PAWS nginx.conf
ActivePublic
Actions

Authored by zhuyifei1999 on Feb 26 2018, 1:45 AM.

Tags

None

Referenced Files

	F14019178: PAWS nginx.conf
	Feb 26 2018, 1:45 AM

Subscribers

None

	# yuvipanda@tools-paws-master-01:~$ kubectl --namespace=prod exec -it proxy-5cd7d56555-tm4p6 /bin/bash
	# Defaulting container name to nginx.
	# Use 'kubectl describe pod/proxy-5cd7d56555-tm4p6 -n prod' to see all of the # containers in this pod.
	# root@proxy-5cd7d56555-tm4p6:/# cat /etc/nginx/nginx.conf

	daemon off;

	worker_processes 4;
	pid /run/nginx.pid;

	worker_rlimit_nofile 261120;

	worker_shutdown_timeout 10s ;

	events {
	multi_accept on;
	worker_connections 16384;
	use epoll;
	}

	http {

	real_ip_header X-Forwarded-For;

	real_ip_recursive on;

	set_real_ip_from 0.0.0.0/0;

	geoip_country /etc/nginx/GeoIP.dat;
	geoip_city /etc/nginx/GeoLiteCity.dat;
	geoip_proxy_recursive on;

	sendfile on;

	aio threads;
	aio_write on;

	tcp_nopush on;
	tcp_nodelay on;

	log_subrequest on;

	reset_timedout_connection on;

	keepalive_timeout 75s;
	keepalive_requests 100;

	client_header_buffer_size 1k;
	client_header_timeout 60s;
	large_client_header_buffers 4 8k;
	client_body_buffer_size 8k;
	client_body_timeout 60s;

	http2_max_field_size 4k;
	http2_max_header_size 16k;

	types_hash_max_size 2048;
	server_names_hash_max_size 1024;
	server_names_hash_bucket_size 32;
	map_hash_bucket_size 64;

	proxy_headers_hash_max_size 512;
	proxy_headers_hash_bucket_size 64;

	variables_hash_bucket_size 128;
	variables_hash_max_size 2048;

	underscores_in_headers off;
	ignore_invalid_headers on;

	include /etc/nginx/mime.types;
	default_type text/html;

	brotli on;
	brotli_comp_level 4;
	brotli_types application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component;

	gzip on;
	gzip_comp_level 5;
	gzip_http_version 1.1;
	gzip_min_length 256;
	gzip_types application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component;
	gzip_proxied any;
	gzip_vary on;

	# Custom headers for response

	server_tokens on;

	# disable warnings
	uninitialized_variable_warn off;

	# Additional available variables:
	# $namespace
	# $ingress_name
	# $service_name
	log_format upstreaminfo '$the_real_ip - [$the_real_ip] - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status';

	map $request_uri $loggable {

	default 1;
	}

	access_log /var/log/nginx/access.log upstreaminfo if=$loggable;

	error_log /var/log/nginx/error.log notice;

	resolver 10.96.0.10 valid=30s;

	# Retain the default nginx handling of requests without a "Connection" header
	map $http_upgrade $connection_upgrade {
	default upgrade;
	'' close;
	}

	map $http_x_forwarded_for $the_real_ip {

	default $remote_addr;

	}

	# trust http_x_forwarded_proto headers correctly indicate ssl offloading
	map $http_x_forwarded_proto $pass_access_scheme {
	default $http_x_forwarded_proto;
	'' $scheme;
	}

	map $http_x_forwarded_port $pass_server_port {
	default $http_x_forwarded_port;
	'' $server_port;
	}

	map $http_x_forwarded_host $best_http_host {
	default $http_x_forwarded_host;
	'' $this_host;
	}

	map $pass_server_port $pass_port {
	443 443;
	default $pass_server_port;
	}

	# Obtain best http host
	map $http_host $this_host {
	default $http_host;
	'' $host;
	}

	server_name_in_redirect off;
	port_in_redirect off;

	ssl_protocols TLSv1.2;

	# turn on session caching to drastically improve performance

	ssl_session_cache builtin:1000 shared:SSL:10m;
	ssl_session_timeout 10m;

	# allow configuring ssl session tickets
	ssl_session_tickets on;

	# slightly reduce the time-to-first-byte
	ssl_buffer_size 4k;

	# allow configuring custom ssl ciphers
	ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
	ssl_prefer_server_ciphers on;

	ssl_ecdh_curve auto;

	proxy_ssl_session_reuse on;

	upstream upstream-default-backend {
	# Load balance algorithm; empty for round robin, which is the default

	least_conn;

	keepalive 32;

	server 10.244.7.45:8000 max_fails=0 fail_timeout=0;

	}

	## start server _
	server {
	server_name _ ;

	listen 80 default_server reuseport backlog=511;

	listen [::]:80 default_server reuseport backlog=511;

	set $proxy_upstream_name "-";

	listen 443 default_server reuseport backlog=511 ssl http2;

	listen [::]:443 default_server reuseport backlog=511 ssl http2;

	# PEM sha: f4e0c71ae16dc74f4d8f71412a5d82a24579f42f
	ssl_certificate /ingress-controller/ssl/default-fake-certificate.pem;
	ssl_certificate_key /ingress-controller/ssl/default-fake-certificate.pem;

	more_set_headers "Strict-Transport-Security: max-age=15724800; includeSubDomains;";

	location / {

	set $proxy_upstream_name "upstream-default-backend";

	set $namespace "";
	set $ingress_name "";
	set $service_name "";

	port_in_redirect off;

	client_max_body_size "64m";

	proxy_set_header Host $best_http_host;

	# Pass the extracted client certificate to the backend

	proxy_set_header ssl-client-cert "";
	proxy_set_header ssl-client-verify "";
	proxy_set_header ssl-client-dn "";

	# Allow websocket connections
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection $connection_upgrade;

	proxy_set_header X-Real-IP $the_real_ip;

	proxy_set_header X-Forwarded-For $the_real_ip;

	proxy_set_header X-Forwarded-Host $best_http_host;
	proxy_set_header X-Forwarded-Port $pass_port;
	proxy_set_header X-Forwarded-Proto $pass_access_scheme;
	proxy_set_header X-Original-URI $request_uri;
	proxy_set_header X-Scheme $pass_access_scheme;

	# Pass the original X-Forwarded-For
	proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;

	# mitigate HTTPoxy Vulnerability
	# https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
	proxy_set_header Proxy "";

	# Custom headers to proxied server

	proxy_connect_timeout 5s;
	proxy_send_timeout 60s;
	proxy_read_timeout 60s;

	proxy_redirect off;

	proxy_buffering off;
	proxy_buffer_size "4k";
	proxy_buffers 4 "4k";
	proxy_request_buffering "on";

	proxy_http_version 1.1;

	proxy_cookie_domain off;
	proxy_cookie_path off;

	# In case of errors try the next upstream server before returning an error
	proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;

	proxy_pass http://upstream-default-backend;

	}

	# health checks in cloud providers require the use of port 80
	location /healthz {
	access_log off;
	return 200;
	}

	# this is required to avoid error if nginx is being monitored
	# with an external software (like sysdig)
	location /nginx_status {
	allow 127.0.0.1;
	allow ::1;
	deny all;

	access_log off;
	stub_status on;
	}

	}
	## end server _

	# default server, used for NGINX healthcheck and access to nginx stats
	server {
	# Use the port 18080 (random value just to avoid known ports) as default port for nginx.
	# Changing this value requires a change in:
	# https://github.com/kubernetes/ingress-nginx/blob/master/controllers/nginx/pkg/cmd/controller/nginx.go
	listen 18080 default_server reuseport backlog=511;
	listen [::]:18080 default_server reuseport backlog=511;
	set $proxy_upstream_name "-";

	location /healthz {
	access_log off;
	return 200;
	}

	location /nginx_status {
	set $proxy_upstream_name "internal";

	access_log off;
	stub_status on;

	}

	location / {

	set $proxy_upstream_name "upstream-default-backend";
	proxy_pass http://upstream-default-backend;
	}

	}
	}

	stream {
	log_format log_stream [$time_local] $protocol $status $bytes_sent $bytes_received $session_time;

	access_log /var/log/nginx/access.log log_stream;

	error_log /var/log/nginx/error.log;

	# TCP services

	# UDP services

	}

Event Timeline

zhuyifei1999 created this paste.Feb 26 2018, 1:45 AM

zhuyifei1999 mentioned this in T163157: Notebook fails to save, throwing "413 Request Entity Too Large" error .Feb 26 2018, 1:48 AM

PAWS nginx.confActivePublicActions

Event Timeline

PAWS nginx.conf
ActivePublic
Actions