ci: optimize nginx

.github/workflows/docker_build_image.yml

@@ -134,17 +134,18 @@ jobs:
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
           echo "build=${BUILD}" >> $GITHUB_OUTPUT
           echo "dockerfilelocation=${DOCKER_FILE_LOCATION}" >> $GITHUB_OUTPUT
-
-          # wait for all images in DEFAULT_ALL to be built before building the all-in-one image as it depends on all other images
-          if [[ "docker-jans-all-in-one" =~ "${{ matrix.docker-images }}" ]]; then
-            TEMP_IMG="auth-server certmanager config-api configurator fido2 persistence-loader scim monolith loadtesting-jmeter link casa saml keycloak-link"
-            for i in $TEMP_IMG; do
-              TEMP_TOKEN=$(curl https://ghcr.io/token\?scope\="repository:janssenproject/jans/$i:pull" | jq -r '.token')
-              while [[ $(curl -s -H "Authorization: Bearer ${TEMP_TOKEN}" https://ghcr.io/v2/janssenproject/jans/$i/tags/list | jq -r '.tags' | grep "$VERSION" | tr -d '[:space:]"') != "$VERSION" ]]; do
-                echo "Waiting for $i to be built"
-                sleep 30
+          if [[ ! $VERSION =~ "_dev" ]]; then
+            # wait for all images in DEFAULT_ALL to be built before building the all-in-one image as it depends on all other images
+            if [[ "docker-jans-all-in-one" =~ "${{ matrix.docker-images }}" ]]; then
+              TEMP_IMG="auth-server certmanager config-api configurator fido2 persistence-loader scim monolith loadtesting-jmeter link casa saml keycloak-link"
+              for i in $TEMP_IMG; do
+                TEMP_TOKEN=$(curl https://ghcr.io/token\?scope\="repository:janssenproject/jans/$i:pull" | jq -r '.token')
+                while [[ $(curl -s -H "Authorization: Bearer ${TEMP_TOKEN}" https://ghcr.io/v2/janssenproject/jans/$i/tags/list | jq -r '.tags' | grep "$VERSION" | tr -d '[:space:]"') != "$VERSION" ]]; do
+                  echo "Waiting for $i to be built"
+                  sleep 30
+                done
               done
-            done
+            fi
           fi
 
       # UPDATE BUILD DATES INSIDE THE DOCKERFILE BEFORE BUILDING THE DEV IMAGES TRIGGERED BY JENKINS

docker-jans-all-in-one/app/templates/nginx/jans-auth-location.conf

@@ -13,7 +13,11 @@ location /.well-known/openid-configuration {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;
@@ -34,7 +38,11 @@ location /.well-known/webfinger {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;
@@ -55,7 +63,11 @@ location /.well-known/uma2-configuration {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;
@@ -76,7 +88,11 @@ location /firebase-messaging-sw.js {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;
@@ -97,7 +113,11 @@ location /device-code {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;
@@ -118,7 +138,11 @@ location /jans-auth {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;

docker-jans-all-in-one/app/templates/nginx/jans-auth-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_auth_backend {
     server 127.0.0.1:8081;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/jans-casa-location.conf

@@ -13,7 +13,11 @@ location /jans-casa {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;

docker-jans-all-in-one/app/templates/nginx/jans-casa-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_casa_backend {
     server 127.0.0.1:8082;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/jans-config-api-location.conf

@@ -13,7 +13,11 @@ location /jans-config-api {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;

docker-jans-all-in-one/app/templates/nginx/jans-config-api-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_config_api_backend {
     server 127.0.0.1:8074;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/jans-fido2-location.conf

@@ -13,7 +13,11 @@ location /.well-known/fido2-configuration {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;
@@ -34,7 +38,11 @@ location /jans-fido2 {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;

docker-jans-all-in-one/app/templates/nginx/jans-fido2-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_fido2_backend {
     server 127.0.0.1:8073;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/jans-keycloak-link-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_keycloak_link_backend {
     server 127.0.0.1:9092;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/jans-link-location.conf

@@ -13,7 +13,10 @@ location /jans-link {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;

docker-jans-all-in-one/app/templates/nginx/jans-link-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_link_backend {
     server 127.0.0.1:9091;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/jans-saml-location.conf

@@ -13,7 +13,10 @@ location /kc {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;

docker-jans-all-in-one/app/templates/nginx/jans-saml-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_saml_backend {
     server 127.0.0.1:8083;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/jans-scim-location.conf

@@ -13,7 +13,11 @@ location /.well-known/scim-configuration {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;
@@ -34,7 +38,11 @@ location /jans-scim {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $connection_upgrade;
     proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
-    proxy_connect_timeout 5s;
+    proxy_connect_timeout 300s;
+    proxy_send_timeout 300;
+    proxy_read_timeout 300;
+    send_timeout 300;
+
     proxy_redirect off;
     port_in_redirect off;
     proxy_http_version 1.1;

docker-jans-all-in-one/app/templates/nginx/jans-scim-upstream.conf

@@ -1,4 +1,3 @@
 upstream jans_scim_backend {
     server 127.0.0.1:8087;
-    keepalive 2;
 }

docker-jans-all-in-one/app/templates/nginx/nginx-default.conf

@@ -5,9 +5,13 @@ geo $literal_dollar {
 
 %(upstream_includes)s
 
+client_header_timeout 300;
+client_body_timeout 300;
+
 server {
     listen 8080 default_server;
     server_name _;
+    gzip on;
 
     root /var/lib/nginx/html;
     index index.html;

docker-jans-auth-server/templates/jans-mysql.properties

@@ -20,12 +20,15 @@ auth.userPassword=%(rdbm_password_enc)s
 password.encryption.method=SSHA-256
 
 # Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
+connection.pool.max-total=400
+connection.pool.max-idle=150
+connection.pool.min-idle=50
+connection.driver-property.autoReconnect=true
+connection.driver-property.autoReconnectForPools=true
+connection.driver-property.maxReconnects=10
 
 # Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
+connection.pool.create-max-wait-time-millis=60000
 
 # Max wait 20 seconds
 connection.pool.max-wait-time-millis=20000

docker-jans-auth-server/templates/jans-pgsql.properties

@@ -12,12 +12,15 @@ auth.userPassword=%(rdbm_password_enc)s
 password.encryption.method=SSHA-256
 
 # Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
+connection.pool.max-total=400
+connection.pool.max-idle=150
+connection.pool.min-idle=50
+connection.driver-property.autoReconnect=true
+connection.driver-property.autoReconnectForPools=true
+connection.driver-property.maxReconnects=10
 
 # Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
+connection.pool.create-max-wait-time-millis=60000
 
 # Max wait 20 seconds
 connection.pool.max-wait-time-millis=20000

docker-jans-auth-server/templates/jans-spanner.properties

@@ -18,7 +18,7 @@ password.encryption.method=SSHA-256
 #connection.pool.inc-step=25
 
 # Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
+connection.pool.create-max-wait-time-millis=60000
 
 # Maximum allowed statement result set size
 statement.limit.default-maximum-result-size=1000

docker-jans-casa/templates/jans-mysql.properties

@@ -20,12 +20,15 @@ auth.userPassword=%(rdbm_password_enc)s
 password.encryption.method=SSHA-256
 
 # Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
+connection.pool.max-total=400
+connection.pool.max-idle=150
+connection.pool.min-idle=50
+connection.driver-property.autoReconnect=true
+connection.driver-property.autoReconnectForPools=true
+connection.driver-property.maxReconnects=10
 
 # Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
+connection.pool.create-max-wait-time-millis=60000
 
 # Max wait 20 seconds
 connection.pool.max-wait-time-millis=20000

docker-jans-casa/templates/jans-pgsql.properties

@@ -12,12 +12,15 @@ auth.userPassword=%(rdbm_password_enc)s
 password.encryption.method=SSHA-256
 
 # Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
+connection.pool.max-total=400
+connection.pool.max-idle=150
+connection.pool.min-idle=50
+connection.driver-property.autoReconnect=true
+connection.driver-property.autoReconnectForPools=true
+connection.driver-property.maxReconnects=10
 
 # Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
+connection.pool.create-max-wait-time-millis=60000
 
 # Max wait 20 seconds
 connection.pool.max-wait-time-millis=20000

docker-jans-casa/templates/jans-spanner.properties

@@ -18,7 +18,7 @@ password.encryption.method=SSHA-256
 #connection.pool.inc-step=25
 
 # Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
+connection.pool.create-max-wait-time-millis=60000
 
 # Maximum allowed statement result set size
 statement.limit.default-maximum-result-size=1000

docker-jans-config-api/templates/jans-mysql.properties

@@ -20,12 +20,15 @@ auth.userPassword=%(rdbm_password_enc)s
 password.encryption.method=SSHA-256
 
 # Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
+connection.pool.max-total=400
+connection.pool.max-idle=150
+connection.pool.min-idle=50
+connection.driver-property.autoReconnect=true
+connection.driver-property.autoReconnectForPools=true
+connection.driver-property.maxReconnects=10
 
 # Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
+connection.pool.create-max-wait-time-millis=60000
 
 # Max wait 20 seconds
 connection.pool.max-wait-time-millis=20000