nginx-plus.tmpl

user  nginx;
worker_processes  {{.WorkerProcesses}};
{{- if .WorkerRlimitNofile}}
worker_rlimit_nofile {{.WorkerRlimitNofile}};{{end}}
{{- if .WorkerCPUAffinity}}
worker_cpu_affinity {{.WorkerCPUAffinity}};{{end}}
{{- if .WorkerShutdownTimeout}}
worker_shutdown_timeout {{.WorkerShutdownTimeout}};{{end}}

daemon off;

error_log  /var/log/nginx/error.log {{.ErrorLogLevel}};
pid        /var/run/nginx.pid;

{{- if .OpenTracingLoadModule}}
load_module modules/ngx_http_opentracing_module.so;
{{- end}}

{{- if .MainSnippets}}
{{range $value := .MainSnippets}}
{{$value}}{{end}}
{{- end}}

events {
    worker_connections  {{.WorkerConnections}};
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    {{- if .HTTPSnippets}}
    {{range $value := .HTTPSnippets}}
    {{$value}}{{end}}
    {{- end}}

    {{if .LogFormat -}}
    log_format  main  '{{.LogFormat}}';
    {{- else -}}
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    {{- end}}

    {{if .AccessLogOff}}
    access_log off;
    {{else}}
    access_log  /var/log/nginx/access.log  main;
    {{end}}

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout {{.KeepaliveTimeout}};
    keepalive_requests {{.KeepaliveRequests}};

    #gzip  on;

    server_names_hash_max_size {{.ServerNamesHashMaxSize}};
    {{if .ServerNamesHashBucketSize}}server_names_hash_bucket_size {{.ServerNamesHashBucketSize}};{{end}}

    variables_hash_bucket_size {{.VariablesHashBucketSize}};
    variables_hash_max_size {{.VariablesHashMaxSize}};

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    {{if .SSLProtocols}}ssl_protocols {{.SSLProtocols}};{{end}}
    {{if .SSLCiphers}}ssl_ciphers "{{.SSLCiphers}}";{{end}}
    {{if .SSLPreferServerCiphers}}ssl_prefer_server_ciphers on;{{end}}
    {{if .SSLDHParam}}ssl_dhparam {{.SSLDHParam}};{{end}}

    {{if .OpenTracingEnabled}}
    opentracing on;
    {{end}}
    {{if .OpenTracingLoadModule}}
    opentracing_load_tracer {{ .OpenTracingTracer }} /etc/tracer-config.json;
    {{end}}

    {{if .ResolverAddresses}}
    resolver {{range $resolver := .ResolverAddresses}}{{$resolver}}{{end}}{{if .ResolverValid}} valid={{.ResolverValid}}{{end}}{{if not .ResolverIPV6}} ipv6=off{{end}};
    {{if .ResolverTimeout}}resolver_timeout {{.ResolverTimeout}};{{end}}
    {{end}}

    server {
        listen 80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};
        listen 443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};

        ssl_certificate /etc/nginx/secrets/default;
        ssl_certificate_key /etc/nginx/secrets/default;

        server_name _;
        server_tokens "{{.ServerTokens}}";
        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        {{if .HealthStatus}}
        location /nginx-health {
            default_type text/plain;
            return 200 "healthy\n";
        }
        {{end}}

        location / {
           return 404;
        }
    }

    {{- if .NginxStatus}}
    # NGINX Plus APIs
    server {
        listen {{.NginxStatusPort}};

        root /usr/share/nginx/html;

        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        location  = /dashboard.html {
        }
        {{range $value := .NginxStatusAllowCIDRs}}
        allow {{$value}};{{end}}

        deny all;
        location /api {
            api write=off;
        }
    }
    {{- end}}

    # NGINX Plus API over unix socket
    server {
        listen unix:/var/run/nginx-plus-api.sock;
        access_log off;

        {{if .OpenTracingEnabled}}
        opentracing off;
        {{end}}

        # $config_version_mismatch is defined in /etc/nginx/config-version.conf
        location /configVersionCheck {
            if ($config_version_mismatch) {
                return 503;
            }
            return 200;
        }

        location /api {
            api write=on;
        }
    }

    include /etc/nginx/config-version.conf;
    include /etc/nginx/conf.d/*.conf;
}

stream {
    {{if .StreamLogFormat -}}
    log_format  stream-main  '{{.StreamLogFormat}}';
    {{- else -}}
    log_format  stream-main  '$remote_addr [$time_local] '
                      '$protocol $status $bytes_sent $bytes_received '
                      '$session_time';
    {{- end}}

    access_log  /var/log/nginx/stream-access.log  stream-main;

    {{range $value := .StreamSnippets}}
    {{$value}}{{end}}
}