Skip to content

NGINX Configuration Improvements using genAI

Jump to bottom
K. C. Ramakrishna edited this page Nov 8, 2024 · 2 revisions

Introduction

While we have been using ngnix for ages, we never really found 'well engineered' ngnix configuration. We did read the manuals and did the best we could but we knew that we needed to improve even further to general best practices. Before genAI, we read a lot of articles on the web and implemented the recommendations but always had nagging doubts if we really did the best. "How qualified were the authors of those articles? ... What if they missed something important? ....". We could never confidently assess if our configuration was adequate or not. genAI helped us spot gaps in our configuration and also guided us in getting to a fairly robust ngnix configuration file.

Original Configuration (Anonymized)

server {
    listen 80;
    server_name *.xxx.ai xxx.ai;
    return  301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    ssl_certificate /etc/nginx/certs/fullchain12.pem;
    ssl_certificate_key /etc/nginx/certs/privkey12.pem;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    add_header X-Frame-Options DENY always;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/lets-encrypt-r3.pem;

    server_name sdk.xxx.ai;

    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';

    root   /usr/share/nginx/html/prodsdk/;
    index  index.html index.htm;

    location ~ \.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf|woff)$ {
        expires 86400;
        add_header Cache-Control "max-age=86400, public, immutable";
        access_log off;
    }
}

# Additional server blocks for keycloak and authentication services...

New Configuration (Anonymized)

server {
    listen 80;
    server_name *.xxx.ai xxx.ai;
    return  301 https://$server_name$request_uri;
}

server {
    listen 80;
    server_name *.xxx.com xxx.com;
    return  301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    ssl_certificate /etc/nginx/certs/xxx.ai/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/xxx.ai/privkey.pem;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    add_header X-Frame-Options DENY always;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/lets-encrypt-r3.pem;

    server_name sdk.xxx.ai;

    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';

    root   /usr/share/nginx/html/prodsdk/;
    index  index.html index.htm;

    location ~ \.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf|woff)$ {
        expires 86400;
        add_header Cache-Control "max-age=86400, public, immutable";
        access_log off;
    }
}

# Additional server blocks for IAM and other services with domain-specific certificates...

Key Changes

1. Domain and Certificate Management

Previous Configuration:

  • Single domain (*.xxx.ai) with unified SSL certificate paths
  • Certificates located at /etc/nginx/certs/fullchain12.pem

New Configuration:

  • Multi-domain support (*.xxx.ai and *.xxx.com)
  • Domain-specific certificate paths: 
    ssl_certificate /etc/nginx/certs/xxx.ai/fullchain.pem
ssl_certificate_key /etc/nginx/certs/xxx.ai/privkey.pem

2. Server Block Restructuring

Added Features:

  • HTTP to HTTPS redirect for both domains
  • Separate server blocks for different subdomains
  • Enhanced routing logic for different services

3. Security Enhancements

SSL/TLS Configuration

Maintained across both versions:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

Security Headers

Modifications:

  • Selective implementation of X-Frame-Options
  • Conditional application of X-Content-Type-Options
  • Service-specific CORS headers

4. Proxy Configuration

New Features:

  • Additional proxy settings for IAM service
  • Updated timeout configurations: 
    proxy_connect_timeout 5s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;

5. Static Content Handling

Optimizations:

  • Cached static content handling: 
    location ~ \.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|swf|woff)$ {
    expires 86400;
    add_header Cache-Control "max-age=86400, public, immutable";
    access_log off;
}

Technical Benefits

  1. Enhanced Security

    • Improved SSL/TLS configuration
    • Domain-specific certificate management
    • Granular security header control

  2. Better Domain Management

    • Clear separation between different domains
    • Improved routing logic
    • Domain-specific configurations

  3. Performance Optimization

    • Optimized static content caching
    • Improved proxy configurations
    • Better session management

  4. Maintainability

    • Clearer structure for multi-domain setup
    • Better organized server blocks
    • Improved commenting and documentation

Notable Technical Considerations

  1. SSL Configuration

    • Maintains strong cipher preferences
    • Implements OCSP stapling
    • Uses modern TLS protocols

  2. Proxy Settings

    • Configured for specific services
    • Implements appropriate timeouts
    • Includes necessary headers for proper forwarding

  3. Security Headers

    • Selective implementation based on service requirements
    • CORS configuration tailored to specific needs
    • Strict Transport Security implementation

Conclusion

The new configuration represents a significant improvement in terms of security, maintainability, and multi-domain support. The changes reflect modern best practices while maintaining backward compatibility and enhanced security measures. Given our current skill set and time restrictions, we could never have achieved the above without modern genAI. We will continue to use genAI to improve performance and more importantly security across the full project.

Clone this wiki locally