Ticket #1673: nginx.conf

File nginx.conf, 6.6 KB (added by akayunov@…, 8 years ago)

nginx.conf

Line 
1user www-data www-data;
2pid /var/run/nginx.pid;
3worker_processes 1;
4worker_rlimit_nofile 21000;
5
6error_log /var/log/error.log;
7
8events {
9 worker_connections 12500;
10 multi_accept on;
11}
12
13http {
14 sendfile on;
15 # merge_slashes on;
16 # tcp_nopush on;
17 # tcp_nodelay on;
18 # keepalive_timeout 110;
19 resolver 192.168.127.10 ipv6=off;
20 resolver_timeout 3s;
21 log_subrequest on;
22
23 # client_body_temp_path /client_temp 1 2;
24 # proxy_read_timeout 900;
25 # proxy_send_timeout 900;
26 # types_hash_max_size 2048;
27 server_tokens off;
28
29 include /etc/nginx/mime.types;
30 default_type application/octet-stream;
31 log_format cas_log_format "active\t[ $pid ]\t$remote_addr\t$http_user_agent\t$upstream_http_x_user_identity\t$http_x_client_id\t$http_x_request_id\t$ssl_cipher\t$request_method\t$uri\t$args\t$upstream_http_x_durations\t$status\t$sent_http_x_error_code\t$connection_requests\t$request_completion\t$content_length\t$request_length\t$body_bytes_sent\t$bytes_sent\t$request_time\t$upstream_http_x_worker_pid";
32 error_log syslog:server=syslog,tag=nginx,facility=local5 warn;
33 access_log syslog:server=syslog,tag=nginx,facility=local6,severity=warn cas_log_format;
34
35 geo $external {
36 default 1;
37 10.0.0.0/8 0;
38 192.0.2.134/32 0; # us2 VIP SNAT
39 192.168.0.0/16 0; # docker, VIP SNAT
40 127.0.0.0/8 0; # nginx health-checks
41 172.16.0.0/12 0; # tfsbuild
42 }
43
44 # http -> https
45# server {
46# listen 80 default_server;
47# location = /robots.txt {
48# alias /var/www/robots.txt;
49# }
50# location / {
51# return 301 https://$host$request_uri;
52# }
53# }
54
55 server {
56 #listen 443 ssl;
57 listen 80;
58 charset utf-8;
59
60 #ssl_certificate /run/secrets/nginx.pem;
61 #ssl_certificate_key /run/secrets/nginx.key;
62 #ssl_session_timeout 1d;
63 #ssl_session_cache shared:SSL:50m;
64 #ssl_session_tickets off;#
65
66
67 # intermediate configuration. tweak to your needs.
68 #ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
69 #ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
70 #ssl_prefer_server_ciphers on;
71
72 location /nginx_status {
73 stub_status on;
74 access_log off;
75 if ($external) { return 403; }
76 }
77
78 client_max_body_size 100M;
79
80 location /d {
81 client_max_body_size 0;
82 proxy_request_buffering off;
83 proxy_http_version 1.1;
84 proxy_pass http://upload:8080;
85 error_log syslog:server=syslog,tag=upload,facility=local5 warn;
86 access_log syslog:server=syslog,tag=upload,facility=local6,severity=warn cas_log_format;
87 }
88
89 location ~ ^/storage/default/(.*):(\d+)/(.*) {
90 internal;
91
92 set $download_host $1;
93 set $download_port $2;
94 set $download_uri $3;
95
96 proxy_method GET;
97 proxy_pass_request_headers off;
98 proxy_pass_request_body off;
99 proxy_buffering off;
100 proxy_http_version 1.1;
101
102 proxy_hide_header x-amz-request-id;
103 proxy_hide_header x-amz-meta-uid;
104 proxy_hide_header x-amz-id-2;
105 proxy_hide_header x-amz-meta-mode;
106 proxy_hide_header x-amz-meta-mtime;
107 proxy_hide_header x-amz-meta-gid;
108 proxy_hide_header x-amz-version-id;
109 proxy_hide_header x-amz-server-side-encryption;
110 proxy_hide_header accept-ranges;
111
112 proxy_hide_header Set-Cookie;
113 proxy_ignore_headers Set-Cookie;
114
115 proxy_hide_header content-type;
116
117 # Do not touch local disks when proxying
118 # content to clients
119 proxy_max_temp_file_size 0;
120
121 # Suppress original request headers
122 # but support the following:
123 proxy_set_header Host $download_host;
124 proxy_set_header Range $http_range;
125
126 proxy_pass https://$download_host:$download_port/$download_uri$is_args$args;
127 proxy_connect_timeout 10s;
128 proxy_next_upstream error timeout http_500 http_502 http_503;
129
130 # A trick with set to temporary variable and add_header which evaluated
131 # before the proxy request:
132 set $etag $upstream_http_etag;
133 set $last_modified $upstream_http_last_modified;
134 set $access_control_expose_headers $upstream_http_access_control_expose_headers;
135 set $access_control_allow_origin $upstream_http_access_control_allow_origin;
136
137 add_header Etag $etag;
138 add_header Last-Modified $last_modified;
139 add_header Access-Control-Expose-Headers $access_control_expose_headers;
140 add_header Access-Control-Allow-Origin $access_control_allow_origin;
141
142 error_log syslog:server=syslog,tag=s3,facility=local5 warn;
143 access_log syslog:server=syslog,tag=s3,facility=local6,severity=warn cas_log_format;
144 }
145
146 location /u {
147 client_max_body_size 100M;
148 proxy_request_buffering off;
149 proxy_http_version 1.1;
150 proxy_pass http://upload:8080;
151 error_log syslog:server=syslog,tag=upload,facility=local5 warn;
152 access_log syslog:server=syslog,tag=upload,facility=local6,severity=warn cas_log_format;
153 }
154
155 location /api/v1 {
156 uwsgi_pass app:8080;
157 include /etc/nginx/uwsgi_params;
158 error_log syslog:server=syslog,tag=slot,facility=local5 warn;
159 access_log syslog:server=syslog,tag=slot,facility=local6,severity=warn cas_log_format;
160 }
161
162 location = /robots.txt {
163 alias /var/www/robots.txt;
164 }
165 location /internal/version {
166 default_type text/plain;
167 alias /var/www/VERSION;
168 }
169 location /internal/webping {
170 default_type text/plain;
171 return 200 'SUCCESS';
172 }
173 }
174}