nginx.tmpl

worker_processes  {{.WorkerProcesses}};
{{- if .WorkerRlimitNofile}}
worker_rlimit_nofile {{.WorkerRlimitNofile}};{{end}}
{{- if .WorkerCPUAffinity}}
worker_cpu_affinity {{.WorkerCPUAffinity}};{{end}}
{{- if .WorkerShutdownTimeout}}
worker_shutdown_timeout {{.WorkerShutdownTimeout}};{{end}}
daemon off;

error_log  stderr {{.ErrorLogLevel}};
pid        /var/lib/nginx/nginx.pid;

{{- if .OpenTracingLoadModule}}
load_module modules/ngx_http_opentracing_module.so;
{{- end}}

{{- if .MainSnippets}}
{{range $value := .MainSnippets}}
{{$value}}{{end}}
{{- end}}

events {
    worker_connections  {{.WorkerConnections}};
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    {{- if .HTTPSnippets}}
    {{range $value := .HTTPSnippets}}
    {{$value}}{{end}}
    {{- end}}

    {{if .LogFormat -}}
    log_format  main {{if .LogFormatEscaping}}escape={{ .LogFormatEscaping }} {{end}}
                     {{range $i, $value := .LogFormat -}}
                     {{with $value}}'{{if $i}} {{end}}{{$value}}'
                     {{end}}{{end}};
    {{- else -}}
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    {{- end}}

    map $upstream_trailer_grpc_status $grpc_status {
        default $upstream_trailer_grpc_status;
        '' $sent_http_grpc_status;
    }

    {{if .AccessLogOff}}
    access_log off;
    {{else}}
    access_log  /dev/stdout  main;
    {{end}}

    {{if .LatencyMetrics}}
    log_format response_time '{"upstreamAddress":"$upstream_addr", "upstreamResponseTime":"$upstream_response_time", "proxyHost":"$proxy_host", "upstreamStatus": "$upstream_status"}';
    access_log syslog:server=unix:/var/lib/nginx/nginx-syslog.sock,nohostname,tag=nginx response_time;
    {{end}}

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout {{.KeepaliveTimeout}};
    keepalive_requests {{.KeepaliveRequests}};

    #gzip  on;

    server_names_hash_max_size {{.ServerNamesHashMaxSize}};
    {{if .ServerNamesHashBucketSize}}server_names_hash_bucket_size {{.ServerNamesHashBucketSize}};{{end}}

    variables_hash_bucket_size {{.VariablesHashBucketSize}};
    variables_hash_max_size {{.VariablesHashMaxSize}};

    map $request_uri $request_uri_no_args {
        "~^(?P<path>[^?]*)(\?.*)?$" $path;
    }

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }
    map $http_upgrade $vs_connection_header {
        default upgrade;
        ''      $default_connection_header;
    }
    {{if .SSLProtocols}}ssl_protocols {{.SSLProtocols}};{{end}}
    {{if .SSLCiphers}}ssl_ciphers "{{.SSLCiphers}}";{{end}}
    {{if .SSLPreferServerCiphers}}ssl_prefer_server_ciphers on;{{end}}
    {{if .SSLDHParam}}ssl_dhparam {{.SSLDHParam}};{{end}}

    {{if .OpenTracingEnabled}}
    opentracing on;
    {{end}}
    {{if .OpenTracingLoadModule}}
    opentracing_load_tracer {{ .OpenTracingTracer }} /var/lib/nginx/tracer-config.json;
    {{end}}

    server {
        # required to support the Websocket protocol in VirtualServer/VirtualServerRoutes
        set $default_connection_header "";
        set $resource_type "";
        set $resource_name "";
        set $resource_namespace "";
        set $service "";

        listen 80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};

        {{if .TLSPassthrough}}
        listen unix:/var/lib/nginx/passthrough-https.sock ssl default_server{{if .HTTP2}} http2{{end}} proxy_protocol;
        set_real_ip_from unix:;
        real_ip_header proxy_protocol;
        {{else}}
        listen 443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};
        {{end}}

        {{if .SSLRejectHandshake}}
        ssl_reject_handshake on;
        {{else}}
        ssl_certificate /etc/nginx/secrets/default;
        ssl_certificate_key /etc/nginx/secrets/default;
        {{end}}

        {{range $setRealIPFrom := .SetRealIPFrom}}
        set_real_ip_from {{$setRealIPFrom}};{{end}}
        {{if .RealIPHeader}}real_ip_header {{.RealIPHeader}};{{end}}
        {{if .RealIPRecursive}}real_ip_recursive on;{{end}}

        server_name _;
        server_tokens "{{.ServerTokens}}";
        {{if .DefaultServerAccessLogOff}}
        access_log off;
        {{end}}

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        {{if .HealthStatus}}
        location {{.HealthStatusURI}} {
            default_type text/plain;
            return 200 "healthy\n";
        }
        {{end}}

        location / {
            return {{.DefaultServerReturn}};
        }
    }

    {{- if .NginxStatus}}
    # stub_status
    server {
        listen {{.NginxStatusPort}};
        {{range $value := .NginxStatusAllowCIDRs}}
        allow {{$value}};{{end}}
        deny all;
        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}
        location /stub_status {
            stub_status;
        }
    }
    {{- end}}

    {{- if .StubStatusOverUnixSocketForOSS }}
    server {
        listen unix:/var/lib/nginx/nginx-status.sock;
        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        location /stub_status {
            stub_status;
        }
    }
    {{- end}}

    include /etc/nginx/config-version.conf;
    include /etc/nginx/conf.d/*.conf;

    server {
        listen unix:/var/lib/nginx/nginx-502-server.sock;
        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        return 502;
    }

    server {
        listen unix:/var/lib/nginx/nginx-418-server.sock;
        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        return 418;
    }
}

stream {
    {{if .StreamLogFormat -}}
    log_format  stream-main {{if .StreamLogFormatEscaping}}escape={{ .StreamLogFormatEscaping }} {{end}}
                            {{range $i, $value := .StreamLogFormat -}}
                            {{with $value}}'{{if $i}} {{end}}{{$value}}'
                            {{end}}{{end}};
    {{- else -}}
    log_format  stream-main  '$remote_addr [$time_local] '
                      '$protocol $status $bytes_sent $bytes_received '
                      '$session_time "$ssl_preread_server_name"';
    {{- end}}

    access_log  /dev/stdout  stream-main;

    {{range $value := .StreamSnippets}}
    {{$value}}{{end}}

    {{if .TLSPassthrough}}
    map $ssl_preread_server_name $dest_internal_passthrough  {
        default unix:/var/lib/nginx/passthrough-https.sock;
        include /etc/nginx/tls-passthrough-hosts.conf;
    }

    server {
        listen 443;

        ssl_preread on;

        proxy_protocol on;
        proxy_pass $dest_internal_passthrough;
    }
    {{end}}

    include /etc/nginx/stream-conf.d/*.conf;
}