|
| 1 | +apiVersion: v1 |
| 2 | +kind: ConfigMap |
| 3 | +metadata: |
| 4 | + name: nginx-config |
| 5 | +data: |
| 6 | + nginx.conf: | |
| 7 | + worker_processes auto; |
| 8 | + error_log /var/log/nginx/error.log warn; |
| 9 | + pid /var/cache/nginx/nginx.pid; |
| 10 | + |
| 11 | + # Tune for large file serving |
| 12 | + worker_rlimit_nofile 65535; |
| 13 | + |
| 14 | + events { |
| 15 | + worker_connections 4096; |
| 16 | + use epoll; |
| 17 | + multi_accept on; |
| 18 | + } |
| 19 | + |
| 20 | + http { |
| 21 | + include /etc/nginx/mime.types; |
| 22 | + default_type application/octet-stream; |
| 23 | + |
| 24 | + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' |
| 25 | + '$status $body_bytes_sent "$http_referer" ' |
| 26 | + '"$http_user_agent" "$http_x_forwarded_for" ' |
| 27 | + 'cache=$upstream_cache_status'; |
| 28 | + |
| 29 | + access_log /var/log/nginx/access.log main; |
| 30 | + |
| 31 | + # Large file optimisations |
| 32 | + sendfile on; |
| 33 | + tcp_nopush on; |
| 34 | + tcp_nodelay on; |
| 35 | + keepalive_timeout 65; |
| 36 | + |
| 37 | + # Proxy cache zone configuration: |
| 38 | + # keys_zone=cdn_cache:50m — 50MB for cache keys/metadata (~400k keys) |
| 39 | + # max_size=50g — on-disk cache (adjust to your PVC size) |
| 40 | + # inactive=30d — evict if not accessed in this time |
| 41 | + # use_temp_path=off — write directly to cache dir (avoids extra copy) |
| 42 | + proxy_cache_path /var/cache/nginx/cdn |
| 43 | + levels=1:2 |
| 44 | + keys_zone=cdn_cache:50m |
| 45 | + max_size={{ .Values.cdn.cacheSize }} |
| 46 | + inactive={{ .Values.cdn.inactive }} |
| 47 | + use_temp_path=off; |
| 48 | + |
| 49 | + # Don't buffer large files to disk before sending — stream them |
| 50 | + proxy_buffering on; |
| 51 | + proxy_request_buffering off; |
| 52 | + |
| 53 | + # Increase timeouts for large file transfers |
| 54 | + proxy_connect_timeout 10s; |
| 55 | + proxy_send_timeout 300s; |
| 56 | + proxy_read_timeout 300s; |
| 57 | + send_timeout 300s; |
| 58 | + |
| 59 | + # Hide upstream headers we don't want to leak |
| 60 | + proxy_hide_header x-amz-request-id; |
| 61 | + proxy_hide_header x-amz-id-2; |
| 62 | + |
| 63 | + include /etc/nginx/conf.d/*.conf; |
| 64 | + } |
| 65 | + default.conf: | |
| 66 | + upstream s3_origin { |
| 67 | + server {{ .Values.cdn.objectStorageServerHostname }}:443; |
| 68 | + keepalive 32; |
| 69 | + } |
| 70 | +
|
| 71 | + server { |
| 72 | + listen 8080; |
| 73 | + server_name _; |
| 74 | +
|
| 75 | + # TLS — cert mounted from a k8s secret via ingress or directly |
| 76 | + #ssl_certificate /etc/nginx/tls/tls.crt; |
| 77 | + #ssl_certificate_key /etc/nginx/tls/tls.key; |
| 78 | + #ssl_protocols TLSv1.2 TLSv1.3; |
| 79 | + #ssl_ciphers HIGH:!aNULL:!MD5; |
| 80 | +
|
| 81 | + proxy_cache cdn_cache; |
| 82 | + proxy_cache_valid 200 206 7d; # Cache 200 and partial content |
| 83 | + proxy_cache_valid 404 1m; # Don't cache 404s for long |
| 84 | + proxy_cache_use_stale error timeout updating http_500 http_502 http_503; |
| 85 | + proxy_cache_lock on; # Collapse simultaneous requests for the same file |
| 86 | + proxy_cache_lock_timeout 10s; |
| 87 | +
|
| 88 | + proxy_cache_key "$scheme$proxy_host$uri"; |
| 89 | +
|
| 90 | + add_header X-Cache-Status $upstream_cache_status always; |
| 91 | + add_header X-Served-By $hostname always; |
| 92 | +
|
| 93 | + add_header X-Content-Type-Options nosniff always; |
| 94 | + add_header X-Frame-Options DENY always; |
| 95 | +
|
| 96 | + proxy_cache_revalidate on; |
| 97 | + proxy_cache_bypass 0; |
| 98 | + proxy_no_cache 0; |
| 99 | + proxy_ignore_headers Cache-Control Expires Set-Cookie; |
| 100 | +
|
| 101 | + location /{{ .Values.cdn.bucketName }}/ { |
| 102 | + # Forward to Object Storage. |
| 103 | + # S3-compatible API expects requests in the form: /bucket-name/key |
| 104 | + # Our clients are using URL paths in the exact same format. |
| 105 | + proxy_pass https://s3_origin$request_uri; |
| 106 | +
|
| 107 | + proxy_http_version 1.1; |
| 108 | + proxy_set_header Connection ""; # keepalive to upstream |
| 109 | + proxy_set_header Host rook-ceph-rgw-ceph-objectstore.rook-ceph.svc; |
| 110 | + proxy_set_header X-Real-IP $remote_addr; |
| 111 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 112 | +
|
| 113 | + # Don't forward auth headers downstream |
| 114 | + proxy_set_header Authorization ""; |
| 115 | +
|
| 116 | + # SSL settings for upstream connection |
| 117 | + proxy_ssl_server_name on; |
| 118 | + proxy_ssl_protocols TLSv1.2 TLSv1.3; |
| 119 | +
|
| 120 | + # Tell clients files are immutable — they should cache forever |
| 121 | + add_header Cache-Control "public, max-age=31536000, immutable" always; |
| 122 | +
|
| 123 | + # Support resumable downloads |
| 124 | + proxy_force_ranges on; |
| 125 | +
|
| 126 | + # Stream large files rather than buffering defeats the cache, so keep buffering on: |
| 127 | + proxy_buffering on; |
| 128 | + } |
| 129 | +
|
| 130 | + # Health check endpoint (used by k8s liveness/readiness probes) |
| 131 | + location /healthz { |
| 132 | + access_log off; |
| 133 | + return 200 "ok\n"; |
| 134 | + add_header Content-Type text/plain; |
| 135 | + } |
| 136 | +
|
| 137 | + # Expose basic cache stats (restrict to internal) |
| 138 | + location /nginx_status { |
| 139 | + stub_status; |
| 140 | + allow 10.0.0.0/8; |
| 141 | + allow 172.16.0.0/12; |
| 142 | + allow 192.168.0.0/16; |
| 143 | + deny all; |
| 144 | + } |
| 145 | + } |
0 commit comments