nginx-auto.conf.template

# Auto-generated by start_esp
# Copyright (C) Extensible Service Proxy Authors
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.


daemon off;

user nginx nginx;

pid ${pid_file};

# Worker/connection processing limits
worker_processes ${worker_processes};
worker_rlimit_nofile 10240;
events { worker_connections 10240; }

% if enable_debug:
error_log /var/log/nginx/error.log debug;
# enable core dump
worker_rlimit_core 512m;
working_directory /tmp;
% endif

# Logging to stderr enables better integration with Docker and GKE/Kubernetes.
error_log stderr warn;

http {
  include /etc/nginx/mime.types;
  include /etc/nginx/conf/*.conf;
  server_tokens off;
  client_max_body_size ${client_max_body_size};
  client_body_buffer_size ${client_body_buffer_size};
% if client_body_timeout:
  client_body_timeout ${client_body_timeout};
% endif
% if large_client_header_buffers:
  large_client_header_buffers ${large_client_header_buffers};
% endif
% if keepalive_timeout:
  keepalive_timeout ${keepalive_timeout};
% endif

  # HTTP subrequests
  endpoints_resolver ${resolver};
  endpoints_certificates /etc/nginx/trusted-ca-certificates.crt;

% if not enable_backend_routing:
% for i, location in enumerate(ingress.locations):
% if location.proto != 'grpc':
  upstream app_server${i} {
  % for backend in location.backends:
    server ${backend};
  % endfor
    keepalive 128;
  }
% endif
% endfor
% endif

% for trusted_proxy in xff_trusted_proxies:
  set_real_ip_from  ${trusted_proxy};
% endfor
  real_ip_header    X-Forwarded-For;
  real_ip_recursive on;

% if enable_websocket:
  map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
  }
% endif

  server {
    server_name ${ingress.host};
    resolver ${resolver};

% if ssl_protocols:
  <%
    ssl_protocol_list = ""
  %>
  % for idx, val in enumerate(ssl_protocols):
    <%
      ssl_protocol_list += val
    %>
    % if idx < len(ssl_protocols)-1:
      <%
        ssl_protocol_list += " "
      %>
    % endif
  % endfor
    ssl_protocols ${ssl_protocol_list};
% endif

% for port in ingress.ports:
  % if port.proto == 'http':
    listen ${port.port} backlog=16384;
  % elif port.proto == 'http2':
    listen ${port.port} http2 backlog=16384;
  % elif port.proto == 'ssl':
    listen ${port.port} ssl http2 backlog=16384;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
  % endif
% endfor

    access_log ${access_log};

% if healthz:
    location = /${healthz} {
      return 200;
      access_log off;
    }
% endif

% if underscores_in_headers:
    underscores_in_headers on;
% endif

% if allow_invalid_headers:
    ignore_invalid_headers off;
% endif

% for i, location in enumerate(ingress.locations):
    location ${location.path} {
      # Begin Endpoints v2 Support
      endpoints {
        on;
        server_config ${server_config_path};
% if service_account:
        google_authentication_secret ${service_account};
% endif
% if google_cloud_platform:
        metadata_server ${metadata};
% endif
      }
      # End Endpoints v2 Support

% if enable_websocket:
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
% endif

% if cors_preset:
    set $cors "unset";
    # Begin CORS settings
  % if cors_preset == 'basic':
    set $cors "true";
    set $allow_origin "${cors_allow_origin}";
  % elif cors_preset == 'cors_with_regex':
    if ($http_origin ~* (${cors_allow_origin_regex})) {
        set $cors "true";
        set $allow_origin $http_origin;
    }
  % endif

    if ($request_method = 'OPTIONS') {
        set $cors "${'$'}{cors}options";
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Access-Control-Allow-Origin' "$allow_origin";
        add_header 'Access-Control-Allow-Methods' '${cors_allow_methods}';
        add_header 'Access-Control-Allow-Headers' '${cors_allow_headers}';
      % if cors_allow_credentials:
        add_header 'Access-Control-Allow-Credentials' 'true';
      % endif
        add_header 'Content-Type' 'text/plain; charset=utf-8';
        add_header 'Content-Length' 0;

      % if enable_strict_transport_security:
        # According to http://nginx.org/en/docs/http/ngx_http_headers_module.html:
        # "There could be several add_header directives. These directives are inherited from the previous
        # level if and only if there are no add_header directives defined on the current level."
        # According to https://github.com/cloudendpoints/esp/issues/473: "nginx considers the if as an indentation level
        # and, once finds an add_header directive inside, ignores all add_header directives in inferior levels."
        # If you add new add_header directives, these new directives must be added to other levels with add_header
        # directives to avoid the new directives being ignored.
        # Enable HSTS (HTTP Strict Transport Security), 31536000 is 1 year.
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;" always;
      % endif

        return 204;
    }

    if ($cors = "true") {
        add_header 'Access-Control-Allow-Origin' "$allow_origin" always;
        add_header 'Access-Control-Allow-Methods' '${cors_allow_methods}' always;
        add_header 'Access-Control-Allow-Headers' '${cors_allow_headers}' always;
        add_header 'Access-Control-Expose-Headers' '${cors_expose_headers}' always;
      % if cors_allow_credentials:
        add_header 'Access-Control-Allow-Credentials' 'true' always;
      % endif

      % if enable_strict_transport_security:
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;" always;
      % endif
    }
    if ($cors = "unset") {
      % if enable_strict_transport_security:
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;" always;
      % endif
    }
    # End CORS settings
% else:
  % if enable_strict_transport_security:
      add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;" always;
  % endif
% endif


% if location.proto == 'grpc':
      # WARNING: only first backend is used
      grpc_pass ${location.backends[0]} override;
% else:
  % if enable_backend_routing:
      proxy_pass $backend_url;
  % elif location.proto == 'http':
      proxy_pass http://app_server${i};
  % elif location.proto == 'https':
      proxy_pass https://app_server${i};
      % if tls_mutual_auth:
          proxy_ssl_certificate /etc/nginx/ssl/backend.crt;
          proxy_ssl_certificate_key /etc/nginx/ssl/backend.key;
      % endif
  % endif
      proxy_redirect off;
  % if experimental_proxy_backend_host_header:
      proxy_set_header Host ${experimental_proxy_backend_host_header};
  % elif not enable_backend_routing:
      proxy_set_header Host $host;
  % endif
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Host $server_name;
      proxy_set_header X-Google-Real-IP $remote_addr;

      # Enable the upstream persistent connection
      proxy_http_version 1.1;
      proxy_set_header Connection "";

      # 86400 seconds (24 hours) is the maximum a server is allowed.
      proxy_send_timeout 86400s;
      proxy_read_timeout 86400s;
% endif
    }
% endfor

    include /var/lib/nginx/extra/*.conf;
  }

  server {
    # expose /nginx_status and /endpoints_status but on a different port to
    # avoid external visibility / conflicts with the app.
    listen ${status};
    location /nginx_status {
      stub_status on;
      access_log off;
    }
    location /endpoints_status {
      endpoints_status;
      access_log off;
    }
    location /healthz {
      return 200;
      access_log off;
    }
    location / {
      root /dev/null;
    }
  }
}