nginx: Add container-based config discovery support

[martavicentenavarro]

What does this PR do?

Adds container-based config discovery support to the nginx integration. When the Datadog Agent detects a container with the nginx AD identifier, it probes the container's exposed ports — starting with port 80 if it is among them — until it finds the nginx status endpoint, then schedules a check against it automatically — no manual conf.yaml needed. HTTPS candidates are generated for ports 443/8443 and for ports named https/ssl/tls; everything else is probed over HTTP. This keeps the check's TLS verification defaults unchanged, so TLS-only nginx discovery is supported when the certificate is trusted by the Agent. Deployments using self-signed or otherwise untrusted certificates are not covered by this PR unless TLS verification is configured separately.

Motivation

DSCVR-509 as part of DSCVR-485. Follows the same pattern established by the krakend integration.

Implementation note — custom discovery strategy: the framework's standard registry strategies (from_ports, openmetrics_from_ports) generate candidates from a single fixed template, which can't vary the nginx_status_url scheme (http/https) per port. Since that scheme depends on which port matched, this PR defines a small custom strategy, local:from_nginx_ports (datadog_checks/nginx/config_models/discovery_strategies.py), that classifies each candidate port as HTTP or HTTPS and yields the matching scheme alongside the port.

Port selection rationale: Port 80 is nginx's default and documented HTTP port. 443/8443 are treated as HTTPS candidates so TLS-only deployments aren't left undiscoverable.

Endpoint: /nginx_status is the standard path for the ngx_http_stub_status_module, used by the integration via the nginx_status_url instance parameter.

Scope: this PR covers the open-source/standard nginx build only, discovered over HTTP or HTTPS depending on the port, and only when the Agent trusts the certificate (see the TLS note above). NGINX Plus is not covered — there's no public Docker image for it to validate against in this repo's e2e setup. Both NGINX Plus support and self-signed/untrusted-certificate discovery are left as possible follow-ups.

docker-compose change: the ${NGINX_CONFIG_FOLDER} mount now has a fallback (${NGINX_CONFIG_FOLDER:-/tmp}). Without one, docker compose ps (called internally by the new test_e2e_discovery_all_candidates test helper) fails when the env var isn't set. The fallback is /tmp (a directory, matching /etc/nginx) rather than /dev/null (a file) to keep the mount types consistent — it's never actually used to run the container, since the real config folder is always passed via env_vars= in the tests.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[datadog-prod-us1-6]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 94.64% (+6.35%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2edb963 | Docs | Datadog PR Page | Give us feedback!}

[Copilot]

Pull request overview

Adds Autodiscovery “configuration discovery” support for the nginx integration so the Agent can auto-schedule the check for containers identified as nginx, without requiring a manual conf.yaml.

Changes:

• Add auto_conf.yaml and spec.yaml discovery stanza to enable container-based config discovery (port-hint 80, /nginx_status).
• Add generated discovery plumbing (config_models/discovery*.py) and an e2e discovery test path.
• Add changelog entry documenting the new discovery support.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
nginx/tests/test_e2e.py	Adds e2e tests for discovery-driven scheduling and candidate stability.
nginx/tests/docker/docker-compose.yaml	Adjusts nginx test container volume wiring.
nginx/tests/conftest.py	Returns e2e discovery metadata so discovery runs can mount auto_conf.yaml into the Agent.
nginx/datadog_checks/nginx/data/auto_conf.yaml	Adds AD template with ad_identifiers: [nginx] and discovery: {}.
nginx/datadog_checks/nginx/config_models/discovery.py	Generated candidate generator for discovery (from ports, builds nginx_status_url).
nginx/datadog_checks/nginx/config_models/discovery_strategies.py	Stub for custom local discovery strategies (generated).
nginx/datadog_checks/nginx/config_models/discovery_overrides.py	Stub hook for overriding/adjusting generated candidates.
nginx/changelog.d/24118.added	Changelog entry for the new discovery capability.
nginx/assets/configuration/spec.yaml	Adds discovery strategy + adds auto_conf.yaml to the integration config spec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9c160ebcc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[vitkyrka]

Putting this as draft for now until we can address the codex comment.

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run