
||
| server { | ||
| listen 80; | ||
| gzip on; | ||
| gzip_types application/json text/plain; | ||
| access_log {{ env "NGINX_LOG_DIR" }}/access.log upstream_time; | ||
| error_log {{ env "NGINX_LOG_DIR" }}/error.log; | ||
| server_name {{ env "VIRTUAL_HOST" }}; | ||
| client_max_body_size {{ env "CLIENT_MAX_BODY_SIZE" }}; | ||
| proxy_connect_timeout {{ env "PROXY_CONNECT_TIMEOUT" }}; | ||
| proxy_send_timeout {{ env "PROXY_SEND_TIMEOUT" }}; | ||
| proxy_read_timeout {{ env "PROXY_READ_TIMEOUT" }}; | ||
| send_timeout {{ env "SEND_TIMEOUT" }}; | ||
|
|
||
| {{ $paramRegex := "{[\\w-]+}" }} | ||
| {{ $allRegex := "<[\\w-]+>" }} | ||
| {{ $globalAllRegex := "^<[\\w-]+>$" }} | ||
|
|
||
| {{ $paramReplace := "[\\w-]+" }} | ||
| {{ $allReplace := ".+" }} | ||
|
|
||
| # First retrieve paths without parameters | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if not (or (regexMatch $paramRegex $location) (regexMatch $allRegex $location)) }} | ||
| location ~ /{{ $location }}/?$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
|
|
||
| # Retrieve paths with {param} wildcard | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if regexMatch $paramRegex $location }} | ||
| {{ $location := ($location | regexReplaceAll $paramRegex $paramReplace) }} | ||
| location ~ /{{ $location }}/?$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
| events { | ||
| worker_connections 10000; | ||
| multi_accept on; | ||
| use epoll; | ||
| } | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
| http { | ||
| include /etc/nginx/mime.types; | ||
| default_type application/octet-stream; | ||
|
|
||
| # Retrieve paths with <all> wildcard, but without global wildcard | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if and (regexMatch $allRegex $location) (not (regexMatch $globalAllRegex $location)) }} | ||
| {{ $location := ($location | regexReplaceAll $allRegex $allReplace) }} | ||
| location ~ /{{ $location }}/?$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | ||
| '$status $body_bytes_sent "$http_referer" ' | ||
| '"$http_user_agent" "$http_x_forwarded_for"'; | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
| access_log /var/log/nginx/access.log main; | ||
|
|
||
| # Retrieve global <all> wildcard (if existent) | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if regexMatch $globalAllRegex $location }} | ||
| location ~ / { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
| sendfile on; | ||
| tcp_nopush on; | ||
| tcp_nodelay on; | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| keepalive_timeout 65; | ||
|
|
||
| location ~ /.+$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
| #gzip on; | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
| include /etc/nginx/conf.d/*.conf; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| {{ $loaded_services := services }} | ||
| {{ $resources := tree (env "RESOURCES_PATH") }} | ||
|
|
||
| {{ range $loaded_services }} | ||
| {{- if in .Tags (env "SERVICE_TAG") -}} | ||
| {{- $current_service := service .Name "any" -}} | ||
| {{- if not (eq (len $current_service) 0) }} | ||
| upstream {{ .Name }} { | ||
| least_conn; | ||
| {{ range $current_service }}server {{ .Address }}:{{ .Port }}; | ||
| {{ end }} | ||
| } | ||
| {{ end -}} | ||
| {{- end -}} | ||
| {{ end }} | ||
|
|
||
| log_format upstream_time '$remote_addr - $remote_user [$time_local] ' | ||
| '"$request" $status $body_bytes_sent ' | ||
| '"$http_referer" "$http_user_agent" ' | ||
| '$request_time $upstream_connect_time ' | ||
| '$upstream_header_time $upstream_response_time ' | ||
| '$pipe'; | ||
|
|
||
| server { | ||
| listen 80; | ||
| gzip on; | ||
| gzip_min_length 1000; | ||
| gzip_types application/json text/plain; | ||
| access_log {{ env "NGINX_LOG_DIR" }}/access.log upstream_time; | ||
| error_log {{ env "NGINX_LOG_DIR" }}/error.log; | ||
| server_name {{ env "VIRTUAL_HOST" }}; | ||
| client_max_body_size {{ env "CLIENT_MAX_BODY_SIZE" }}; | ||
| proxy_connect_timeout {{ env "PROXY_CONNECT_TIMEOUT" }}; | ||
| proxy_send_timeout {{ env "PROXY_SEND_TIMEOUT" }}; | ||
| proxy_read_timeout {{ env "PROXY_READ_TIMEOUT" }}; | ||
| send_timeout {{ env "SEND_TIMEOUT" }}; | ||
|
|
||
| {{ $paramRegex := "{[\\w-]+}" }} | ||
| {{ $allRegex := "<[\\w-]+>" }} | ||
| {{ $globalAllRegex := "^<[\\w-]+>$" }} | ||
|
|
||
| {{ $paramReplace := "[\\w-]+" }} | ||
| {{ $allReplace := ".+" }} | ||
|
|
||
| # First retrieve paths without parameters | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if not (or (regexMatch $paramRegex $location) (regexMatch $allRegex $location)) }} | ||
| location ~ /{{ $location }}/?$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
|
|
||
| # Retrieve paths with {param} wildcard | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if regexMatch $paramRegex $location }} | ||
| {{ $location := ($location | regexReplaceAll $paramRegex $paramReplace) }} | ||
| location ~ /{{ $location }}/?$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
|
|
||
| # Retrieve paths with <all> wildcard, but without global wildcard | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if and (regexMatch $allRegex $location) (not (regexMatch $globalAllRegex $location)) }} | ||
| {{ $location := ($location | regexReplaceAll $allRegex $allReplace) }} | ||
| location ~ /{{ $location }}/?$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
|
|
||
| # Retrieve global <all> wildcard (if existent) | ||
| {{ range $resources }} {{ $location := .Key }} {{ $upstream := .Value }} | ||
| {{- if regexMatch $globalAllRegex $location }} | ||
| location ~ / { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
|
|
||
| location ~ /.+$ { | ||
| {{- if eq (env "REQUIRE_SSL") "true" }} | ||
| if ($http_x_forwarded_proto != "https") { | ||
| return 307 https://$host$request_uri; | ||
| } | ||
| {{ end }} | ||
|
|
||
| proxy_pass http://{{ $upstream }}; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_http_version 1.1; | ||
| } | ||
| {{ end -}} | ||
| {{ end }} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters