nginx-plus.tmpl

worker_processes  {{.WorkerProcesses}};
{{- if .WorkerRlimitNofile}}
worker_rlimit_nofile {{.WorkerRlimitNofile}};{{end}}
{{- if .WorkerCPUAffinity}}
worker_cpu_affinity {{.WorkerCPUAffinity}};{{end}}
{{- if .WorkerShutdownTimeout}}
worker_shutdown_timeout {{.WorkerShutdownTimeout}};{{end}}

daemon off;

error_log  stderr {{.ErrorLogLevel}};
pid        /var/lib/nginx/nginx.pid;

{{- if .OpenTracingLoadModule}}
load_module modules/ngx_http_opentracing_module.so;
{{- end}}
{{- if .AppProtectLoadModule}}
load_module modules/ngx_http_app_protect_module.so;
{{- end}}
{{- if .AppProtectDosLoadModule}}
load_module modules/ngx_http_app_protect_dos_module.so;
{{- end}}
load_module modules/ngx_fips_check_module.so;
{{- if .MainSnippets}}
{{range $value := .MainSnippets}}
{{$value}}{{end}}
{{- end}}

{{if .OIDC}}
load_module modules/ngx_http_js_module.so;
{{- end}}

events {
    worker_connections  {{.WorkerConnections}};
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    {{- if .HTTPSnippets}}
    {{range $value := .HTTPSnippets}}
    {{$value}}{{end}}
    {{- end}}

    {{if .LogFormat -}}
    log_format  main {{if .LogFormatEscaping}}escape={{ .LogFormatEscaping }} {{end}}
                     {{range $i, $value := .LogFormat -}}
                     {{with $value}}'{{if $i}} {{end}}{{$value}}'
                     {{end}}{{end}};
    {{- else -}}
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    {{- end}}

    map $upstream_trailer_grpc_status $grpc_status {
        default $upstream_trailer_grpc_status;
        '' $sent_http_grpc_status;
    }

    {{- if .AppProtectDosLoadModule}}
    {{- if .AppProtectDosLogFormat}}
    log_format  log_dos {{if .AppProtectDosLogFormatEscaping}}escape={{ .AppProtectDosLogFormatEscaping }} {{end}}
                    {{range $i, $value := .AppProtectDosLogFormat -}}
                    {{with $value}}'{{if $i}} {{end}}{{$value}}'
                    {{end}}{{end}};
    {{- else -}}
    log_format  log_dos ', vs_name_al=$app_protect_dos_vs_name, ip=$remote_addr, tls_fp=$app_protect_dos_tls_fp, '
                        'outcome=$app_protect_dos_outcome, reason=$app_protect_dos_outcome_reason, '
                        'ip_tls=$remote_addr:$app_protect_dos_tls_fp, ';

    {{- end}}
    {{- if .AppProtectDosArbFqdn}}
    app_protect_dos_arb_fqdn {{.AppProtectDosArbFqdn}};
    {{- end}}
    {{- end}}

    {{if .AccessLogOff}}
    access_log off;
    {{else}}
    access_log  /dev/stdout  main;
    {{end}}

    {{if .LatencyMetrics}}
    log_format response_time '{"upstreamAddress":"$upstream_addr", "upstreamResponseTime":"$upstream_response_time", "proxyHost":"$proxy_host", "upstreamStatus": "$upstream_status"}';
    access_log syslog:server=unix:/var/lib/nginx/nginx-syslog.sock,nohostname,tag=nginx response_time;
    {{end}}

    {{- if .AppProtectLoadModule}}
    {{if .AppProtectFailureModeAction}}app_protect_failure_mode_action {{.AppProtectFailureModeAction}};{{end}}
    {{if .AppProtectCompressedRequestsAction}}app_protect_compressed_requests_action {{.AppProtectCompressedRequestsAction}};{{end}}
    {{if .AppProtectCookieSeed}}app_protect_cookie_seed {{.AppProtectCookieSeed}};{{end}}
    {{if .AppProtectCPUThresholds}}app_protect_cpu_thresholds {{.AppProtectCPUThresholds}};{{end}}
    {{if .AppProtectPhysicalMemoryThresholds}}app_protect_physical_memory_util_thresholds {{.AppProtectPhysicalMemoryThresholds}};{{end}}
    {{if .AppProtectReconnectPeriod}}app_protect_reconnect_period_seconds {{.AppProtectReconnectPeriod}};{{end}}
    include /etc/nginx/waf/nac-usersigs/index.conf;
    {{- end}}

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout {{.KeepaliveTimeout}};
    keepalive_requests {{.KeepaliveRequests}};

    #gzip  on;

    server_names_hash_max_size {{.ServerNamesHashMaxSize}};
    {{if .ServerNamesHashBucketSize}}server_names_hash_bucket_size {{.ServerNamesHashBucketSize}};{{end}}

    variables_hash_bucket_size {{.VariablesHashBucketSize}};
    variables_hash_max_size {{.VariablesHashMaxSize}};

    map $request_uri $request_uri_no_args {
        "~^(?P<path>[^?]*)(\?.*)?$" $path;
    }

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }
    map $http_upgrade $vs_connection_header {
        default upgrade;
        ''      $default_connection_header;
    }
    {{if .SSLProtocols}}ssl_protocols {{.SSLProtocols}};{{end}}
    {{if .SSLCiphers}}ssl_ciphers "{{.SSLCiphers}}";{{end}}
    {{if .SSLPreferServerCiphers}}ssl_prefer_server_ciphers on;{{end}}
    {{if .SSLDHParam}}ssl_dhparam {{.SSLDHParam}};{{end}}

    {{if .OpenTracingEnabled}}
    opentracing on;
    {{end}}
    {{if .OpenTracingLoadModule}}
    opentracing_load_tracer {{ .OpenTracingTracer }} /var/lib/nginx/tracer-config.json;
    {{end}}

    {{if .ResolverAddresses}}
    resolver {{range $resolver := .ResolverAddresses}}{{$resolver}}{{end}}{{if .ResolverValid}} valid={{.ResolverValid}}{{end}}{{if not .ResolverIPV6}} ipv6=off{{end}};
    {{if .ResolverTimeout}}resolver_timeout {{.ResolverTimeout}};{{end}}
    {{end}}

    {{if .OIDC}}
    include oidc/oidc_common.conf;
    {{- end}}

    server {
        # required to support the Websocket protocol in VirtualServer/VirtualServerRoutes
        set $default_connection_header "";
        set $resource_type "";
        set $resource_name "";
        set $resource_namespace "";
        set $service "";

        listen 80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};
        {{if not .DisableIPV6}}listen [::]:80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};{{end}}

        {{if .TLSPassthrough}}
        listen unix:/var/lib/nginx/passthrough-https.sock ssl default_server{{if .HTTP2}} http2{{end}} proxy_protocol;
        set_real_ip_from unix:;
        real_ip_header proxy_protocol;
        {{else}}
        listen 443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};
        {{if not .DisableIPV6}}listen [::]:443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};{{end}}
        {{end}}

        {{if .SSLRejectHandshake}}
        ssl_reject_handshake on;
        {{else}}
        ssl_certificate /etc/nginx/secrets/default;
        ssl_certificate_key /etc/nginx/secrets/default;
        {{end}}

        {{range $setRealIPFrom := .SetRealIPFrom}}
        set_real_ip_from {{$setRealIPFrom}};{{end}}
        {{if .RealIPHeader}}real_ip_header {{.RealIPHeader}};{{end}}
        {{if .RealIPRecursive}}real_ip_recursive on;{{end}}

        server_name _;
        server_tokens "{{.ServerTokens}}";
        {{if .DefaultServerAccessLogOff}}
        access_log off;
        {{end}}

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        {{if .HealthStatus}}
        location {{.HealthStatusURI}} {
            default_type text/plain;
            return 200 "healthy\n";
        }
        {{end}}

        location / {
            return {{.DefaultServerReturn}};
        }
    }

    {{- if .NginxStatus}}
    # NGINX Plus APIs
    server {
        listen {{.NginxStatusPort}};
        {{if not .DisableIPV6}}listen [::]:{{.NginxStatusPort}};{{end}}

        root /usr/share/nginx/html;

        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        location  = /dashboard.html {
        }
        {{if .AppProtectDosLoadModule}}
        location = /dashboard-dos.html {
        }
        {{end}}
        {{range $value := .NginxStatusAllowCIDRs}}
        allow {{$value}};{{end}}

        deny all;
        location /api {
            {{if .AppProtectDosLoadModule}}
            app_protect_dos_api on;
            {{end}}
            api write=off;
        }
    }
    {{- end}}

    # NGINX Plus API over unix socket
    server {
        listen unix:/var/lib/nginx/nginx-plus-api.sock;
        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        # $config_version_mismatch is defined in /etc/nginx/config-version.conf
        location /configVersionCheck {
            if ($config_version_mismatch) {
                return 503;
            }
            return 200;
        }

        location /api {
            api write=on;
        }
    }

    include /etc/nginx/config-version.conf;
    include /etc/nginx/conf.d/*.conf;

    server {
        listen unix:/var/lib/nginx/nginx-418-server.sock;
        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        return 418;
    }
    {{if .InternalRouteServer}}
    server {
        listen 443 ssl;
        {{if not .DisableIPV6}}listen [::]:443 ssl;{{end}}
        server_name {{.InternalRouteServerName}};
        ssl_certificate /etc/nginx/secrets/spiffe_cert.pem;
        ssl_certificate_key /etc/nginx/secrets/spiffe_key.pem;
        ssl_client_certificate /etc/nginx/secrets/spiffe_rootca.pem;
        ssl_verify_client on;
        ssl_verify_depth 25;
    }
    {{end}}
}

stream {
    {{if .StreamLogFormat -}}
    log_format  stream-main {{if .StreamLogFormatEscaping}}escape={{ .StreamLogFormatEscaping }} {{end}}
                            {{range $i, $value := .StreamLogFormat -}}
                            {{with $value}}'{{if $i}} {{end}}{{$value}}'
                            {{end}}{{end}};
    {{- else -}}
    log_format  stream-main  '$remote_addr [$time_local] '
                      '$protocol $status $bytes_sent $bytes_received '
                      '$session_time "$ssl_preread_server_name"';
    {{- end}}

    access_log  /dev/stdout  stream-main;

    {{range $value := .StreamSnippets}}
    {{$value}}{{end}}

    {{if .ResolverAddresses}}
    resolver {{range $resolver := .ResolverAddresses}}{{$resolver}}{{end}}{{if .ResolverValid}} valid={{.ResolverValid}}{{end}}{{if not .ResolverIPV6}} ipv6=off{{end}};
    {{if .ResolverTimeout}}resolver_timeout {{.ResolverTimeout}};{{end}}
    {{end}}

    map_hash_max_size {{.MapHashMaxSize}};
    {{if .MapHashBucketSize}}map_hash_bucket_size {{.MapHashBucketSize}};{{end}}

    {{if .TLSPassthrough}}
    map $ssl_preread_server_name $dest_internal_passthrough  {
        default unix:/var/lib/nginx/passthrough-https.sock;
        include /etc/nginx/tls-passthrough-hosts.conf;
    }

    server {
        listen 443{{if .ProxyProtocol}} proxy_protocol{{end}};
        {{if not .DisableIPV6}}listen [::]:443{{if .ProxyProtocol}} proxy_protocol{{end}};{{end}}

        {{if .ProxyProtocol}}
        {{range $setRealIPFrom := .SetRealIPFrom}}
        set_real_ip_from {{$setRealIPFrom}};{{end}}
        {{end}}

        ssl_preread on;

        proxy_protocol on;
        proxy_pass $dest_internal_passthrough;
    }
    {{end}}

    include /etc/nginx/stream-conf.d/*.conf;
}