Ticket #1063: nginx.conf

user www-data www-data;
pid       /var/run/nginx.pid;
worker_processes 4;


events {
    worker_connections 12500;
    # multi_accept on;
}

http {
    sendfile on;
    merge_slashes on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 110;
    types_hash_max_size 2048;
    server_tokens off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format ss_log_format "active\t[ $pid ]\t$remote_addr\t$http_user_agent\t$upstream_http_x_user_identity\t$http_x_client_id\t$http_x_request_id\t$ssl_cipher\t$request_method\t$uri\t$args\t$upstream_http_x_durations\t$status\t$http_x_error_code\t$connection_requests\t$request_completion\t$content_length\t$request_length\t$body_bytes_sent\t$bytes_sent";
    error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=others,facility=local5,severity=warn warn;
    access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=others,facility=local6,severity=warn ss_log_format;
    error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=others,facility=local5,severity=warn warn;
    access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=others,facility=local6,severity=warn ss_log_format;
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }



    upstream wopi_srv {
        server localhost:8400;
    }






        upstream provisioning-active {
            server unix:/opt/securisync/be-active/var/run/uwsgi-provisioning-active-0.sock;
            server unix:/opt/securisync/be-active/var/run/uwsgi-provisioning-active-1.sock;
            server unix:/opt/securisync/be-active/var/run/uwsgi-provisioning-active-2.sock;
            server unix:/opt/securisync/be-active/var/run/uwsgi-provisioning-active-3.sock;
            server unix:/opt/securisync/be-active/var/run/uwsgi-provisioning-active-4.sock;
            server unix:/opt/securisync/be-active/var/run/uwsgi-provisioning-active-5.sock;
            server unix:/opt/securisync/be-active/var/run/uwsgi-provisioning-active-6.sock;
        }
        upstream testing-active {
            server unix:/opt/securisync/be-active/var/run/uwsgi-testing-active-0.sock;
        }
        upstream internal-active {
            server unix:/opt/securisync/be-active/var/run/uwsgi-internal-active-0.sock;
        }

    upstream rabbitmq {
        server imfmrb-va.filemirror.local:15672;
    }
    upstream elastichq {
        server imfmes-va.filemirror.local:9200;
    }
    upstream internal_auth {
        server unix:/opt/securisync/be-active/var/run/uwsgi-internal_auth.sock;
    }
    proxy_buffer_size   128k;
    proxy_buffers   4 256k;
    proxy_busy_buffers_size   256k;

    server {
        listen 443 default_server;
        server_name admin.imsync.myonlinedata.net  dev0fmall-xxx-1.filemirror.local ;
        add_header Strict-Transport-Security "max-age=15638400; includeSubdomains; preload" always;
        ssl on;
        ssl_certificate /etc/ssl/certs/admin.imsync.myonlinedata.net.pem;
        ssl_certificate_key /etc/ssl/private/admin.imsync.myonlinedata.net.key;
        ssl_session_timeout 5m;
        ssl_ciphers  "HIGH MEDIUM !aNULL !eNULL !LOW -3DES !MD5 !EXP !PSK !SRP !DSS !RC4 !DH DES-CBC3-SHA";
        ssl_prefer_server_ciphers   on;
        ssl_protocols    TLSv1 TLSv1.1 TLSv1.2;
        ssl_session_cache shared:SSL:512k;

        root /opt/securisync/be-2.dev/var/www/;

        index index.html;


        gzip            on;
        gzip_min_length 1000;
        gzip_proxied    expired no-cache no-store private auth;
        gzip_types      application/json;

        client_max_body_size 500m;
        client_body_buffer_size 128k;
        server_tokens off;

        uwsgi_buffering on;
        uwsgi_buffer_size 64k;
        uwsgi_buffers 8 64k;
        uwsgi_busy_buffers_size 64k;
        uwsgi_connect_timeout 600s;
        uwsgi_read_timeout 600s;
        uwsgi_send_timeout 600s;
        uwsgi_force_ranges on;
        uwsgi_intercept_errors on;
        uwsgi_request_buffering on;
        uwsgi_max_temp_file_size 1024m;
        # uwsgi_next_upstream error timeout;
        uwsgi_next_upstream error;
        uwsgi_next_upstream_tries 2;

        location /nginx_status {
            stub_status on;
            access_log off;
            allow 127.0.0.1;
            deny all;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=nginx_status,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=nginx_status,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=nginx_status,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=nginx_status,facility=local6,severity=warn ss_log_format;
        }
        location /metadata/xdomain/ {
            alias  /opt/securisync/be-2.dev/var/www/xdomain/;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=crossdomain,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=crossdomain,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=crossdomain,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=crossdomain,facility=local6,severity=warn ss_log_format;

        }
        location /diagnostic-reports/ {
            satisfy any;
            auth_basic "INTERMEDIA domain";
            auth_basic_user_file /opt/securisync/be-active/conf/nginx.htpasswd;
            auth_request /internal_auth;
            autoindex on;
            alias /var/lib/securisync/diagnostic-reports/;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=diagnostic,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=diagnostic,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=diagnostic,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=diagnostic,facility=local6,severity=warn ss_log_format;
        }
        location /diagnostic-logs/ {
            satisfy any;
            auth_basic "INTERMEDIA domain";
            auth_basic_user_file /opt/securisync/be-active/conf/nginx.htpasswd;
            auth_request /internal_auth;
            autoindex on;
            alias      /var/lib/securisync/diagnostic-logs/;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=diagnostic,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=diagnostic,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=diagnostic,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=diagnostic,facility=local6,severity=warn ss_log_format;
        }
        location /favicon.ico {
            alias  /opt/securisync/be-active/var/www/web/content/static/images/favicon.ico;

            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=favicon,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=favicon,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=favicon,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=favicon,facility=local6,severity=warn ss_log_format;
        }

        location /internal_auth {
            uwsgi_pass internal_auth;
            include uwsgi_params;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=internal_auth,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=internal_auth,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=internal_auth,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=internal_auth,facility=local6,severity=warn ss_log_format;
        }

        rewrite    web/login    /web/#login permanent;
        rewrite    /web/signup   /web/#signup permanent;
        rewrite    ^/web/s/(.+)$ /web/#s/login?public_share=$1 permanent;
        if ($query_string ~* accesscode=){
            rewrite    /web /web/#/ permanent;
        }



        location ~* ^/(clientaccesspolicy|crossdomain)\.xml$ {
            etag off;
            proxy_set_header If-Modified-Since "";
            proxy_set_header If-None-Match-Since "";
            add_header Content-Type "text/xml";

            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=crossdomain,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=crossdomain,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=crossdomain,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=crossdomain,facility=local6,severity=warn ss_log_format;
        }

        merge_slashes off;
        location ~* /rabbitmq/api/(.*)///(.*) {
            proxy_pass https://rabbitmq/api/$1/%2F/$2;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=rabbitmq,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=rabbitmq,facility=local6,severity=warn ss_log_format;

            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=rabbitmq,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=rabbitmq,facility=local6,severity=warn ss_log_format;

        }
        location /rabbitmq/ {
            proxy_pass https://rabbitmq/;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=rabbitmq,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=rabbitmq,facility=local6,severity=warn ss_log_format;

            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=rabbitmq,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=rabbitmq,facility=local6,severity=warn ss_log_format;

        }
        location /elastichq/server {
            satisfy any;
            auth_basic "INTERMEDIA domain";
            auth_basic_user_file /opt/securisync/be-active/conf/nginx.htpasswd;
            auth_request /internal_auth;
            proxy_pass http://elastichq/;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=elastichq,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=elastichq,facility=local6,severity=warn ss_log_format;

            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=elastichq,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=elastichq,facility=local6,severity=warn ss_log_format;

        }
        location /content {
            internal;
            alias /var/lib/securisync;
            add_header Etag $upstream_http_etag;
            add_header Last-Modified $upstream_http_last_modified;
            add_header X-Revision $upstream_http_x_revision;
            add_header X-Key-ID $upstream_http_x_key_id;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=content,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=content,facility=local6,severity=warn ss_log_format;

            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=content,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=content,facility=local6,severity=warn ss_log_format;

        }


        location /wopi/files {
            satisfy any;
            allow all;
            proxy_pass http://wopi_srv;
            error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=wopi,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=wopi,facility=local6,severity=warn ss_log_format;
            error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=wopi,facility=local5,severity=warn warn;
            access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=wopi,facility=local6,severity=warn ss_log_format;
        }





            location /provisioning {
                uwsgi_pass provisioning-active;
                include uwsgi_params;
                satisfy any;
                auth_basic "INTERMEDIA domain";
                auth_basic_user_file /opt/securisync/be-active/conf/nginx.htpasswd;
                auth_request /internal_auth;
                error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=provisioning,facility=local5,severity=warn warn;
                access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=provisioning,facility=local6,severity=warn ss_log_format;
                error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=provisioning,facility=local5,severity=warn warn;
                access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=provisioning,facility=local6,severity=warn ss_log_format;
            }
            location /testing {
                uwsgi_pass testing-active;
                include uwsgi_params;
                satisfy any;
                auth_basic "INTERMEDIA domain";
                auth_basic_user_file /opt/securisync/be-active/conf/nginx.htpasswd;
                auth_request /internal_auth;
                error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=testing,facility=local5,severity=warn warn;
                access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=testing,facility=local6,severity=warn ss_log_format;
                error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=testing,facility=local5,severity=warn warn;
                access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=testing,facility=local6,severity=warn ss_log_format;
            }
            location /internal {
                uwsgi_pass internal-active;
                include uwsgi_params;
                error_log syslog:server=imfmce-va-81-1.filemirror.local,tag=internal,facility=local5,severity=warn warn;
                access_log syslog:server=imfmce-va-81-1.filemirror.local,tag=internal,facility=local6,severity=warn ss_log_format;
                error_log syslog:server=imfmce-va-81-2.filemirror.local,tag=internal,facility=local5,severity=warn warn;
                access_log syslog:server=imfmce-va-81-2.filemirror.local,tag=internal,facility=local6,severity=warn ss_log_format;
            }
    }
}