worker_processes {{ .WorkerProcesses }};

daemon off;

error_log stderr {{ .LogLevel }};

pid {{ .WorkingDir }}/nginx.pid;

{{ if .OpenTracingPlugin }}

load_module modules/ngx_http_opentracing_module.so;

{{ end }}

events {

# Accept connections as fast as possible.

multi_accept on;

# Includes both proxy and client connections.

# So e.g. 4096 = 2048 persistent client connections to backends per worker.

worker_connections {{ .WorkerConnections }};

# Use most optimal non-blocking selector on linux.

# Should be selected by default on linux, we just make it explicit here.

use epoll;

}

http {

default_type text/html;

# Track extended virtual host stats.

vhost_traffic_status_zone shared:vhost_traffic_status:{{ .VhostStatsSharedMemory }}m;

# Server names hash bucket sizes. Set based on nginx log messages.

{{ if gt .ServerNamesHashBucketSize 0 }}server_names_hash_bucket_size {{ .ServerNamesHashBucketSize }};{{ end }}

{{ if gt .ServerNamesHashMaxSize 0 }}server_names_hash_max_size {{ .ServerNamesHashMaxSize }};{{ end }}

# Keep alive time for client connections. Don't limit by number of requests.

keepalive_timeout {{ .KeepaliveSeconds }}s;

keepalive_requests 2147483647;

# Optimize for latency over throughput for persistent connections.

tcp_nodelay on;

# Disable nginx version leakage to external clients.

server_tokens off;

{{ if .ClientHeaderBufferSize }}

# Sets buffer size for reading client request header.

client_header_buffer_size {{ .ClientHeaderBufferSize }}k;

{{ end }}

{{ if .ClientBodyBufferSize }}

# Sets buffer size for reading client request bodies.

client_body_buffer_size {{ .ClientBodyBufferSize }}k;

{{ end }}

{{ if .LargeClientHeaderBufferBlocks }}

{{ if .ClientHeaderBufferSize }}

# Sets the maximum number of buffers used for reading large client request header.

# The size would be same as client_header_buffer_size. A request line cannot exceed the size of one buffer

large_client_header_buffers {{ .LargeClientHeaderBufferBlocks }} {{ .ClientHeaderBufferSize }}k;

{{ end }}

{{ end }}

# Obtain client IP from frontend

{{ range .TrustedFrontends }} set_real_ip_from {{ . }};

{{ end }}

real_ip_header {{ if .ProxyProtocol }}proxy_protocol{{ else }}X-Forwarded-For{{ end }};

real_ip_recursive on;

# Log format tracking timings

log_format upstream_info '$remote_addr - $remote_user [$time_iso8601] '

'"$request" $status{{.AccessLogHeaders}} $body_bytes_sent'

'"$http_referer" "$http_user_agent" '

'"$host" uip="$upstream_addr" ust="$upstream_status" '

'rt=$request_time uct="$upstream_connect_time" uht="$upstream_header_time" urt="$upstream_response_time"';

# Access logs

access_log {{ if .AccessLog }}{{ .AccessLogDir }}/access.log upstream_info buffer=32k flush=1m{{ else }}off{{ end }};

# Disable all logging of 404s - to prevent spam when error log is enabled.

log_not_found off;

# Enable keepalive to backend.

proxy_http_version 1.1;

proxy_set_header Connection "";

# Mitigate httpoxy vulnerability.

proxy_set_header Proxy "";

# Add headers for proxy information.

map $http_x_forwarded_proto $frontend_scheme {

default $http_x_forwarded_proto;

'' $scheme;

}

map $http_x_forwarded_port $frontend_port {

default $http_x_forwarded_port;

'' $server_port;

}

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Host $host:$frontend_port;

proxy_set_header X-Forwarded-Proto $frontend_scheme;

proxy_set_header X-Original-URI $request_uri;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header Host $host;

# Timeout to backend services on initial connect.

proxy_connect_timeout {{ .BackendConnectTimeoutSeconds }}s;

# Disable buffering, as we'll be interacting with ELBs with http listeners, which we assume will

# quickly consume and generate responses and requests.

# This should be enabled if nginx will directly serve traffic externally to unknown clients.

proxy_buffering off;

# Don't mess with redirects.

proxy_redirect off;

{{ if .OpenTracingPlugin }}

# Load a vendor tracer

opentracing_load_tracer {{ .OpenTracingPlugin }} {{ .OpenTracingConfig }};

opentracing on;

opentracing_propagate_context;

opentracing_trace_locations off;

{{ end }}

# Start ingresses

{{- $keepalive := .BackendKeepalives }}

{{- $proxyprotocol := .ProxyProtocol }}

{{- range $upstream := .Upstreams }}

upstream {{ $upstream.ID }} {

server {{ $upstream.Server }} max_conns={{ $upstream.MaxConnections }};

keepalive {{ $keepalive }};

}

{{ end }}

{{- $IngressPorts := .Ports }}

{{- $SSLPath := .SSLPath }}

{{define "HTTPSConf"}}

# https://mozilla.github.io/server-side-tls/ssl-config-generator/ - Nginx, Modern Profile + TLSv1, TLSv1.1

ssl_certificate {{ . }}.crt;

ssl_certificate_key {{ . }}.key;

ssl_session_timeout 1d;

ssl_session_cache shared:SSL:50m;

ssl_session_tickets off;

ssl_protocols TLSv1.2;

ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';

ssl_prefer_server_ciphers on;

{{ end }}

{{- range $entry := .Servers }}

# ingress: {{ $entry.Name }}

{{- range $portConf := $IngressPorts }}

server {

listen {{ $portConf.Port }}{{- if eq $portConf.Name "https" }} ssl{{ end }}{{ if $proxyprotocol }} proxy_protocol{{ end }};

server_name {{ $entry.ServerName }};

{{- if eq $portConf.Name "https" }}

{{ template "HTTPSConf" $SSLPath }}

{{- end }}

# disable any limits to avoid HTTP 413 for large uploads

client_max_body_size 0;

{{- range $location := $entry.Locations }}

location {{ if $location.Path }}{{ $location.Path }}{{ end }} {

{{- if $location.StripPath }}

# Strip location path when proxying.

# Beware this can cause issues with url encoded characters.

proxy_pass http://{{ $location.UpstreamID }}/;

{{- else }}

# Keep original path when proxying.

proxy_pass http://{{ $location.UpstreamID }};

{{- end }}

# Set display name for vhost stats.

vhost_traffic_status_filter_by_set_key {{ $location.Path }}::$proxy_host $server_name;

# Close proxy connections after backend keepalive time.

proxy_read_timeout {{ $location.BackendTimeoutSeconds }}s;

proxy_send_timeout {{ $location.BackendTimeoutSeconds }}s;

proxy_buffer_size {{ $location.ProxyBufferSize }}k;

proxy_buffers {{ $location.ProxyBufferBlocks }} {{ $location.ProxyBufferSize }}k;

# Allow localhost for debugging

allow 127.0.0.1;

# Restrict clients

{{ range $location.Allow }}allow {{ . }};

{{ end }}

deny all;

}

{{- end }}

}

{{- end }}

{{- end }}

# End ingresses

# Default backend

{{- range $portConf := $IngressPorts }}

server {

listen {{ $portConf.Port }}{{- if eq $portConf.Name "https" }} ssl{{ end }} default_server;

{{- if eq $portConf.Name "https" }}

{{ template "HTTPSConf" $SSLPath }}

{{- end }}

location / {

return 404;

}

}

{{- end }}

# Status port. This should be firewalled to only allow internal access.

server {

{{ if .OpenTracingPlugin }}

opentracing off;

{{ end }}

listen {{ .HealthPort }} default_server reuseport;

vhost_traffic_status off;

location /health {

access_log off;

return 200;

}

location /basic_status {

access_log off;

stub_status;

}

location /status {

access_log off;

vhost_traffic_status_display;

vhost_traffic_status_display_format html;

}

location / {

return 404;

}

}

}