nginx-auto.conf.template

# Auto-generated by start_esp
# Copyright 2017 Google Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

daemon off;

user nginx nginx;

pid ${pid_file};

# Worker/connection processing limits
worker_processes ${worker_processes};
worker_rlimit_nofile 10240;
events { worker_connections 10240; }

# Logging to stderr enables better integration with Docker and GKE/Kubernetes.
error_log stderr warn;

http {
  include /etc/nginx/mime.types;
  server_tokens off;
  client_max_body_size ${client_max_body_size};
  client_body_buffer_size ${client_body_buffer_size};

  # HTTP subrequests
  endpoints_resolver ${resolver};
  endpoints_certificates /etc/nginx/trusted-ca-certificates.crt;

% for i, location in enumerate(ingress.locations):
% if location.proto != 'grpc':
  upstream app_server${i} {
  % for backend in location.backends:
    server ${backend};
  % endfor
    keepalive 128;
  }
% endif
% endfor

% for trusted_proxy in xff_trusted_proxies:
  set_real_ip_from  ${trusted_proxy};
% endfor
  real_ip_header    X-Forwarded-For;
  real_ip_recursive on;

% if enable_websocket:
  map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
  }
% endif

  server {
    server_name ${ingress.host};

% if ssl_protocols:
  <%
    ssl_protocol_list = ""
  %>
  % for idx, val in enumerate(ssl_protocols):
    <%
      ssl_protocol_list += val
    %>
    % if idx < len(ssl_protocols)-1:
      <%
        ssl_protocol_list += " "
      %>
    % endif
  % endfor
    ssl_protocols ${ssl_protocol_list};
% endif

% for port in ingress.ports:
  % if port.proto == 'http':
    listen ${port.port} backlog=16384;
  % elif port.proto == 'http2':
    listen ${port.port} http2 backlog=16384;
  % elif port.proto == 'ssl':
    listen ${port.port} ssl http2 backlog=16384;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
  % endif
% endfor

    access_log ${access_log};

% if healthz:
    location = /${healthz} {
      return 200;
      access_log off;
    }
% endif

% if underscores_in_headers:
    underscores_in_headers on;
% endif

% if allow_invalid_headers:
    ignore_invalid_headers off;
% endif

% for i, location in enumerate(ingress.locations):
    location ${location.path} {
      # Begin Endpoints v2 Support
      endpoints {
        on;
        server_config /etc/nginx/server_config.pb.txt;
% if service_account:
        google_authentication_secret ${service_account};
% endif
% if google_cloud_platform:
        metadata_server ${metadata};
% endif
      }
      # End Endpoints v2 Support

% if enable_websocket:
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
% endif

% if cors_preset:
    # Begin CORS settings
  % if cors_preset == 'basic':
    set $cors "true";
    set $allow_origin "${cors_allow_origin}";
  % elif cors_preset == 'cors_with_regex':
    if ($http_origin ~* (${cors_allow_origin_regex})) {
        set $cors "true";
        set $allow_origin $http_origin;
    }
  % endif

    if ($request_method = 'OPTIONS') {
        set $cors "${'$'}{cors}options";
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Access-Control-Allow-Origin' "$allow_origin";
        add_header 'Access-Control-Allow-Methods' '${cors_allow_methods}';
        add_header 'Access-Control-Allow-Headers' '${cors_allow_headers}';
      % if cors_allow_credentials:
        add_header 'Access-Control-Allow-Credentials' 'true';
      % endif
        add_header 'Content-Type' 'text/plain; charset=utf-8';
        add_header 'Content-Length' 0;
        return 204;
    }

    if ($cors = "true") {
        add_header 'Access-Control-Allow-Origin' "$allow_origin";
        add_header 'Access-Control-Allow-Methods' '${cors_allow_methods}' always;
        add_header 'Access-Control-Allow-Headers' '${cors_allow_headers}' always;
        add_header 'Access-Control-Expose-Headers' '${cors_expose_headers}' always;
      % if cors_allow_credentials:
        add_header 'Access-Control-Allow-Credentials' 'true' always;
      % endif
    }
    # End CORS settings
% endif

% if location.proto == 'grpc':
      # WARNING: only first backend is used
      grpc_pass ${location.backends[0]} override;
% else:
  % if location.proto == 'http':
      proxy_pass http://app_server${i};
  % elif location.proto == 'https':
      proxy_pass https://app_server${i};
      % if tls_mutual_auth:
          proxy_ssl_certificate /etc/nginx/ssl/backend.crt;
          proxy_ssl_certificate_key /etc/nginx/ssl/backend.key;
      % endif
  % endif
      proxy_redirect off;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Host $server_name;
      proxy_set_header X-Google-Real-IP $remote_addr;

      # Enable the upstream persistent connection
      proxy_http_version 1.1;
      proxy_set_header Connection "";

      # 86400 seconds (24 hours) is the maximum a server is allowed.
      proxy_send_timeout 86400s;
      proxy_read_timeout 86400s;
% endif
    }
% endfor

    include /var/lib/nginx/extra/*.conf;
  }

  server {
    # expose /nginx_status and /endpoints_status but on a different port to
    # avoid external visibility / conflicts with the app.
    listen ${status};
    location /nginx_status {
      stub_status on;
      access_log off;
    }
    location /endpoints_status {
      endpoints_status;
      access_log off;
    }
    location /healthz {
      return 200;
      access_log off;
    }
    location / {
      root /dev/null;
    }
  }
}