diff --git a/labs/lab5/docker-compose.yml b/labs/lab5/docker-compose.yml new file mode 100644 index 0000000..19472b6 --- /dev/null +++ b/labs/lab5/docker-compose.yml @@ -0,0 +1,187 @@ +# NGINX Plus / OSS with NGINX Agent +# NGINX webservers with ingress-demo pages +# NGINX One Console Instance Registration +# NGINX Basics, Dec 2024 +# Chris Akker, Shouvik Dutta, Adam Currier +# +services: + plus1: # Alpine NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey From One Console + NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + hostname: $NAME-plus1 + container_name: $NAME-plus1 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r32-alpine-3.20-20240613 # CVE - From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - 80:80 # Open for HTTP + - 443:443 # Open for HTTPS + - 9000:9000 # Open for stub status page + - 9113:9113 # Open for Prometheus Scraper page + restart: always + # + plus2: # Alpine NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + hostname: $NAME-plus2 + container_name: $NAME-plus2 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-alpine-3.19-20240522 # CVE - From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for API / Dashboard page + - '9113' # Open for Prometheus Scraper page + restart: always + # + plus3: # RHEL UBI NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + hostname: $NAME-plus3 + container_name: $NAME-plus3 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-ubi-9-20240522 # From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for API / Dashboard page + - '9113' # Open for Prometheus Scraper page + restart: always + # +# plus4: # Debian R33 NGINX Plus Web / Load Balancer +# environment: +# NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' +# NGINX_AGENT_SERVER_GRPCPORT: '443' +# NGINX_AGENT_TLS_ENABLE: 'true' +# NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console +# NGINX_LICENSE_JWT: $JWT +# NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group +# hostname: $NAME-plus4 +# container_name: $NAME-plus4 +# image: private-registry.nginx.com/nginx-plus/agent:debian # From Nginx Private Registry R33 +# volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html +# ports: +# - '80' # Open for HTTP +# - '443' # Open for HTTPS +# - '9000' # Open for API / Dashboard page +# - '9113' # Open for Prometheus Scraper page +# restart: always + # + oss1: # Debian NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: $NAME-oss1 + container_name: $NAME-oss1 + image: docker-registry.nginx.com/nginx/agent:mainline # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for stub status page + - '9113' # Open for Prometheus Scraper page + restart: always + # + oss2: # Alpine NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: $NAME-oss2 + container_name: $NAME-oss2 + image: docker-registry.nginx.com/nginx/agent:alpine # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for stub status page + - '9113' # Open for Prometheus Scraper page + restart: always + # + oss3: # Older Alpine NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: $NAME-oss3 + container_name: $NAME-oss3 + image: docker-registry.nginx.com/nginx/agent:1.26-alpine # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for stub status page + - '9113' # Open for Prometheus Scraper page + restart: always + # + web1: + hostname: $NAME-web1 + container_name: $NAME-web1 + platform: linux/amd64 + image: nginxinc/ingress-demo # Image from Docker Hub + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + web2: + hostname: $NAME-web2 + container_name: $NAME-web2 + platform: linux/amd64 + image: nginxinc/ingress-demo + ports: + - '80' + - '433' + web3: + hostname: $NAME-web3 + container_name: $NAME-web3 + platform: linux/amd64 + image: nginxinc/ingress-demo + ports: + - '80' + - '443' + diff --git a/labs/lab5/media/docker-icon.png b/labs/lab5/media/docker-icon.png new file mode 100644 index 0000000..02ee3f1 Binary files /dev/null and b/labs/lab5/media/docker-icon.png differ diff --git a/labs/lab5/media/lab5-add-instance-1.png b/labs/lab5/media/lab5-add-instance-1.png new file mode 100644 index 0000000..781a088 Binary files /dev/null and b/labs/lab5/media/lab5-add-instance-1.png differ diff --git a/labs/lab5/media/lab5-add-instance-2.png b/labs/lab5/media/lab5-add-instance-2.png new file mode 100644 index 0000000..cfe5d02 Binary files /dev/null and b/labs/lab5/media/lab5-add-instance-2.png differ diff --git a/labs/lab5/media/lab5-add-license-1.png b/labs/lab5/media/lab5-add-license-1.png new file mode 100644 index 0000000..f6a8d9e Binary files /dev/null and b/labs/lab5/media/lab5-add-license-1.png differ diff --git a/labs/lab5/media/lab5-add-license-2.png b/labs/lab5/media/lab5-add-license-2.png new file mode 100644 index 0000000..31eb2c8 Binary files /dev/null and b/labs/lab5/media/lab5-add-license-2.png differ diff --git a/labs/lab5/media/lab5-add-license-3.png b/labs/lab5/media/lab5-add-license-3.png new file mode 100644 index 0000000..81318e7 Binary files /dev/null and b/labs/lab5/media/lab5-add-license-3.png differ diff --git a/labs/lab5/media/lab5-config-sync-group1.png b/labs/lab5/media/lab5-config-sync-group1.png new file mode 100644 index 0000000..91ec39c Binary files /dev/null and b/labs/lab5/media/lab5-config-sync-group1.png differ diff --git a/labs/lab5/media/lab5-config-sync-group2.png b/labs/lab5/media/lab5-config-sync-group2.png new file mode 100644 index 0000000..5231ef3 Binary files /dev/null and b/labs/lab5/media/lab5-config-sync-group2.png differ diff --git a/labs/lab5/media/lab5-csg-1.png b/labs/lab5/media/lab5-csg-1.png new file mode 100644 index 0000000..20f6882 Binary files /dev/null and b/labs/lab5/media/lab5-csg-1.png differ diff --git a/labs/lab5/media/lab5-one-lic-confirm.png b/labs/lab5/media/lab5-one-lic-confirm.png new file mode 100644 index 0000000..02abb41 Binary files /dev/null and b/labs/lab5/media/lab5-one-lic-confirm.png differ diff --git a/labs/lab5/media/lab5-plus-api-1.png b/labs/lab5/media/lab5-plus-api-1.png new file mode 100644 index 0000000..42ed69f Binary files /dev/null and b/labs/lab5/media/lab5-plus-api-1.png differ diff --git a/labs/lab5/media/lab5-plus-api-2.png b/labs/lab5/media/lab5-plus-api-2.png new file mode 100644 index 0000000..f260b6f Binary files /dev/null and b/labs/lab5/media/lab5-plus-api-2.png differ diff --git a/labs/lab5/media/lab5-upgrade-confirmed.png b/labs/lab5/media/lab5-upgrade-confirmed.png new file mode 100644 index 0000000..2e66bb9 Binary files /dev/null and b/labs/lab5/media/lab5-upgrade-confirmed.png differ diff --git a/labs/lab5/media/nginx-nim-icon.png b/labs/lab5/media/nginx-nim-icon.png new file mode 100644 index 0000000..21a9bc5 Binary files /dev/null and b/labs/lab5/media/nginx-nim-icon.png differ diff --git a/labs/lab5/media/nginx-one-icon.png b/labs/lab5/media/nginx-one-icon.png new file mode 100644 index 0000000..acca29f Binary files /dev/null and b/labs/lab5/media/nginx-one-icon.png differ diff --git a/labs/lab5/media/nginx-plus-icon.png b/labs/lab5/media/nginx-plus-icon.png new file mode 100644 index 0000000..23eb5e5 Binary files /dev/null and b/labs/lab5/media/nginx-plus-icon.png differ diff --git a/labs/lab5/media/r33-delete-old-instances-1.png b/labs/lab5/media/r33-delete-old-instances-1.png new file mode 100644 index 0000000..a4a33ae Binary files /dev/null and b/labs/lab5/media/r33-delete-old-instances-1.png differ diff --git a/labs/lab5/media/r33-delete-old-instances-2.png b/labs/lab5/media/r33-delete-old-instances-2.png new file mode 100644 index 0000000..317599a Binary files /dev/null and b/labs/lab5/media/r33-delete-old-instances-2.png differ diff --git a/labs/lab5/media/r33-delete-old-instances-3.png b/labs/lab5/media/r33-delete-old-instances-3.png new file mode 100644 index 0000000..5cc1a4d Binary files /dev/null and b/labs/lab5/media/r33-delete-old-instances-3.png differ diff --git a/labs/lab5/media/r33-instance-settings-1.png b/labs/lab5/media/r33-instance-settings-1.png new file mode 100644 index 0000000..9e93fba Binary files /dev/null and b/labs/lab5/media/r33-instance-settings-1.png differ diff --git a/labs/lab5/media/r33-instance-settings-2.png b/labs/lab5/media/r33-instance-settings-2.png new file mode 100644 index 0000000..547804a Binary files /dev/null and b/labs/lab5/media/r33-instance-settings-2.png differ diff --git a/labs/lab5/media/r33-plus4-deployed.png b/labs/lab5/media/r33-plus4-deployed.png new file mode 100644 index 0000000..3b40599 Binary files /dev/null and b/labs/lab5/media/r33-plus4-deployed.png differ diff --git a/labs/lab5/media/r33-plus4-with-agent.png b/labs/lab5/media/r33-plus4-with-agent.png new file mode 100644 index 0000000..eaa7d7a Binary files /dev/null and b/labs/lab5/media/r33-plus4-with-agent.png differ diff --git a/labs/lab5/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf b/labs/lab5/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf new file mode 100644 index 0000000..3af7071 --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf @@ -0,0 +1,27 @@ +# cafe.example.com HTTP +server { + # Listening on port 80 on all IP addresses on this machine + listen 80; + + server_name cafe.example.com; + + # status_zone cafe-VirtualServer; + + # Server specific logging + access_log /var/log/nginx/cafe.example.com.log main_ext; + error_log /var/log/nginx/cafe.example.com_error.log info; + + location / { + + proxy_buffering off; + + # Including best-practice headers are bonus points + include includes/proxy_headers.conf; + include includes/keepalive.conf; + + # status_zone /; + + proxy_pass http://nginx_cafe; + } + +} diff --git a/labs/lab5/nginx-oss/etc/nginx/conf.d/stub_status.conf b/labs/lab5/nginx-oss/etc/nginx/conf.d/stub_status.conf new file mode 100644 index 0000000..8869acd --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/conf.d/stub_status.conf @@ -0,0 +1,19 @@ +# ngx_http_stub_status_module (Available in NGINX OSS) +# provides Basic Status information http://nginx.org/en/docs/http/ngx_http_stub_status_module.html + +server { + listen 9000 ssl; # Listener for Stub Status + + ssl_certificate /etc/ssl/nginx/30-day.crt; + ssl_certificate_key /etc/ssl/nginx/30-day.key; + + location /basic_status { + stub_status; + } + + # Redirect requests for "/" to "/basic_status" + location / { + return 301 /basic_status; + } + +} \ No newline at end of file diff --git a/labs/lab5/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf b/labs/lab5/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf new file mode 100644 index 0000000..89c78de --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf @@ -0,0 +1,54 @@ +# cars.example.com HTTP/HTTPS +# NGINX Basics Workshop +# Nov 2024, Chris Akker, Shouvik Dutta, Adam Currier +# +server { + + listen 443 ssl; # Uncomment to change to port 443, add "ssl" parameter for terminating TLS on all IP addresses on this machine + + server_name cars.example.com; # Set hostname to match in request + +# Update the following lines for NGINX cert and key directives and file locations + + ssl_certificate /etc/ssl/nginx/cars.crt; + ssl_certificate_key /etc/ssl/nginx/cars.key; + + ssl_protocols TLSv1.1 TLSv1.3; + ssl_ciphers HIGH:!aNULL:3DES; + ssl_prefer_server_ciphers on; + + access_log /var/log/nginx/cars.example.com.log main; + + error_log /var/log/nginx/cars.example.com_error.log info; + + root /usr/share/nginx/html; # Set the root folder for the HTML and JPG files + + location / { + + default_type text/html; + return 200 "Let's go fast, you have reached cars.example.com, path $uri\n"; + } + + location /gtr { + + try_files $uri $uri.html; # Look for filename that matches the URI requested + } + + location /nsx { + + try_files $uri $uri.html; + } + + location /rcf { + + try_files $uri $uri.html; + } + + location /browse { # new URL path + + alias /usr/share/nginx/html; # Browse this folder + index index.html; # Use this file, but if it does *not* exist + autoindex on; # Perform directory/file browsing + } + +} diff --git a/labs/lab5/nginx-oss/etc/nginx/conf.d/upstreams.conf b/labs/lab5/nginx-oss/etc/nginx/conf.d/upstreams.conf new file mode 100644 index 0000000..8570729 --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/conf.d/upstreams.conf @@ -0,0 +1,34 @@ +# NGINX Basics, Plus Proxy to three upstream NGINX containers +# Nov 2024 - Chris Akker, Shouvik Dutta, Adam Currier +# nginx_cafe servers +# +upstream nginx_cafe { # Upstream block, the name is "nginx_cafe" + + # Uncomment the zone directive below to add metrics to the Dashboard + # zone nginx_cafe 256k; + + # Load Balancing Algorithms supported by NGINX + # - Round Robin (Default if nothing specified) + # - Least Connections + # - IP Hash + # - Hash (Any generic Hash) + + # Load Balancing Algorithms supported by NGINX Plus + # - Least Time Last Byte / Header + # - Random Two + + # Uncomment for Least-Time Last-Byte algorithm + # least_time last_byte; + + # From Docker-Compose: + server web1:80; + server web2:80; + server web3:80; + + # Uncomment for Cookie persistence + # sticky cookie srv_id expires=1m domain=.example.com path=/; + + # Uncomment for keepalive TCP connections to upstreams + keepalive 16; + +} \ No newline at end of file diff --git a/labs/lab5/nginx-oss/etc/nginx/includes/keepalive.conf b/labs/lab5/nginx-oss/etc/nginx/includes/keepalive.conf new file mode 100644 index 0000000..a9fbcf4 --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/includes/keepalive.conf @@ -0,0 +1,9 @@ +# Default is HTTP/1, keepalive is only enabled in HTTP/1.1 +proxy_http_version 1.1; + +# Remove the Connection header if the client sends it, +# it could be "close" to close a keepalive connection +proxy_set_header Connection ""; + +# Host request header field, or the server name matching a request +proxy_set_header Host $host; \ No newline at end of file diff --git a/labs/lab5/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf b/labs/lab5/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf new file mode 100644 index 0000000..296ea7b --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf @@ -0,0 +1,20 @@ +# Extended Log Format +# Nginx Basics +log_format main_ext 'remote_addr="$remote_addr", ' + '[time_local=$time_local], ' + 'request="$request", ' + 'status="$status", ' + 'http_referer="$http_referer", ' + 'body_bytes_sent="$body_bytes_sent", ' + 'Host="$host", ' + 'sn="$server_name", ' + 'request_time=$request_time, ' + 'http_user_agent="$http_user_agent", ' + 'http_x_forwarded_for="$http_x_forwarded_for", ' + 'request_length="$request_length", ' + 'upstream_address="$upstream_addr", ' + 'upstream_status="$upstream_status", ' + 'upstream_connect_time="$upstream_connect_time", ' + 'upstream_header_time="$upstream_header_time", ' + 'upstream_response_time="$upstream_response_time", ' + 'upstream_response_length="$upstream_response_length", '; diff --git a/labs/lab5/nginx-oss/etc/nginx/includes/proxy_headers.conf b/labs/lab5/nginx-oss/etc/nginx/includes/proxy_headers.conf new file mode 100644 index 0000000..23a83d1 --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/includes/proxy_headers.conf @@ -0,0 +1,12 @@ +## Set Headers to the proxied servers ## + +# client address in a binary form, value’s length is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses +proxy_set_header X-Real-IP $remote_addr; + +# X-Forwarded-For client request header field with the $remote_addr variable appended to it, +# separated by a comma. If the “X-Forwarded-For” field is not present in the client request header, +# the $proxy_add_x_forwarded_for variable is equal to the $remote_addr variable. +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + +# request scheme, “http” or “https” +proxy_set_header X-Forwarded-Proto $scheme; \ No newline at end of file diff --git a/labs/lab5/nginx-oss/etc/nginx/nginx.conf b/labs/lab5/nginx-oss/etc/nginx/nginx.conf new file mode 100644 index 0000000..a3b502b --- /dev/null +++ b/labs/lab5/nginx-oss/etc/nginx/nginx.conf @@ -0,0 +1,33 @@ +user nginx; +worker_processes 1; + +error_log /var/log/nginx/error.log info; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + include /etc/nginx/includes/log_formats/*.conf; # Custom Access logs formats found here + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; + +} diff --git a/labs/lab5/nginx-oss/etc/ssl/nginx/cars.crt b/labs/lab5/nginx-oss/etc/ssl/nginx/cars.crt new file mode 100644 index 0000000..4eb6334 --- /dev/null +++ b/labs/lab5/nginx-oss/etc/ssl/nginx/cars.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDFTCCAf2gAwIBAgIUEQHIC+pN7UA+PwpufAGW4sFczqowDQYJKoZIhvcNAQEL +BQAwGjEYMBYGA1UEAwwPTmdpbnhQbHVzQmFzaWNzMB4XDTI1MDEwMjIyMDY0OVoX +DTI1MDEwMzIyMDY0OVowGjEYMBYGA1UEAwwPTmdpbnhQbHVzQmFzaWNzMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA17iXl8xC2AApcMaoPEu5w42U++ai +ZPPtgEoDGE/tgNZmWwHsmfdkKbhvcFX8vLwI1OD+mKPW0RcB56x0I29KRk8HGwwX +XXUuALmWuYVYNE71O2cBE/8JpgLlFgkbjYyFZekQeyb9QHeYxI47vCQqptBzQoCx +Bs/zi4lh+wgRYyXmHdTQ60183Gvxs4ujIDWnOC4/PGLr/ZLjySyBDM4+rtoz5xia +HZVBFA8HINTz4vjMkP1zrN4RsgSQQop8vuxlZsLlJCSWDMgkidu/uCvXxo+gHLMs +nrvDloEJuU1zx2va4i0e8Zr/eV/zVRIghKx9g/mBFFPnEdu0x7B48EfTnwIDAQAB +o1MwUTAdBgNVHQ4EFgQUDQzkk+0qMyn/nczCV7vJVlpFLnAwHwYDVR0jBBgwFoAU +DQzkk+0qMyn/nczCV7vJVlpFLnAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B +AQsFAAOCAQEAWXBbXqEckARXPGQtasa5+uVqwokH4TJwbnQLfZsQV766OltS4Bv/ +MFDqmFxFLvsuM2jf1vodtJTq+cuUWtn1o+0MCDFWy3lTifk0wpQyg3xF6boHdBi4 +oGFKn7oPwWaTU8yjJzbvH6A5mfjO57YklAXlmZwWsEylsgR9D9jPTUkX82P+8Ad6 +UjWmFsopTwjit1rBAnBOL/oIGl2IFE5L4Vv8tcFsfpDGpCK/h9D3G25uQY36c0av +Q10lfV2+1eTQz//In+Li8zgGZa+XHtCxFPCEdcFQeEF3VkefgN7aL8qxmPgmSrqd +P13gMgo7HwFPoxvuUD3vN2DKIeqfa/H7Mg== +-----END CERTIFICATE----- diff --git a/labs/lab5/nginx-oss/etc/ssl/nginx/cars.key b/labs/lab5/nginx-oss/etc/ssl/nginx/cars.key new file mode 100644 index 0000000..3777400 --- /dev/null +++ b/labs/lab5/nginx-oss/etc/ssl/nginx/cars.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDXuJeXzELYAClw +xqg8S7nDjZT75qJk8+2ASgMYT+2A1mZbAeyZ92QpuG9wVfy8vAjU4P6Yo9bRFwHn +rHQjb0pGTwcbDBdddS4AuZa5hVg0TvU7ZwET/wmmAuUWCRuNjIVl6RB7Jv1Ad5jE +jju8JCqm0HNCgLEGz/OLiWH7CBFjJeYd1NDrTXzca/Gzi6MgNac4Lj88Yuv9kuPJ +LIEMzj6u2jPnGJodlUEUDwcg1PPi+MyQ/XOs3hGyBJBCiny+7GVmwuUkJJYMyCSJ +27+4K9fGj6Acsyyeu8OWgQm5TXPHa9riLR7xmv95X/NVEiCErH2D+YEUU+cR27TH +sHjwR9OfAgMBAAECggEAGspO8UgpyP+EJgBV5l8VK+cKaJpE8rqkdTk71yod+dEm +lwjPJHPn2ZKRLGdRYvMLObzTgYtfY0ozL11ocvogREkOPdqrkCy8UNS7lkCsKprf +s8fgB2a2AQr8/laVOGgKLRTbuh+mdfokW8y6OGxZa6wZlFm9InZy7ZJbO7zNw/03 +jkAnDAzcAD4T9AgbR0zCVrRxehR6wGR220VWG8kw6gXswBvGvQaVAnwmjlTrh3pp +EhZGC+iZ2el05JfGw6MlM7g6NKBK18KgrGYkhvKiML7BsOJPJD0vMId1jiVsejJR +9xaPoBEaeTOLVWFisBfO5EZtkSZPF7nHwZGHSqZvoQKBgQDttK94ItRS33Uv/HAk +2W+WKGSagSJeqHG9Hi3DEVLPE355QsOxgx/3h5EXnqHRVnu+CXqMHqEhf9afUZsJ +0iMYVShYYELauRhcL8+XSrg+jFXp7Tvokv4XVbkwUyFnY+fM+coQ1rvamd5+1deX +x1x629e/QtOtnaqkuvr9Xn8ArwKBgQDoUsKa3Eq8rx0vzI6KV4F6WncShObiKqkV +0TR79SaNawT0vEhdDOhHuO5BNaiOI3+mbx/CRwnVedIicoi99cDgZrQPncaisnkC +KZVcQpNMoFM8+ZYGyeYDo86sBi05WQRI/vxGKrOIUcaSsdieBLpS3E2btcNGkaLY +pilcnRW4EQKBgQC2rR4QaEvd6GbJ2ulgGE3eCurNpiIAtti56wBmIeEOzL9sdzen +KssdUmzZxwo6s4jjUauBFWTlNrZ8t507XeekooUf7dJS/t5OsluJvF19jCHWZX+d +y6FD05g/IBPSvf99EhYM/MlfRNKtjK9jsE1NCbhy/utoSHvEnwGWR9G4dwKBgQCa +fbZ1frqgYJ67E39SVcB/WbtG8GQM0Cuim30YVTyu3BTunmpMnnG0iDC/4mvVIZwY +VFs9OTo74IexapKuJ8d8Mi/ZFqVpud8oZfix4n/Le+3+ZUaz+vzfPMYJtQ3LzftA +g3fFPU4n/6FaGbQf2KsCwQdG3Yce3Wf6Q/zLXpZ70QKBgEseUKnmYKvFjmyVdO94 +nesTUuu7DITx4M7I3ssdKz/9KdqjmnVQn3yiNEEHEvItvKEZvFMAKB7uJFmY/oGr +5DvP29lsr45FDTz2UWElz/LhsOkSBzRYQpXDkuaCl+lz7YE76S6F45vAy7RSY8TU ++57833tZa5uHl5GKhytuhGyQ +-----END PRIVATE KEY----- diff --git a/labs/lab5/nginx-oss/usr/share/nginx/html/gtr.html b/labs/lab5/nginx-oss/usr/share/nginx/html/gtr.html new file mode 100644 index 0000000..1b1bdfc --- /dev/null +++ b/labs/lab5/nginx-oss/usr/share/nginx/html/gtr.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx GTR ! + + + +

Welcome to nginx GTR !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +GTR + +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-oss/usr/share/nginx/html/gtr.jpg b/labs/lab5/nginx-oss/usr/share/nginx/html/gtr.jpg new file mode 100644 index 0000000..be39ffe Binary files /dev/null and b/labs/lab5/nginx-oss/usr/share/nginx/html/gtr.jpg differ diff --git a/labs/lab5/nginx-oss/usr/share/nginx/html/index.html b/labs/lab5/nginx-oss/usr/share/nginx/html/index.html new file mode 100644 index 0000000..5d2b304 --- /dev/null +++ b/labs/lab5/nginx-oss/usr/share/nginx/html/index.html @@ -0,0 +1,24 @@ + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-oss/usr/share/nginx/html/nsx.html b/labs/lab5/nginx-oss/usr/share/nginx/html/nsx.html new file mode 100644 index 0000000..fc1de05 --- /dev/null +++ b/labs/lab5/nginx-oss/usr/share/nginx/html/nsx.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx NSX ! + + + +

Welcome to nginx NSX !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +NSX + +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-oss/usr/share/nginx/html/nsx.jpg b/labs/lab5/nginx-oss/usr/share/nginx/html/nsx.jpg new file mode 100644 index 0000000..f3c27f5 Binary files /dev/null and b/labs/lab5/nginx-oss/usr/share/nginx/html/nsx.jpg differ diff --git a/labs/lab5/nginx-oss/usr/share/nginx/html/rcf.html b/labs/lab5/nginx-oss/usr/share/nginx/html/rcf.html new file mode 100644 index 0000000..468ddae --- /dev/null +++ b/labs/lab5/nginx-oss/usr/share/nginx/html/rcf.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx RCF ! + + + +

Welcome to nginx RCF !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +RCF + +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-oss/usr/share/nginx/html/rcf.jpg b/labs/lab5/nginx-oss/usr/share/nginx/html/rcf.jpg new file mode 100644 index 0000000..40faef6 Binary files /dev/null and b/labs/lab5/nginx-oss/usr/share/nginx/html/rcf.jpg differ diff --git a/labs/lab5/nginx-plus/etc/nginx/conf.d/cafe.example.com.conf b/labs/lab5/nginx-plus/etc/nginx/conf.d/cafe.example.com.conf new file mode 100644 index 0000000..a770dba --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/conf.d/cafe.example.com.conf @@ -0,0 +1,37 @@ +# cafe.example.com HTTP +server { + # Listening on port 80 on all IP addresses on this machine + listen 80; + + server_name cafe.example.com; + + status_zone cafe-VirtualServer; + + # Server specific logging + access_log /var/log/nginx/cafe.example.com.log main_ext; + error_log /var/log/nginx/cafe.example.com_error.log info; + + location / { + + # Including best-practice headers are bonus points + include includes/proxy_headers.conf; + include includes/keepalive.conf; + + status_zone /; + + proxy_pass http://nginx_cafe; + } + + # Active Healthchecks + location @health_check { + internal; # Requests by NGINX only + proxy_set_header Host cafe.example.com; + proxy_pass http://nginx_cafe; + health_check interval=5s fails=3 passes=2 uri=/ match=status_ok; + + # Health check logs are boring but errors are interesting + # access_log /var/log/nginx/health_check.log main; + access_log off; + error_log /var/log/nginx/error.log error; + } +} diff --git a/labs/lab5/nginx-plus/etc/nginx/conf.d/dashboard.conf b/labs/lab5/nginx-plus/etc/nginx/conf.d/dashboard.conf new file mode 100644 index 0000000..3b1ace3 --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/conf.d/dashboard.conf @@ -0,0 +1,24 @@ +# NGINX Plus Basics, Nov 2024 +# Chris Akker, Shouvik Dutta, Adam Currier +# dashboard.conf +# +server { + # Conventional port for the NGINX Plus API is 8080 + listen 9000; + access_log off; # reduce noise in access logs + + location /api/ { + # Enable in read-write mode + api write=on; + } + # Conventional location of the NGINX Plus dashboard + location = /dashboard.html { + root /usr/share/nginx/html; + } + + # Redirect requests for "/" to "/dashboard.html" + location / { + return 301 /dashboard.html; + } +} + \ No newline at end of file diff --git a/labs/lab5/nginx-plus/etc/nginx/conf.d/default.conf b/labs/lab5/nginx-plus/etc/nginx/conf.d/default.conf new file mode 100644 index 0000000..5a96b73 --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/conf.d/default.conf @@ -0,0 +1,64 @@ +server { + listen 80 default_server; + server_name localhost; + + #access_log /var/log/nginx/host.access.log main; + + location / { + root /usr/share/nginx/html; + index index.html index.htm; + } + + #error_page 404 /404.html; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + location = /50x.html { + root /usr/share/nginx/html; + } + + location /test_header { + add_header X-Test-App true; + return 200 'HTTP/1.1 200 OK\nContent-Type: text/html\n\nWelcome to Lab 4 of the NGINX One Workshop!'; + } + + # proxy the PHP scripts to Apache listening on 127.0.0.1:80 + # + #location ~ \.php$ { + # proxy_pass http://127.0.0.1; + #} + + # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 + # + #location ~ \.php$ { + # root html; + # fastcgi_pass 127.0.0.1:9000; + # fastcgi_index index.php; + # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; + # include fastcgi_params; + #} + + # deny access to .htaccess files, if Apache's document root + # concurs with nginx's one + # + #location ~ /\.ht { + # deny all; + #} + + # enable /api/ location with appropriate access control in order + # to make use of NGINX Plus API + # + #location /api/ { + # api write=on; + # allow 127.0.0.1; + # deny all; + #} + + # enable NGINX Plus Dashboard; requires /api/ location to be + # enabled and appropriate access control for remote access + # + #location = /dashboard.html { + # root /usr/share/nginx/html; + #} +} diff --git a/labs/lab5/nginx-plus/etc/nginx/conf.d/status_ok.conf b/labs/lab5/nginx-plus/etc/nginx/conf.d/status_ok.conf new file mode 100644 index 0000000..adc6bbe --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/conf.d/status_ok.conf @@ -0,0 +1,5 @@ +# Simple health check expecting http 200 and correct Content-Type +match status_ok { + status 200; + header Content-Type = "text/html; charset=utf-8"; # For the nginx-cafe html +} \ No newline at end of file diff --git a/labs/lab5/nginx-plus/etc/nginx/conf.d/upstreams.conf b/labs/lab5/nginx-plus/etc/nginx/conf.d/upstreams.conf new file mode 100644 index 0000000..9879cf6 --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/conf.d/upstreams.conf @@ -0,0 +1,34 @@ +# NGINX Basics, Plus Proxy to three upstream NGINX containers +# Nov 2024 - Chris Akker, Shouvik Dutta, Adam Currier +# nginx_cafe servers +# +upstream nginx_cafe { # Upstream block, the name is "nginx_cafe" + + # Uncomment the zone directive below to add metrics to the Dashboard + zone nginx_cafe 256k; + + # Load Balancing Algorithms supported by NGINX + # - Round Robin (Default if nothing specified) + # - Least Connections + # - IP Hash + # - Hash (Any generic Hash) + + # Load Balancing Algorithms supported by NGINX Plus + # - Least Time Last Byte / Header + # - Random Two + + # Uncomment for Least-Time Last-Byte algorithm + least_time last_byte; + + # From Docker-Compose: + server web1:80; + server web2:80; + server web3:80; + + # Uncomment for Cookie persistence + # sticky cookie srv_id expires=1m domain=.example.com path=/; + + # Uncomment for keepalive TCP connections to upstreams + keepalive 16; + +} \ No newline at end of file diff --git a/labs/lab5/nginx-plus/etc/nginx/includes/keepalive.conf b/labs/lab5/nginx-plus/etc/nginx/includes/keepalive.conf new file mode 100644 index 0000000..a9fbcf4 --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/includes/keepalive.conf @@ -0,0 +1,9 @@ +# Default is HTTP/1, keepalive is only enabled in HTTP/1.1 +proxy_http_version 1.1; + +# Remove the Connection header if the client sends it, +# it could be "close" to close a keepalive connection +proxy_set_header Connection ""; + +# Host request header field, or the server name matching a request +proxy_set_header Host $host; \ No newline at end of file diff --git a/labs/lab5/nginx-plus/etc/nginx/includes/log_formats/main_ext.conf b/labs/lab5/nginx-plus/etc/nginx/includes/log_formats/main_ext.conf new file mode 100644 index 0000000..296ea7b --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/includes/log_formats/main_ext.conf @@ -0,0 +1,20 @@ +# Extended Log Format +# Nginx Basics +log_format main_ext 'remote_addr="$remote_addr", ' + '[time_local=$time_local], ' + 'request="$request", ' + 'status="$status", ' + 'http_referer="$http_referer", ' + 'body_bytes_sent="$body_bytes_sent", ' + 'Host="$host", ' + 'sn="$server_name", ' + 'request_time=$request_time, ' + 'http_user_agent="$http_user_agent", ' + 'http_x_forwarded_for="$http_x_forwarded_for", ' + 'request_length="$request_length", ' + 'upstream_address="$upstream_addr", ' + 'upstream_status="$upstream_status", ' + 'upstream_connect_time="$upstream_connect_time", ' + 'upstream_header_time="$upstream_header_time", ' + 'upstream_response_time="$upstream_response_time", ' + 'upstream_response_length="$upstream_response_length", '; diff --git a/labs/lab5/nginx-plus/etc/nginx/includes/proxy_headers.conf b/labs/lab5/nginx-plus/etc/nginx/includes/proxy_headers.conf new file mode 100644 index 0000000..23a83d1 --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/includes/proxy_headers.conf @@ -0,0 +1,12 @@ +## Set Headers to the proxied servers ## + +# client address in a binary form, value’s length is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses +proxy_set_header X-Real-IP $remote_addr; + +# X-Forwarded-For client request header field with the $remote_addr variable appended to it, +# separated by a comma. If the “X-Forwarded-For” field is not present in the client request header, +# the $proxy_add_x_forwarded_for variable is equal to the $remote_addr variable. +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + +# request scheme, “http” or “https” +proxy_set_header X-Forwarded-Proto $scheme; \ No newline at end of file diff --git a/labs/lab5/nginx-plus/etc/nginx/nginx.conf b/labs/lab5/nginx-plus/etc/nginx/nginx.conf new file mode 100644 index 0000000..e610191 --- /dev/null +++ b/labs/lab5/nginx-plus/etc/nginx/nginx.conf @@ -0,0 +1,77 @@ + +user nginx; +worker_processes 1; + +error_log /var/log/nginx/error.log notice; +pid /var/run/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + include /etc/nginx/includes/log_formats/*.conf; # Custom Access logs formats found here + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; +} + + +# TCP/UDP proxy and load balancing block +# +#stream { + # Example configuration for TCP load balancing + + #upstream stream_backend { + # zone tcp_servers 64k; + # server backend1.example.com:12345; + # server backend2.example.com:12345; + #} + + #server { + # listen 12345; + # status_zone tcp_server; + # proxy_pass stream_backend; + #} +#} + +# NGINX Plus Usage Reporting +# +# By default, every 30 minutes, NGINX Plus will send usage information +# to NGINX Instance Manager, resolved by a "nginx-mgmt.local" DNS entry. +# Alternate settings can be configured by uncommenting the "mgmt" block +# and optional directives. +# +#mgmt { + #usage_report endpoint=nginx-mgmt.local interval=30m; + #resolver DNS_IP; + + #uuid_file /var/lib/nginx/nginx.id; + + #ssl_protocols TLSv1.2 TLSv1.3; + #ssl_ciphers DEFAULT; + + #ssl_certificate client.pem; + #ssl_certificate_key client.key; + + #ssl_trusted_certificate trusted_ca_cert.crt; + #ssl_verify on; + #ssl_verify_depth 2; +#} diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/dashboard.html b/labs/lab5/nginx-plus/usr/share/nginx/html/dashboard.html new file mode 100644 index 0000000..5f1d00b --- /dev/null +++ b/labs/lab5/nginx-plus/usr/share/nginx/html/dashboard.html @@ -0,0 +1,1929 @@ +NGINX Plus Dashboard + \ No newline at end of file diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/gtr.html b/labs/lab5/nginx-plus/usr/share/nginx/html/gtr.html new file mode 100644 index 0000000..1b1bdfc --- /dev/null +++ b/labs/lab5/nginx-plus/usr/share/nginx/html/gtr.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx GTR ! + + + +

Welcome to nginx GTR !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +GTR + +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/gtr.jpg b/labs/lab5/nginx-plus/usr/share/nginx/html/gtr.jpg new file mode 100644 index 0000000..be39ffe Binary files /dev/null and b/labs/lab5/nginx-plus/usr/share/nginx/html/gtr.jpg differ diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/index.html b/labs/lab5/nginx-plus/usr/share/nginx/html/index.html new file mode 100644 index 0000000..5d2b304 --- /dev/null +++ b/labs/lab5/nginx-plus/usr/share/nginx/html/index.html @@ -0,0 +1,24 @@ + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/nsx.html b/labs/lab5/nginx-plus/usr/share/nginx/html/nsx.html new file mode 100644 index 0000000..fc1de05 --- /dev/null +++ b/labs/lab5/nginx-plus/usr/share/nginx/html/nsx.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx NSX ! + + + +

Welcome to nginx NSX !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +NSX + +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/nsx.jpg b/labs/lab5/nginx-plus/usr/share/nginx/html/nsx.jpg new file mode 100644 index 0000000..f3c27f5 Binary files /dev/null and b/labs/lab5/nginx-plus/usr/share/nginx/html/nsx.jpg differ diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/rcf.html b/labs/lab5/nginx-plus/usr/share/nginx/html/rcf.html new file mode 100644 index 0000000..468ddae --- /dev/null +++ b/labs/lab5/nginx-plus/usr/share/nginx/html/rcf.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx RCF ! + + + +

Welcome to nginx RCF !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +RCF + +

Thank you for using nginx.

+ + diff --git a/labs/lab5/nginx-plus/usr/share/nginx/html/rcf.jpg b/labs/lab5/nginx-plus/usr/share/nginx/html/rcf.jpg new file mode 100644 index 0000000..40faef6 Binary files /dev/null and b/labs/lab5/nginx-plus/usr/share/nginx/html/rcf.jpg differ diff --git a/labs/lab5/readme.md b/labs/lab5/readme.md new file mode 100644 index 0000000..58deafb --- /dev/null +++ b/labs/lab5/readme.md @@ -0,0 +1,395 @@ +# NGINX One Console and Upgrading NGINX Plus Instances to R33 + +## Introduction + +This lab will explore the R33 upgrade process with One Console. With release 33, your instances being managed is now a requirement. Let's explore how we can add our instances to One Console and how it will assist us in prepping our systems for the R33 upgrade. We will explore the One Console interface, create an Instance Group and look at how we can manage configs. Finally, we will show deploying a R33 container instance to One Console and upgrading our a standalone instance to R33 via One Console. + +## Learning Objectives + +- You will learn how to deploy a R33 version of a docker container +- You will learn how to pin a release version while installing NGINX Plus +- You will learn how to add an NGINX web server to One Console +- You will learn how to install NGINX Agent +- You will learn how to use Instance Groups to manage files +- You will learn how to upgrade your release to R33 (latest) + +## Prerequisites + +- You must have a license for NGINX One (jwt, key & cert) +- You must have Docker and Docker Compose installed and running +- See `Lab0` for instructions on setting up your system for this Workshop +- Familiarity with basic Linux concepts and commands +- Familiarity with basic NGINX concepts and commands + +
+ +### Deploy a container running R33 with Docker + + +| NGINX One Console | Docker | NGINX Plus | +| :--------------------------------------: | :------------------------------: | :--------------------------------: | +| ![NGINX One Console](media/nginx-one-icon.png) | ![Docker](media/docker-icon.png) | ![NGINX Plus](media/nginx-plus-icon.png) | + + +# Deploy an R33 instance. + +Release 33 of NGINX now requires NGINX Agent to be installed along with a license for NGINX One (Not to be confused with the NGINX One Console we are working with today). It is not as painful as some have been led to believe. Let's add a new R33 instance to our lab setup. + +First we need the NGINX One `license.jwt` file which you can get from [my.f5.com](https://my.f5.com). Create a new file in the lab5 folder called `license.jwt` and paste the contents into it. If you are in the F5 UDF environment, this has been done for you. The $JWT environment variable should still be set from the earlier labs, but you can check it. If it is not there, add the license to a CLI variable as you did previously: + +```bash +echo $JWT +# If the result is empty, set it the JWT variable again. +export JWT=$(cat license.jwt) + +#Confirm the other two previously used variables are still set: +echo $NAME +echo $TOKEN + +# If they are not set, go ahead and set them again: +export NAME=s.jobs +export TOKEN= +``` + +If you updated/changed the JWT token, you will need to login to docker again. Skip if everything was still set from before: + +```bash +docker login private-registry.nginx.com --username=$JWT --password=none +``` + +In this portion of the lab we re-use a docker-compose.yml file from lab2 to deploy our containers and register with the One Console. This time we will now add an R33 (latest) version of the NGINX Plus container. Open the docker-compose file in VS Code. + +```bash +vi lab5/docker-compose.yml +``` + +After the `plus3` instance code block we will put a new block of code for the R33 release. We will call this `plus4`, keeping in line with our naming convention for the labs. + +Starting on line 74 let's uncomment this block of code (ends on line 94): + +```bash +plus4: # Debian R33 NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + NGINX_LICENSE_JWT: $JWT + NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + hostname: $NAME-plus4 + container_name: $NAME-plus4 + image: private-registry.nginx.com/nginx-plus/agent:debian # From Nginx Private Registry R33 + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for API / Dashboard page + - '9113' # Open for Prometheus Scraper page + restart: always + # +``` + +Save your edits. You'll notice a couple of changes from the other blocks (besides the name). The first is the environment variable called `NGINX_LICENSE_JWT: $JWT` This is what authorizes the pulling of this specific image. The second change is the image name `private-registry.nginx.com/nginx-plus/agent:debian` which pulls the debian version of the NGINX Plus with Agent installed. We will be able to see this in the One Console once deployed. + +Now that this file is edited, save it and let's restart the containers. Issue the following commands: + +```bash +docker compose down +docker compose up --force-recreate -d +``` + +
+ +# Examine in One Console + +You will notice a few things in One console now. First - why are there duplicate container names?!?!? + +![NGINX Plus](media/r33-delete-old-instances-1.png) + +Containers as we know are ephemeral. Once we destroy / recreate them they re-register with the Console. You can manually clean these up (delete the grayed out versions of your images) or you can have these cleaned up automatically. Previously we used the search to narrow down the instances with your name. This time we will use the Filter feature. Choose the action of `Availability is Unavailable` then you can select your containers and use the `Delete selected` button. + +![NGINX Plus](media/r33-delete-old-instances-2.png) + +Once done, remember to clear the filter so you will be able to see the active instances. + +![NGINX Plus](media/r33-delete-old-instances-3.png) + + To automate this removal of instances, you can expand the `Settings` menu on the left hand side it will reveal an entry for `Instance Settings`. + +![NGINX Plus](media/r33-instance-settings-1.png) + +Clicking that will take you to a screen where you can change the cleanup to a time of your choosing. We usually leave it at 24 hours not seen, but we can set it down to a single hour. + +![NGINX Plus](media/r33-instance-settings-2.png) + +
+ Note +Make sure you aren't too aggressive with the auto cleanup as sometimes it is good to see what has been out in production over a recent period. +
+ + +Now that we cleaned things up we can see the plus4 instance in our `Instances` interface. + +![NGINX Plus](media/r33-plus4-deployed.png) + +If we click on the instance name, now we can see the NGINX version as well as the Agent version that are deployed: + +![NGINX Plus](media/r33-plus4-with-agent.png) + +That's how easy it is to deploy an R33 instance and have it registered with One Console. Using A/B testing practices, you can move the traffic from any R32 container to the R33 instance. We can now clean up the One Console environment by issuing: + +```bash +docker compose down +``` + + +# Stand up a NGINX Plus instance on NGINX Plus R32 + +Let's create an NGINX instance that is pinned to version R32 ona virtual machine. This will allow us to show an upgrade from R32 to the new R33. From the jumphost you can use the terminal to get to the command line to do an install. You can also use Webshell to the nplus server or RDP directly to it. From the VS Studio Terminal window, run the following commands. + +**Note: If you are using the F5 UDF environment, these files have been placed there ahead of time for your convenience. You can continue with the next step (install). + +```bash +ssh nplus +cd ~/Documents + +sudo mkdir -p /etc/nginx/ +sudo cp license/license.jwt /etc/nginx/license.jwt + +sudo mkdir -p /etc/ssl/nginx +sudo cp license/nginx-repo.* /etc/ssl/nginx/ +``` + +With the cert and key in place we can go ahead with the install. Let's do the pre-work: + +```bash +sudo apt update +sudo apt install apt-transport-https lsb-release ca-certificates wget gnupg2 ubuntu-keyring +wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null + printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \ +https://pkgs.nginx.com/plus/ubuntu `lsb_release -cs` nginx-plus\n" | sudo tee /etc/apt/sources.list.d/nginx-plus.list +``` + +For this lab, we need to pin this release version to R32 so that we can show the upgrade process. The keys we are using are good for R33, so if we simply ask for an install of nginx we will get the latest release (currently R33). To pin the release, we manually need to put the R32 branch in URL like: `/plus/R32/` + +```bash +sudo vi /etc/apt/sources.list.d/nginx-plus.list +``` +Change this line: + +```bash +"https://pkgs.nginx.com/plus/ubuntu jammy nginx-plus" +``` + + to: + +```bash +"https://pkgs.nginx.com/plus/R32/ubuntu jammy nginx-plus" +``` + +Run the commands to install NGINX Plus: + +```bash +sudo wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx +sudo apt update +sudo apt install -y nginx-plus +``` + +Confirm the version that you installed: + +```bash +nginx -v +``` + +```bash +### SAMPLE OUTPUT ### +nginx version: nginx/1.25.5 (nginx-plus-r32-p2) +``` + +```bash +sudo systemctl start nginx +``` + + +## Install NGINX agent and add NGINX Plus to One Console + +First, we will create a new Config Sync Group to add machines that we want to upgrade. As a best practice, you want your Config Sync Groups to only contain machines that have the exact same configuration. For example, a group for docker containers with nginx. One for OSS instances you have. Here we are creating a group to add Virtual Machines that we want to upgrade. Follow the same process as the previous lab by clicking on `Config Sync Groups` in the left hand menu and then clicking on the `Add Config Sync Group` button. + +![Add Config Sync Group](media/lab5-config-sync-group1.png) + +In the Nginx One Console, click on the Instances menu in the left hand side. Click on `Add Instance` button. + +![Add Instance](media/lab5-add-instance-1.png) + +It will ask you if you want to `Generate a new key` or `Use existing key`. We have already created a TOKEN variable in previous labs so we will use that same value. Click on the radio button for `Use existing key`. + +![Add Instance](media/lab5-add-instance-2.png) + +In the field labeled `Data Plane Key (optional)`, type in the environment variable `$TOKEN`. This will customize the curl command. For this example, we will use `Virtual Machine or Bare Metal` tab. You will see the command to install agent and register the instance with One Console. + +Confirm or set your environment variables: + +```bash +export NAME=s.jobs +export TOKEN= +export JWT=$(cat /home/ubuntu/Documents/license/license.jwt) +``` +Install the NGINX Agent and register with the One Console: + +```bash +curl https://agent.connect.nginx.com/nginx-agent/install | DATA_PLANE_KEY="$TOKEN" sh -s -- -y +``` +Now that agent is installed, there are a couple of modifications we can make to get the most out of this installation. + +## Enable NGINX Plus API + +To collect comprehensive metrics for NGINX Plus–including bytes streamed, information about upstream systems and caches, and counts of all HTTP status codes we can add the following to the NGINX Plus configuration file: + +```bash +location /api/ { + api write=on; + allow 127.0.0.1; + deny all; +} +``` + +This configuration: + - Enables the NGINX Plus API. + - Allows requests only from 127.0.0.1 (localhost). + - Blocks all other requests for security. + +We can do this in the One Console - in the Config Sync Group, click on the Configuration tab. Here we will edit the `/etc/nginx/conf.d/default.con`f file. Insert the above code on lines 12-16 as shown below. + +![Add Plus API](media/lab5-plus-api-1.png) + +Click `Next` to load the editor comparison screen and then click on the `Save and Publish` button. + +![Add Plus API](media/lab5-plus-api-2.png) + + +## Add to a Config Sync Group +We can get this instance to go into a One Console Config Sync Group with a small config change. Go back to your jumphost and Visual Studio, and in the terminal make sure you are on the nplus server. If not ssh to it with `ssh nplus`. + +We can add one line to the config `/etc/nginx-agent/agent-dynamic.conf` file: + +```bash +cd /var/lib/nginx-agent +sudo vi agent-dynamic.conf +``` +add the following line to the bottom of the file (use your name in place of s.jobs - meaning the one you used for the group above): + +```bash +instance_group: s.jobs-nginx-plus-vm +``` + +### Restart the agent to add to the group. + +```bash +sudo systemctl start nginx-agent +sudo nginx -s reload +``` +When the first instance is added to an Config Sync Group, that config becomes the default (if none existed ahead of time). Now that we have configured Agent on this system, you will see it in the Config Sync Group section we assigned it to. + +We have a system added to the Config Sync Group, let's show how we can push out config changes and even new files. To do an upgrade on an R32 system, there needs to be a `license.jwt` file placed in the `/etc/nginx` folder. This prevents accidental upgrades to R33 or later from happening. Putting the file in place we can then go and upgrade each system. + + +# Upgrade NGINX Plus from R32 to R33 + +Let's take the previous R32 install we created and upgrade it. This time we will do it with assistance from One Console. On the `nplus` system there is a directory for the NGINX One license files. The path is `~/Documents/license` + +In the UDF environment, the files are already there. From the jumphost system, check via the Visual Studio terminal: + +```bash +ssh nplus +cd Documents/ +tree license/ +``` + +```bash +#Sample Output +license/ +├── license.jwt +├── nginx-repo.crt +└── nginx-repo.key + +0 directories, 3 files +``` + +In the One Console we will create a new file. Pull up the Config Sync Group - we can see there is one Instance (nplus) that is in the group. + +Click on the group name and it will bring up the Details pane. + +![NGINX Plus](media/lab5-csg-1.png) + +Click on the Configuration tab. This will show the initial config pulled from the first instance that was added. We can add our own files to this and we will do so now. Click on the `+ Add File` button. + +The upgrade license file needs to be put in a certain location which is `/etc/nginx/license.jwt`. Type in that file name (including the path) and hit the green `Add` button. + +![NGINX Plus](media/lab5-add-license-1.png) + +Copy the value from the `~/Downloads/license/license.jwt` and enter it into this file in the NIM file. Click the `Next` button. + +![NGINX Plus](media/lab5-add-license-3.png) + +This will bring up a confirmation screen and we will select the green `Save and Publish` button. + +![NGINX Plus](media/lab5-add-license-2.png) + +On pressing this button, that new file was pushed out to the remote system. Let's confirm that by going to the terminal on the nplus system and checking. In Visual Studio terminal, you should still be on the `nplus` system. If not, do a `ssh nplus` and then we can check to see if the license file is there: + +![NGINX Plus](media/lab5-one-lic-confirm.png) + +We can see the Console pushed out the new license file to the remote system. This can be a huge help in the upgrade process, as we can put 100's of instances into the instance group, then push the license.jwt file out to all of them automatically making them ready for an upgrade. Let's go ahead and upgrade the instance as we are on the server already. For our example, we pinned the release to R32. When upgrading a system, you will not be sure if the system was pinned, so let's check: + +```bash +cd /etc/apt/sources.list.d/ +sudo vi nginx-plus.list +``` + +This URL does contains R32, so it is pinned. Change this line: + +```bash +"https://pkgs.nginx.com/plus/R32/ubuntu jammy nginx-plus" +``` + +to: + +```bash +"https://pkgs.nginx.com/plus/ubuntu jammy nginx-plus" +``` + +Now we can do an upgrade: + +```bash +sudo apt update +sudo apt upgrade nginx-plus -y +``` + +Confirm in One Console that the system was upgraded. Click on the `Instances` menu on the left-hand side and you will see the instance was upgraded: + +![NGINX Plus](media/lab5-upgrade-confirmed.png) + +You can update a single instance following this procedure for adding a license.jwt to the server. Using a Config Sync group, you can hadd 100's or 1000's of instances and have them all prepared for the upgrade. + + +**This completes Lab5.** + +## References + +- [NGINX One Console](https://docs.nginx.com/nginx-one/) +- [NGINX Instance MAnager](https://docs.nginx.com/nginx-instance-manager) +- [NGINX Plus](https://docs.nginx.com/nginx) + +### Authors + +- Chris Akker - Solutions Architect - Community and Alliances @ F5, Inc. +- Shouvik Dutta - Solutions Architect - Community and Alliances @ F5, Inc. +- Adam Currier - Solutions Architect - Community and Alliances @ F5, Inc. + +------------- + +Navigate to [Main Menu](../readme.md))