diff --git a/.gitignore b/.gitignore index a60260e..1b07dab 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,8 @@ # Any private crt and keys # ############################ -*.crt -*.key +*-day.crt +*-day.key +nginx-repo.* *~ \#* diff --git a/labs/lab1/media/lab1_none-dataplane-key-delete1.png b/labs/lab1/media/lab1_none-dataplane-key-delete1.png new file mode 100644 index 0000000..c9affe1 Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-delete1.png differ diff --git a/labs/lab1/media/lab1_none-dataplane-key-delete2.png b/labs/lab1/media/lab1_none-dataplane-key-delete2.png new file mode 100644 index 0000000..304bd62 Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-delete2.png differ diff --git a/labs/lab1/media/lab1_none-dataplane-key-new.png b/labs/lab1/media/lab1_none-dataplane-key-new.png new file mode 100644 index 0000000..09c8919 Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-new.png differ diff --git a/labs/lab1/media/lab1_none-dataplane-key-overview.png b/labs/lab1/media/lab1_none-dataplane-key-overview.png new file mode 100644 index 0000000..fd02faa Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-overview.png differ diff --git a/labs/lab1/media/lab1_none-dataplane-key-revoke-list.png b/labs/lab1/media/lab1_none-dataplane-key-revoke-list.png new file mode 100644 index 0000000..828bf37 Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-revoke-list.png differ diff --git a/labs/lab1/media/lab1_none-dataplane-key-revoke1.png b/labs/lab1/media/lab1_none-dataplane-key-revoke1.png new file mode 100644 index 0000000..e4b922b Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-revoke1.png differ diff --git a/labs/lab1/media/lab1_none-dataplane-key-revoke2.png b/labs/lab1/media/lab1_none-dataplane-key-revoke2.png new file mode 100644 index 0000000..c529ac0 Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-revoke2.png differ diff --git a/labs/lab1/media/lab1_none-dataplane-key-save.png b/labs/lab1/media/lab1_none-dataplane-key-save.png new file mode 100644 index 0000000..8bf3d5c Binary files /dev/null and b/labs/lab1/media/lab1_none-dataplane-key-save.png differ diff --git a/labs/lab1/media/lab1_none-empty-overview-dashboard.png b/labs/lab1/media/lab1_none-empty-overview-dashboard.png new file mode 100644 index 0000000..fc2315c Binary files /dev/null and b/labs/lab1/media/lab1_none-empty-overview-dashboard.png differ diff --git a/labs/lab1/media/lab1_none-overview-dashboard.png b/labs/lab1/media/lab1_none-overview-dashboard.png new file mode 100644 index 0000000..2d66e04 Binary files /dev/null and b/labs/lab1/media/lab1_none-overview-dashboard.png differ diff --git a/labs/lab1/media/lab1_none-service.png b/labs/lab1/media/lab1_none-service.png new file mode 100644 index 0000000..8d41ca3 Binary files /dev/null and b/labs/lab1/media/lab1_none-service.png differ diff --git a/labs/lab1/media/lab1_none-tile.png b/labs/lab1/media/lab1_none-tile.png new file mode 100644 index 0000000..f7e9de3 Binary files /dev/null and b/labs/lab1/media/lab1_none-tile.png differ diff --git a/labs/lab1/media/lab1_xc-login.png b/labs/lab1/media/lab1_xc-login.png new file mode 100644 index 0000000..156cdf0 Binary files /dev/null and b/labs/lab1/media/lab1_xc-login.png differ diff --git a/labs/lab1/media/nginx-agent-icon.png b/labs/lab1/media/nginx-agent-icon.png new file mode 100644 index 0000000..1af3346 Binary files /dev/null and b/labs/lab1/media/nginx-agent-icon.png differ diff --git a/labs/lab1/media/nginx-one-icon.png b/labs/lab1/media/nginx-one-icon.png new file mode 100644 index 0000000..acca29f Binary files /dev/null and b/labs/lab1/media/nginx-one-icon.png differ diff --git a/labs/lab1/readme.md b/labs/lab1/readme.md new file mode 100644 index 0000000..f3da673 --- /dev/null +++ b/labs/lab1/readme.md @@ -0,0 +1,132 @@ +# NGINX One Console Introduction & Access + +## Introduction + +In this lab, you will be logging into NGINX One Console and exploring various components within it. This lab requires that you have access to F5 Distributed Cloud to work with the One Console. As part of this lab, you will explore the NGINX One console product, as a quick Overview of what it is and how to access it. + +
+ +## Learning Objectives + +By the end of the lab you will be able to: + +- [Understand NGINX One Console product](#nginx-one-console-introduction) +- [Access and navigate NGINX One Console](#access-and-navigate-nginx-one-console) +- [Create and manage data plane keys that would be used to manage NGINX instances](#create-and-manage-data-plane-keys-that-would-be-used-to-manage-nginx-instances) + +## Prerequisites + +- You must have an F5 Distributed Cloud(XC) Account +- You must have enabled NGINX One service on F5 Distributed Cloud(XC) +- See `Lab0` for instructions on setting up your system for this Workshop +- Familiarity with basic Linux concepts and commands +- Familiarity with basic NGINX concepts and commands + +
+ +### NGINX One Console Introduction + +![NGINX One](media/nginx-one-icon.png) + +The F5 NGINX One Console is a service which is part of the F5 Distributed Cloud, gives all NGINX users access to a SaaS experience for managing NGINX instances. The console lets you monitor and control your NGINX fleet from one place. You can check configurations, track performance metrics, identify security vulnerabilities, manage SSL certificates, and more. + +The NGINX One Console is valuable because it simplifies the complexities of modern application delivery by integrating multiple functionalities into a single platform. This reduces the need for disparate tools, lowers operational overhead and costs, and ensures robust security for your applications. You will be able to accelerate application delivery and time-to-value like never before with SaaS capabilities. + +NGINX One Console offers the following key benefits: + +- **Centralized control:** Manage all your NGINX instances from a single console. +- **Enhanced monitoring and risk detection:** Automatically detect critical vulnerabilities (CVEs), verify SSL certificate statuses, and identify security issues in NGINX configurations. +- **Performance optimization:** Track your NGINX versions and receive recommendations for tuning your configurations for better performance. +- **Graphical Metrics Display:** Access a dashboard that shows key metrics for your NGINX instances, including instance availability, version distribution, system health, and utilization trends. +- **Real-time alerts:** Receive alerts about critical issues. + +### How it works + +![NGINX Agent](media/nginx-agent-icon.png) + +The NGINX One Console requires `NGINX Agent`, an open source software module written by NGINX that connects and communicates with NGINX One. This NGINX Agent must be installed and running on every NGINX instance that you wish to manage with NGINX One. You will use the publicly available NGINX with Agent images from Docker Hub for your NGINX OSS containers. In addition, as part of your Docker Compose file, your NGINX Plus containers already have the required `NGINX Agent` installed for you. NGINX Agent can also be installed using regular Linux package managers like `apt` and `yum`. Refer to the References Section for links to the NGINX Agent installation guides. + +### Access and navigate NGINX One console + +1. Login into the F5 Distributed Cloud console using your account credentials. The login page can be found at: https://console.ves.volterra.io/login/start + + ![XC Login](media/lab1_xc-login.png) + +1. Once logged in, the "home" screen shows you various tiles which represent F5 Distributed Cloud console features. In this lab, we'll focus on the `NGINX One` console tile as highlighted in the below screenshot. + + ![XC HomeScreen](media/lab1_none-tile.png) + +1. Click on the `NGINX One` tile from the home screen. The NGINX One "welcome" screen will appear. Make sure the NGINX One Console status shows `green - Enabled` as highlighted in below screenshot. Click on `Visit Service`. If it is not enabled, you must request access from your F5 Distributed Cloud admin. + + ![N One Visit Service](media/lab1_none-service.png) + +1. By default, this will bring you to the NGINX One Console `Overview Dashboard` page. As no NGINX Instances are being managed by NGINX One you are seeing the blank dashboard as shown in below screenshot. + + ![Empty Dashboard](media/lab1_none-empty-overview-dashboard.png) + + Once you add different NGINX Instance in the next section, this Dashboard would get populated by useful insights as depicted in below sample dashboard screenshot. + + ![Sample Overview Dashboard](media/lab1_none-overview-dashboard.png) + +
+ +### Create and manage data plane keys that would be used to manage NGINX instances + +1. Within the NGINX One Console, click on `Manage > Data Plane Keys`. This would show all the Data Plane keys that you currently have. + + ![Dataplane key](media/lab1_none-dataplane-key-overview.png) + +1. Click on `Add Data Plane Key` to create a new Dataplane key. This should open an `Add Data Plane Key` window. Provide a name of your choice for the new key. By default, the expiration date is set for a year. You can modify the expiration data as per your preference or keep the defaults for this workshop. Click on `Generate` to create your new key. + + ![New Dataplane key](media/lab1_none-dataplane-key-new.png) + + Once the key is generated, copy the value of this key to the clipboard using the `Copy` icon on the right side. **NOTE:** This Dataplane Key is only shown here and NGINX One doesn't save this value. Save this value locally as you would be using it to register new NGINX Instances. You can Register as many NGINX Instances as you like with the same Dataplane Key. If you lose the value of the key then you need to generate a new one again. + + ![New Dataplane key save](media/lab1_none-dataplane-key-save.png) + +1. Once you have saved the key locally for future use, click the `Close` button to finish the Data plane key creation process. + +
+ +### (Optional Exercise): Revoke a data plane key + +1. To revoke the data plane key, search the key that you would like to revoke within the Data Plane Keys Page and then click on the key. This should open a new overlay window on the right side as shown in below screenshot. Click on `Revoke` button. In the next confirmation window, again click on `Revoke` button to disable the data plane key. + + ![Revoke Dataplane Key](media/lab1_none-dataplane-key-revoke1.png) + ![Confirm Revoke](media/lab1_none-dataplane-key-revoke2.png) + +### (Optional Exercise): Delete a data plane key + +1. Active keys cannot be directly deleted. The key must first be revoked and then can be deleted. + +1. You can delete a revoked data plane key by opening the Data Plane Keys Page and then navigating to the `Revoked Keys` tab. This view should list all the revoked keys. + + ![Revoke key list](media/lab1_none-dataplane-key-revoke-list.png) + + To delete a particular revoked key, select the key and then click on `Delete Selected` button. In the next confirmation window, again click on `Delete` button to delete the data plane key. + + ![Delete key](media/lab1_none-dataplane-key-delete1.png) + ![Delete key confirmation](media/lab1_none-dataplane-key-delete2.png) + +
+ +This ends lab1. + +
+ +## References: + +- [NGINX One Console](https://docs.nginx.com/nginx-one/) +- [NGINX Agent](https://docs.nginx.com/nginx-agent/overview/) + +
+ +### Authors + +- Chris Akker - Solutions Architect - Community and Alliances @ F5, Inc. +- Shouvik Dutta - Solutions Architect - Community and Alliances @ F5, Inc. +- Adam Currier - Solutions Architect - Community and Alliances @ F5, Inc. + +------------- + +Navigate to ([Lab2](../lab2/readme.md) | [LabGuide](../readme.md)) diff --git a/labs/lab2/docker-compose.yml b/labs/lab2/docker-compose.yml new file mode 100644 index 0000000..bbe3679 --- /dev/null +++ b/labs/lab2/docker-compose.yml @@ -0,0 +1,164 @@ +# NGINX Plus / OSS with NGINX Agent +# NGINX webservers with ingress-demo pages +# NGINX One Console Instance Registration +# NGINX Basics, Dec 2024 +# Chris Akker, Shouvik Dutta, Adam Currier +# +services: + basics-plus1: # Alpine NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com" + NGINX_AGENT_SERVER_GRPCPORT: "443" + NGINX_AGENT_TLS_ENABLE: "true" + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron basics- One Console +# NGINX_AGENT_INSTANCE_GROUP: basics-workshop-plus + hostname: basics-plus1 + container_name: basics-plus1 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r32-alpine-3.20-20240613 # CVE - From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - 80:80 # Open for HTTP + - 443:443 # Open for HTTPS + - 9000:9000 # Open for stub status page + - 9113:9113 # Open for Prometheus Scraper page + restart: always + # + basics-plus2: # Alpine NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com" + NGINX_AGENT_SERVER_GRPCPORT: "443" + NGINX_AGENT_TLS_ENABLE: "true" + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console +# NGINX_AGENT_INSTANCE_GROUP: basics-workshop-plus + hostname: basics-plus2 + container_name: basics-plus2 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-alpine-3.19-20240522 # CVE - From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - "80" # Open for HTTP + - "443" # Open for HTTPS + - "9000" # Open for API / Dashboard page + - "9113" # Open for Prometheus Scraper page + restart: always + # + basics-plus3: # RHEL UBI NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com" + NGINX_AGENT_SERVER_GRPCPORT: "443" + NGINX_AGENT_TLS_ENABLE: "true" + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console +# NGINX_AGENT_INSTANCE_GROUP: basics-workshop-plus + hostname: basics-plus3 + container_name: basics-plus3 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-ubi-9-20240522 # From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - "80" # Open for HTTP + - "443" # Open for HTTPS + - "9000" # Open for API / Dashboard page + - "9113" # Open for Prometheus Scraper page + restart: always + # + basics-oss1: # Debian NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com" + NGINX_AGENT_SERVER_GRPCPORT: "443" + NGINX_AGENT_TLS_ENABLE: "true" + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: basics-oss1 + container_name: basics-oss1 + image: docker-registry.nginx.com/nginx/agent:mainline # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - "80" # Open for HTTP + - "443" # Open for HTTPS + - "9000" # Open for stub status page + - "9113" # Open for Prometheus Scraper page + restart: always + # + basics-oss2: # Alpine NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com" + NGINX_AGENT_SERVER_GRPCPORT: "443" + NGINX_AGENT_TLS_ENABLE: "true" + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: basics-oss2 + container_name: basics-oss2 + image: docker-registry.nginx.com/nginx/agent:alpine # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - "80" # Open for HTTP + - "443" # Open for HTTPS + - "9000" # Open for stub status page + - "9113" # Open for Prometheus Scraper page + restart: always + # + basics-oss3: # Older Alpine NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: "agent.connect.nginx.com" + NGINX_AGENT_SERVER_GRPCPORT: "443" + NGINX_AGENT_TLS_ENABLE: "true" + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: basics-oss3 + container_name: basics-oss3 + image: docker-registry.nginx.com/nginx/agent:1.26-alpine # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - "80" # Open for HTTP + - "443" # Open for HTTPS + - "9000" # Open for stub status page + - "9113" # Open for Prometheus Scraper page + restart: always + # + web1: + hostname: web1 + container_name: web1 + platform: linux/amd64 + image: nginxinc/ingress-demo # Image from Docker Hub + ports: + - "80" # Open for HTTP + - "443" # Open for HTTPS + web2: + hostname: web2 + container_name: web2 + platform: linux/amd64 + image: nginxinc/ingress-demo + ports: + - "80" + - "433" + web3: + hostname: web3 + container_name: web3 + platform: linux/amd64 + image: nginxinc/ingress-demo + ports: + - "80" + - "443" + diff --git a/labs/lab2/generate_certs.sh b/labs/lab2/generate_certs.sh new file mode 100644 index 0000000..301b896 --- /dev/null +++ b/labs/lab2/generate_certs.sh @@ -0,0 +1,4 @@ +echo "Generate 1-day cert." +openssl req -x509 -nodes -days 1 -newkey rsa:2048 -keyout nginx-oss/etc/ssl/nginx/1-day.key -out nginx-oss/etc/ssl/nginx/1-day.crt -subj "/CN=NginxPlusBasics" +echo "Generate 30-day cert." +openssl req -x509 -nodes -days 30 -newkey rsa:2048 -keyout nginx-oss/etc/ssl/nginx/30-day.key -out nginx-oss/etc/ssl/nginx/30-day.crt -subj "/CN=NginxPlusBasics" \ No newline at end of file diff --git a/labs/lab2/media/docker-icon.png b/labs/lab2/media/docker-icon.png new file mode 100644 index 0000000..02ee3f1 Binary files /dev/null and b/labs/lab2/media/docker-icon.png differ diff --git a/labs/lab2/media/lab2_docker-pulling.png b/labs/lab2/media/lab2_docker-pulling.png new file mode 100644 index 0000000..3e2166f Binary files /dev/null and b/labs/lab2/media/lab2_docker-pulling.png differ diff --git a/labs/lab2/media/lab2_none-instances.png b/labs/lab2/media/lab2_none-instances.png new file mode 100644 index 0000000..66567bb Binary files /dev/null and b/labs/lab2/media/lab2_none-instances.png differ diff --git a/labs/lab2/media/nginx-icon.png b/labs/lab2/media/nginx-icon.png new file mode 100644 index 0000000..5997bd0 Binary files /dev/null and b/labs/lab2/media/nginx-icon.png differ diff --git a/labs/lab2/media/nginx-plus-icon.png b/labs/lab2/media/nginx-plus-icon.png new file mode 100644 index 0000000..23eb5e5 Binary files /dev/null and b/labs/lab2/media/nginx-plus-icon.png differ diff --git a/labs/lab2/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf b/labs/lab2/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf new file mode 100644 index 0000000..3af7071 --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf @@ -0,0 +1,27 @@ +# cafe.example.com HTTP +server { + # Listening on port 80 on all IP addresses on this machine + listen 80; + + server_name cafe.example.com; + + # status_zone cafe-VirtualServer; + + # Server specific logging + access_log /var/log/nginx/cafe.example.com.log main_ext; + error_log /var/log/nginx/cafe.example.com_error.log info; + + location / { + + proxy_buffering off; + + # Including best-practice headers are bonus points + include includes/proxy_headers.conf; + include includes/keepalive.conf; + + # status_zone /; + + proxy_pass http://nginx_cafe; + } + +} diff --git a/labs/lab2/nginx-oss/etc/nginx/conf.d/stub_status.conf b/labs/lab2/nginx-oss/etc/nginx/conf.d/stub_status.conf new file mode 100644 index 0000000..8869acd --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/conf.d/stub_status.conf @@ -0,0 +1,19 @@ +# ngx_http_stub_status_module (Available in NGINX OSS) +# provides Basic Status information http://nginx.org/en/docs/http/ngx_http_stub_status_module.html + +server { + listen 9000 ssl; # Listener for Stub Status + + ssl_certificate /etc/ssl/nginx/30-day.crt; + ssl_certificate_key /etc/ssl/nginx/30-day.key; + + location /basic_status { + stub_status; + } + + # Redirect requests for "/" to "/basic_status" + location / { + return 301 /basic_status; + } + +} \ No newline at end of file diff --git a/labs/lab2/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf b/labs/lab2/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf new file mode 100644 index 0000000..89c78de --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf @@ -0,0 +1,54 @@ +# cars.example.com HTTP/HTTPS +# NGINX Basics Workshop +# Nov 2024, Chris Akker, Shouvik Dutta, Adam Currier +# +server { + + listen 443 ssl; # Uncomment to change to port 443, add "ssl" parameter for terminating TLS on all IP addresses on this machine + + server_name cars.example.com; # Set hostname to match in request + +# Update the following lines for NGINX cert and key directives and file locations + + ssl_certificate /etc/ssl/nginx/cars.crt; + ssl_certificate_key /etc/ssl/nginx/cars.key; + + ssl_protocols TLSv1.1 TLSv1.3; + ssl_ciphers HIGH:!aNULL:3DES; + ssl_prefer_server_ciphers on; + + access_log /var/log/nginx/cars.example.com.log main; + + error_log /var/log/nginx/cars.example.com_error.log info; + + root /usr/share/nginx/html; # Set the root folder for the HTML and JPG files + + location / { + + default_type text/html; + return 200 "Let's go fast, you have reached cars.example.com, path $uri\n"; + } + + location /gtr { + + try_files $uri $uri.html; # Look for filename that matches the URI requested + } + + location /nsx { + + try_files $uri $uri.html; + } + + location /rcf { + + try_files $uri $uri.html; + } + + location /browse { # new URL path + + alias /usr/share/nginx/html; # Browse this folder + index index.html; # Use this file, but if it does *not* exist + autoindex on; # Perform directory/file browsing + } + +} diff --git a/labs/lab2/nginx-oss/etc/nginx/conf.d/upstreams.conf b/labs/lab2/nginx-oss/etc/nginx/conf.d/upstreams.conf new file mode 100644 index 0000000..8570729 --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/conf.d/upstreams.conf @@ -0,0 +1,34 @@ +# NGINX Basics, Plus Proxy to three upstream NGINX containers +# Nov 2024 - Chris Akker, Shouvik Dutta, Adam Currier +# nginx_cafe servers +# +upstream nginx_cafe { # Upstream block, the name is "nginx_cafe" + + # Uncomment the zone directive below to add metrics to the Dashboard + # zone nginx_cafe 256k; + + # Load Balancing Algorithms supported by NGINX + # - Round Robin (Default if nothing specified) + # - Least Connections + # - IP Hash + # - Hash (Any generic Hash) + + # Load Balancing Algorithms supported by NGINX Plus + # - Least Time Last Byte / Header + # - Random Two + + # Uncomment for Least-Time Last-Byte algorithm + # least_time last_byte; + + # From Docker-Compose: + server web1:80; + server web2:80; + server web3:80; + + # Uncomment for Cookie persistence + # sticky cookie srv_id expires=1m domain=.example.com path=/; + + # Uncomment for keepalive TCP connections to upstreams + keepalive 16; + +} \ No newline at end of file diff --git a/labs/lab2/nginx-oss/etc/nginx/includes/keepalive.conf b/labs/lab2/nginx-oss/etc/nginx/includes/keepalive.conf new file mode 100644 index 0000000..a9fbcf4 --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/includes/keepalive.conf @@ -0,0 +1,9 @@ +# Default is HTTP/1, keepalive is only enabled in HTTP/1.1 +proxy_http_version 1.1; + +# Remove the Connection header if the client sends it, +# it could be "close" to close a keepalive connection +proxy_set_header Connection ""; + +# Host request header field, or the server name matching a request +proxy_set_header Host $host; \ No newline at end of file diff --git a/labs/lab2/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf b/labs/lab2/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf new file mode 100644 index 0000000..296ea7b --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf @@ -0,0 +1,20 @@ +# Extended Log Format +# Nginx Basics +log_format main_ext 'remote_addr="$remote_addr", ' + '[time_local=$time_local], ' + 'request="$request", ' + 'status="$status", ' + 'http_referer="$http_referer", ' + 'body_bytes_sent="$body_bytes_sent", ' + 'Host="$host", ' + 'sn="$server_name", ' + 'request_time=$request_time, ' + 'http_user_agent="$http_user_agent", ' + 'http_x_forwarded_for="$http_x_forwarded_for", ' + 'request_length="$request_length", ' + 'upstream_address="$upstream_addr", ' + 'upstream_status="$upstream_status", ' + 'upstream_connect_time="$upstream_connect_time", ' + 'upstream_header_time="$upstream_header_time", ' + 'upstream_response_time="$upstream_response_time", ' + 'upstream_response_length="$upstream_response_length", '; diff --git a/labs/lab2/nginx-oss/etc/nginx/includes/proxy_headers.conf b/labs/lab2/nginx-oss/etc/nginx/includes/proxy_headers.conf new file mode 100644 index 0000000..23a83d1 --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/includes/proxy_headers.conf @@ -0,0 +1,12 @@ +## Set Headers to the proxied servers ## + +# client address in a binary form, value’s length is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses +proxy_set_header X-Real-IP $remote_addr; + +# X-Forwarded-For client request header field with the $remote_addr variable appended to it, +# separated by a comma. If the “X-Forwarded-For” field is not present in the client request header, +# the $proxy_add_x_forwarded_for variable is equal to the $remote_addr variable. +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + +# request scheme, “http” or “https” +proxy_set_header X-Forwarded-Proto $scheme; \ No newline at end of file diff --git a/labs/lab2/nginx-oss/etc/nginx/nginx.conf b/labs/lab2/nginx-oss/etc/nginx/nginx.conf new file mode 100644 index 0000000..a3b502b --- /dev/null +++ b/labs/lab2/nginx-oss/etc/nginx/nginx.conf @@ -0,0 +1,33 @@ +user nginx; +worker_processes 1; + +error_log /var/log/nginx/error.log info; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + include /etc/nginx/includes/log_formats/*.conf; # Custom Access logs formats found here + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; + +} diff --git a/labs/lab2/nginx-oss/etc/ssl/nginx/cars.crt b/labs/lab2/nginx-oss/etc/ssl/nginx/cars.crt new file mode 100644 index 0000000..4eb6334 --- /dev/null +++ b/labs/lab2/nginx-oss/etc/ssl/nginx/cars.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDFTCCAf2gAwIBAgIUEQHIC+pN7UA+PwpufAGW4sFczqowDQYJKoZIhvcNAQEL +BQAwGjEYMBYGA1UEAwwPTmdpbnhQbHVzQmFzaWNzMB4XDTI1MDEwMjIyMDY0OVoX +DTI1MDEwMzIyMDY0OVowGjEYMBYGA1UEAwwPTmdpbnhQbHVzQmFzaWNzMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA17iXl8xC2AApcMaoPEu5w42U++ai +ZPPtgEoDGE/tgNZmWwHsmfdkKbhvcFX8vLwI1OD+mKPW0RcB56x0I29KRk8HGwwX +XXUuALmWuYVYNE71O2cBE/8JpgLlFgkbjYyFZekQeyb9QHeYxI47vCQqptBzQoCx +Bs/zi4lh+wgRYyXmHdTQ60183Gvxs4ujIDWnOC4/PGLr/ZLjySyBDM4+rtoz5xia +HZVBFA8HINTz4vjMkP1zrN4RsgSQQop8vuxlZsLlJCSWDMgkidu/uCvXxo+gHLMs +nrvDloEJuU1zx2va4i0e8Zr/eV/zVRIghKx9g/mBFFPnEdu0x7B48EfTnwIDAQAB +o1MwUTAdBgNVHQ4EFgQUDQzkk+0qMyn/nczCV7vJVlpFLnAwHwYDVR0jBBgwFoAU +DQzkk+0qMyn/nczCV7vJVlpFLnAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B +AQsFAAOCAQEAWXBbXqEckARXPGQtasa5+uVqwokH4TJwbnQLfZsQV766OltS4Bv/ +MFDqmFxFLvsuM2jf1vodtJTq+cuUWtn1o+0MCDFWy3lTifk0wpQyg3xF6boHdBi4 +oGFKn7oPwWaTU8yjJzbvH6A5mfjO57YklAXlmZwWsEylsgR9D9jPTUkX82P+8Ad6 +UjWmFsopTwjit1rBAnBOL/oIGl2IFE5L4Vv8tcFsfpDGpCK/h9D3G25uQY36c0av +Q10lfV2+1eTQz//In+Li8zgGZa+XHtCxFPCEdcFQeEF3VkefgN7aL8qxmPgmSrqd +P13gMgo7HwFPoxvuUD3vN2DKIeqfa/H7Mg== +-----END CERTIFICATE----- diff --git a/labs/lab2/nginx-oss/etc/ssl/nginx/cars.key b/labs/lab2/nginx-oss/etc/ssl/nginx/cars.key new file mode 100644 index 0000000..3777400 --- /dev/null +++ b/labs/lab2/nginx-oss/etc/ssl/nginx/cars.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDXuJeXzELYAClw +xqg8S7nDjZT75qJk8+2ASgMYT+2A1mZbAeyZ92QpuG9wVfy8vAjU4P6Yo9bRFwHn +rHQjb0pGTwcbDBdddS4AuZa5hVg0TvU7ZwET/wmmAuUWCRuNjIVl6RB7Jv1Ad5jE +jju8JCqm0HNCgLEGz/OLiWH7CBFjJeYd1NDrTXzca/Gzi6MgNac4Lj88Yuv9kuPJ +LIEMzj6u2jPnGJodlUEUDwcg1PPi+MyQ/XOs3hGyBJBCiny+7GVmwuUkJJYMyCSJ +27+4K9fGj6Acsyyeu8OWgQm5TXPHa9riLR7xmv95X/NVEiCErH2D+YEUU+cR27TH +sHjwR9OfAgMBAAECggEAGspO8UgpyP+EJgBV5l8VK+cKaJpE8rqkdTk71yod+dEm +lwjPJHPn2ZKRLGdRYvMLObzTgYtfY0ozL11ocvogREkOPdqrkCy8UNS7lkCsKprf +s8fgB2a2AQr8/laVOGgKLRTbuh+mdfokW8y6OGxZa6wZlFm9InZy7ZJbO7zNw/03 +jkAnDAzcAD4T9AgbR0zCVrRxehR6wGR220VWG8kw6gXswBvGvQaVAnwmjlTrh3pp +EhZGC+iZ2el05JfGw6MlM7g6NKBK18KgrGYkhvKiML7BsOJPJD0vMId1jiVsejJR +9xaPoBEaeTOLVWFisBfO5EZtkSZPF7nHwZGHSqZvoQKBgQDttK94ItRS33Uv/HAk +2W+WKGSagSJeqHG9Hi3DEVLPE355QsOxgx/3h5EXnqHRVnu+CXqMHqEhf9afUZsJ +0iMYVShYYELauRhcL8+XSrg+jFXp7Tvokv4XVbkwUyFnY+fM+coQ1rvamd5+1deX +x1x629e/QtOtnaqkuvr9Xn8ArwKBgQDoUsKa3Eq8rx0vzI6KV4F6WncShObiKqkV +0TR79SaNawT0vEhdDOhHuO5BNaiOI3+mbx/CRwnVedIicoi99cDgZrQPncaisnkC +KZVcQpNMoFM8+ZYGyeYDo86sBi05WQRI/vxGKrOIUcaSsdieBLpS3E2btcNGkaLY +pilcnRW4EQKBgQC2rR4QaEvd6GbJ2ulgGE3eCurNpiIAtti56wBmIeEOzL9sdzen +KssdUmzZxwo6s4jjUauBFWTlNrZ8t507XeekooUf7dJS/t5OsluJvF19jCHWZX+d +y6FD05g/IBPSvf99EhYM/MlfRNKtjK9jsE1NCbhy/utoSHvEnwGWR9G4dwKBgQCa +fbZ1frqgYJ67E39SVcB/WbtG8GQM0Cuim30YVTyu3BTunmpMnnG0iDC/4mvVIZwY +VFs9OTo74IexapKuJ8d8Mi/ZFqVpud8oZfix4n/Le+3+ZUaz+vzfPMYJtQ3LzftA +g3fFPU4n/6FaGbQf2KsCwQdG3Yce3Wf6Q/zLXpZ70QKBgEseUKnmYKvFjmyVdO94 +nesTUuu7DITx4M7I3ssdKz/9KdqjmnVQn3yiNEEHEvItvKEZvFMAKB7uJFmY/oGr +5DvP29lsr45FDTz2UWElz/LhsOkSBzRYQpXDkuaCl+lz7YE76S6F45vAy7RSY8TU ++57833tZa5uHl5GKhytuhGyQ +-----END PRIVATE KEY----- diff --git a/labs/lab2/nginx-oss/usr/share/nginx/html/gtr.html b/labs/lab2/nginx-oss/usr/share/nginx/html/gtr.html new file mode 100644 index 0000000..1b1bdfc --- /dev/null +++ b/labs/lab2/nginx-oss/usr/share/nginx/html/gtr.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx GTR ! + + + +

Welcome to nginx GTR !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +GTR + +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-oss/usr/share/nginx/html/gtr.jpg b/labs/lab2/nginx-oss/usr/share/nginx/html/gtr.jpg new file mode 100644 index 0000000..be39ffe Binary files /dev/null and b/labs/lab2/nginx-oss/usr/share/nginx/html/gtr.jpg differ diff --git a/labs/lab2/nginx-oss/usr/share/nginx/html/index.html b/labs/lab2/nginx-oss/usr/share/nginx/html/index.html new file mode 100644 index 0000000..5d2b304 --- /dev/null +++ b/labs/lab2/nginx-oss/usr/share/nginx/html/index.html @@ -0,0 +1,24 @@ + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-oss/usr/share/nginx/html/nsx.html b/labs/lab2/nginx-oss/usr/share/nginx/html/nsx.html new file mode 100644 index 0000000..fc1de05 --- /dev/null +++ b/labs/lab2/nginx-oss/usr/share/nginx/html/nsx.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx NSX ! + + + +

Welcome to nginx NSX !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +NSX + +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-oss/usr/share/nginx/html/nsx.jpg b/labs/lab2/nginx-oss/usr/share/nginx/html/nsx.jpg new file mode 100644 index 0000000..f3c27f5 Binary files /dev/null and b/labs/lab2/nginx-oss/usr/share/nginx/html/nsx.jpg differ diff --git a/labs/lab2/nginx-oss/usr/share/nginx/html/rcf.html b/labs/lab2/nginx-oss/usr/share/nginx/html/rcf.html new file mode 100644 index 0000000..468ddae --- /dev/null +++ b/labs/lab2/nginx-oss/usr/share/nginx/html/rcf.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx RCF ! + + + +

Welcome to nginx RCF !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +RCF + +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-oss/usr/share/nginx/html/rcf.jpg b/labs/lab2/nginx-oss/usr/share/nginx/html/rcf.jpg new file mode 100644 index 0000000..40faef6 Binary files /dev/null and b/labs/lab2/nginx-oss/usr/share/nginx/html/rcf.jpg differ diff --git a/labs/lab2/nginx-plus/etc/nginx/conf.d/cafe.example.com.conf b/labs/lab2/nginx-plus/etc/nginx/conf.d/cafe.example.com.conf new file mode 100644 index 0000000..a770dba --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/conf.d/cafe.example.com.conf @@ -0,0 +1,37 @@ +# cafe.example.com HTTP +server { + # Listening on port 80 on all IP addresses on this machine + listen 80; + + server_name cafe.example.com; + + status_zone cafe-VirtualServer; + + # Server specific logging + access_log /var/log/nginx/cafe.example.com.log main_ext; + error_log /var/log/nginx/cafe.example.com_error.log info; + + location / { + + # Including best-practice headers are bonus points + include includes/proxy_headers.conf; + include includes/keepalive.conf; + + status_zone /; + + proxy_pass http://nginx_cafe; + } + + # Active Healthchecks + location @health_check { + internal; # Requests by NGINX only + proxy_set_header Host cafe.example.com; + proxy_pass http://nginx_cafe; + health_check interval=5s fails=3 passes=2 uri=/ match=status_ok; + + # Health check logs are boring but errors are interesting + # access_log /var/log/nginx/health_check.log main; + access_log off; + error_log /var/log/nginx/error.log error; + } +} diff --git a/labs/lab2/nginx-plus/etc/nginx/conf.d/dashboard.conf b/labs/lab2/nginx-plus/etc/nginx/conf.d/dashboard.conf new file mode 100644 index 0000000..3b1ace3 --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/conf.d/dashboard.conf @@ -0,0 +1,24 @@ +# NGINX Plus Basics, Nov 2024 +# Chris Akker, Shouvik Dutta, Adam Currier +# dashboard.conf +# +server { + # Conventional port for the NGINX Plus API is 8080 + listen 9000; + access_log off; # reduce noise in access logs + + location /api/ { + # Enable in read-write mode + api write=on; + } + # Conventional location of the NGINX Plus dashboard + location = /dashboard.html { + root /usr/share/nginx/html; + } + + # Redirect requests for "/" to "/dashboard.html" + location / { + return 301 /dashboard.html; + } +} + \ No newline at end of file diff --git a/labs/lab2/nginx-plus/etc/nginx/conf.d/status_ok.conf b/labs/lab2/nginx-plus/etc/nginx/conf.d/status_ok.conf new file mode 100644 index 0000000..adc6bbe --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/conf.d/status_ok.conf @@ -0,0 +1,5 @@ +# Simple health check expecting http 200 and correct Content-Type +match status_ok { + status 200; + header Content-Type = "text/html; charset=utf-8"; # For the nginx-cafe html +} \ No newline at end of file diff --git a/labs/lab2/nginx-plus/etc/nginx/conf.d/upstreams.conf b/labs/lab2/nginx-plus/etc/nginx/conf.d/upstreams.conf new file mode 100644 index 0000000..9879cf6 --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/conf.d/upstreams.conf @@ -0,0 +1,34 @@ +# NGINX Basics, Plus Proxy to three upstream NGINX containers +# Nov 2024 - Chris Akker, Shouvik Dutta, Adam Currier +# nginx_cafe servers +# +upstream nginx_cafe { # Upstream block, the name is "nginx_cafe" + + # Uncomment the zone directive below to add metrics to the Dashboard + zone nginx_cafe 256k; + + # Load Balancing Algorithms supported by NGINX + # - Round Robin (Default if nothing specified) + # - Least Connections + # - IP Hash + # - Hash (Any generic Hash) + + # Load Balancing Algorithms supported by NGINX Plus + # - Least Time Last Byte / Header + # - Random Two + + # Uncomment for Least-Time Last-Byte algorithm + least_time last_byte; + + # From Docker-Compose: + server web1:80; + server web2:80; + server web3:80; + + # Uncomment for Cookie persistence + # sticky cookie srv_id expires=1m domain=.example.com path=/; + + # Uncomment for keepalive TCP connections to upstreams + keepalive 16; + +} \ No newline at end of file diff --git a/labs/lab2/nginx-plus/etc/nginx/includes/keepalive.conf b/labs/lab2/nginx-plus/etc/nginx/includes/keepalive.conf new file mode 100644 index 0000000..a9fbcf4 --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/includes/keepalive.conf @@ -0,0 +1,9 @@ +# Default is HTTP/1, keepalive is only enabled in HTTP/1.1 +proxy_http_version 1.1; + +# Remove the Connection header if the client sends it, +# it could be "close" to close a keepalive connection +proxy_set_header Connection ""; + +# Host request header field, or the server name matching a request +proxy_set_header Host $host; \ No newline at end of file diff --git a/labs/lab2/nginx-plus/etc/nginx/includes/log_formats/main_ext.conf b/labs/lab2/nginx-plus/etc/nginx/includes/log_formats/main_ext.conf new file mode 100644 index 0000000..296ea7b --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/includes/log_formats/main_ext.conf @@ -0,0 +1,20 @@ +# Extended Log Format +# Nginx Basics +log_format main_ext 'remote_addr="$remote_addr", ' + '[time_local=$time_local], ' + 'request="$request", ' + 'status="$status", ' + 'http_referer="$http_referer", ' + 'body_bytes_sent="$body_bytes_sent", ' + 'Host="$host", ' + 'sn="$server_name", ' + 'request_time=$request_time, ' + 'http_user_agent="$http_user_agent", ' + 'http_x_forwarded_for="$http_x_forwarded_for", ' + 'request_length="$request_length", ' + 'upstream_address="$upstream_addr", ' + 'upstream_status="$upstream_status", ' + 'upstream_connect_time="$upstream_connect_time", ' + 'upstream_header_time="$upstream_header_time", ' + 'upstream_response_time="$upstream_response_time", ' + 'upstream_response_length="$upstream_response_length", '; diff --git a/labs/lab2/nginx-plus/etc/nginx/includes/proxy_headers.conf b/labs/lab2/nginx-plus/etc/nginx/includes/proxy_headers.conf new file mode 100644 index 0000000..23a83d1 --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/includes/proxy_headers.conf @@ -0,0 +1,12 @@ +## Set Headers to the proxied servers ## + +# client address in a binary form, value’s length is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses +proxy_set_header X-Real-IP $remote_addr; + +# X-Forwarded-For client request header field with the $remote_addr variable appended to it, +# separated by a comma. If the “X-Forwarded-For” field is not present in the client request header, +# the $proxy_add_x_forwarded_for variable is equal to the $remote_addr variable. +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + +# request scheme, “http” or “https” +proxy_set_header X-Forwarded-Proto $scheme; \ No newline at end of file diff --git a/labs/lab2/nginx-plus/etc/nginx/nginx.conf b/labs/lab2/nginx-plus/etc/nginx/nginx.conf new file mode 100644 index 0000000..be988da --- /dev/null +++ b/labs/lab2/nginx-plus/etc/nginx/nginx.conf @@ -0,0 +1,33 @@ +user nginx; +worker_processes 1; + +error_log /var/log/nginx/error.log info; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + include /etc/nginx/includes/log_formats/*.conf; # Custom Access logs formats found here + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; + +} diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/dashboard.html b/labs/lab2/nginx-plus/usr/share/nginx/html/dashboard.html new file mode 100644 index 0000000..5f1d00b --- /dev/null +++ b/labs/lab2/nginx-plus/usr/share/nginx/html/dashboard.html @@ -0,0 +1,1929 @@ +NGINX Plus Dashboard + \ No newline at end of file diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/gtr.html b/labs/lab2/nginx-plus/usr/share/nginx/html/gtr.html new file mode 100644 index 0000000..1b1bdfc --- /dev/null +++ b/labs/lab2/nginx-plus/usr/share/nginx/html/gtr.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx GTR ! + + + +

Welcome to nginx GTR !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +GTR + +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/gtr.jpg b/labs/lab2/nginx-plus/usr/share/nginx/html/gtr.jpg new file mode 100644 index 0000000..be39ffe Binary files /dev/null and b/labs/lab2/nginx-plus/usr/share/nginx/html/gtr.jpg differ diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/index.html b/labs/lab2/nginx-plus/usr/share/nginx/html/index.html new file mode 100644 index 0000000..5d2b304 --- /dev/null +++ b/labs/lab2/nginx-plus/usr/share/nginx/html/index.html @@ -0,0 +1,24 @@ + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/nsx.html b/labs/lab2/nginx-plus/usr/share/nginx/html/nsx.html new file mode 100644 index 0000000..fc1de05 --- /dev/null +++ b/labs/lab2/nginx-plus/usr/share/nginx/html/nsx.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx NSX ! + + + +

Welcome to nginx NSX !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +NSX + +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/nsx.jpg b/labs/lab2/nginx-plus/usr/share/nginx/html/nsx.jpg new file mode 100644 index 0000000..f3c27f5 Binary files /dev/null and b/labs/lab2/nginx-plus/usr/share/nginx/html/nsx.jpg differ diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/rcf.html b/labs/lab2/nginx-plus/usr/share/nginx/html/rcf.html new file mode 100644 index 0000000..468ddae --- /dev/null +++ b/labs/lab2/nginx-plus/usr/share/nginx/html/rcf.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx RCF ! + + + +

Welcome to nginx RCF !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +RCF + +

Thank you for using nginx.

+ + diff --git a/labs/lab2/nginx-plus/usr/share/nginx/html/rcf.jpg b/labs/lab2/nginx-plus/usr/share/nginx/html/rcf.jpg new file mode 100644 index 0000000..40faef6 Binary files /dev/null and b/labs/lab2/nginx-plus/usr/share/nginx/html/rcf.jpg differ diff --git a/labs/lab2/readme.md b/labs/lab2/readme.md new file mode 100644 index 0000000..1f0f843 --- /dev/null +++ b/labs/lab2/readme.md @@ -0,0 +1,170 @@ +# Build workshop components within Docker + +## Introduction + +In this lab, you will be running the backend application and several NGINX OSS and Plus instances as Docker containers. All the NGINX containers would be attached to NGINX One console as part of this exercise. + +
+ +## Prerequisites + +- You must have an F5 Distributed Cloud(XC) Account +- You must have enabled NGINX One service on F5 Distributed Cloud(XC) +- You must have Docker and Docker Compose installed and running +- You must have an Active Data Plane Key from previous exercise +- See `Lab0` for instructions on setting up your system for this Workshop +- Familiarity with basic Linux concepts and commands +- Familiarity with basic NGINX concepts and commands + +
+ +### Run NGINX Containers with Docker + +NGINX Plus | Docker| NGINX OSS +:-------------------------:|:-------------------------:|:---------------: +![NGINX Plus](media/nginx-plus-icon.png) |![Docker](media/docker-icon.png) |![NGINX OSS](media/nginx-icon.png) + +You will run some Docker containers to build out various workshop components, using the provided `docker-compose.yml` file. This Docker Compose will pull and run 9 different Docker Containers, as follows: + +- 3 NGINX OSS Containers, with different OS and NGINX versions, connecting to the NGINX One Console +- 3 NGINX Plus Containers, with different OS and NGINX versions, connecting to the NGINX One Console +- 3 nginxinc/ingress-demo Containers, used for the backend web servers, but NOT connected to the NGINX One Console + +1. Inspect the `lab2/docker-compose.yml` file. You will see the details of each container being pulled and run. + + >Before you can pull and run these containers, you must set several Environment variables correctly, *before running docker compose*. + +1. Using the Visual Studio Terminal, set the `TOKEN` environment variable with the Dataplane Key from the One Console, as follows: + + ```bash + export TOKEN=paste-your-dataplane-key-from-clipboard-here + ``` + + And verify it was set: + + ```bash + #check it + echo $TOKEN + ``` + + ```bash + ## Sample output ## + vJ+ADwlFXKf58bX0Qk/...6N38Al4fdxXDefT6J2iiM= + ``` + +1. Using the same Terminal, set the `JWT` environment variable from your `nginx-repo.jwt` license file. This is required to pull the NGINX Plus container images from the NGINX Private Registry. If you do not have an NGINX Plus license, you can request a free 30-Day Trial license from here: https://www.f5.com/trials/nginx-one + + ```bash + export JWT=$(cat nginx-repo.jwt) + ``` + + And verify it was set: + + ```bash + #check it + echo $JWT + ``` + +1. Using Docker, Login to to the NGINX Private Registry, using the $JWT ENV variable for the username, as follows. (Your system may require sudo): + + ```bash + docker login private-registry.nginx.com --username=$JWT --password=none + ``` + + You should see a `Login Suceeded` message, like this: + + ```bash + ##Sample output## + WARNING! Using --password via the CLI is insecure. Use --password-stdin. + WARNING! Your password will be stored unencrypted in /home/ubuntu/.docker/config.json. + Configure a credential helper to remove this warning. See + https://docs.docker.com/engine/reference/commandline/login/#credentials-store + + Login Succeeded + ``` + +1. Run below script to generate temporary self-signed certificates that would be used by NGINX OSS instances.Ensure you are in the `/lab2` folder: + + ```bash + bash generate_certs.sh + ``` + +1. If both ENV variables are set correctly && you are logged into the NGINX Private Registry, you can now run Docker Compose to pull and run the images. Ensure you are in the `/lab2` folder: + + ```bash + docker compose up --force-recreate -d + ``` + + You will see Docker pulling the images, and then starting the containers. + + ![Docker Pulling](media/lab2_docker-pulling.png) + + ```bash + ## Sample output ## + [+] Running 9/10 + ⠙ Network lab7_default Created 2.1s + ✔ Container basics-plus3 Started 0.9s + ✔ Container web1 Started 1.4s + ✔ Container basics-plus1 Started 2.1s + ✔ Container web2 Started 1.8s + ✔ Container basics-oss3 Started 2.0s + ✔ Container basics-oss1 Started 1.9s + ✔ Container basics-oss2 Started 1.6s + ✔ Container basics-plus2 Started 1.2s + ✔ Container web3 Started 1.2s + ``` + +1. Verify that all 9 containers started: + + ```bash + docker ps + ``` + + ```bash + ##Sample output## + + CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES + # NGINX OSS containers + 00ee8c9e4326 docker-registry.nginx.com/nginx/agent:mainline "/docker-entrypoint.…" 44 minutes ago Up 44 minutes 0.0.0.0:33396->80/tcp, :::33395->80/tcp, 0.0.0.0:33393->443/tcp, :::33392->443/tcp, 0.0.0.0:33388->9000/tcp, :::33387->9000/tcp, 0.0.0.0:33381->9113/tcp, :::33380->9113/tcp basics-oss1 + 34b871d50d1b docker-registry.nginx.com/nginx/agent:alpine "/docker-entrypoint.…" 44 minutes ago Up 44 minutes 0.0.0.0:33391->80/tcp, :::33390->80/tcp, 0.0.0.0:33385->443/tcp, :::33384->443/tcp, 0.0.0.0:33378->9000/tcp, :::33377->9000/tcp, 0.0.0.0:33375->9113/tcp, :::33374->9113/tcp basics-oss2 + 022d79ce886c docker-registry.nginx.com/nginx/agent:1.26-alpine "/docker-entrypoint.…" 44 minutes ago Up 44 minutes 0.0.0.0:33398->80/tcp, :::33397->80/tcp, 0.0.0.0:33395->443/tcp, :::33394->443/tcp, 0.0.0.0:33392->9000/tcp, :::33391->9000/tcp, 0.0.0.0:33386->9113/tcp, :::33385->9113/tcp basics-oss3 + + # NGINX Plus containers + 9770a4169e19 private-registry.nginx.com/nginx-plus/agent:nginx-plus-r32-alpine-3.20-20240613 "/usr/bin/supervisor…" 44 minutes ago Up 44 minutes 0.0.0.0:33397->80/tcp, :::33396->80/tcp, 0.0.0.0:33394->443/tcp, :::33393->443/tcp, 0.0.0.0:33389->9000/tcp, :::33388->9000/tcp, 0.0.0.0:33383->9113/tcp, :::33382->9113/tcp basics-plus1 + 852667e29280 private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-alpine-3.19-20240522 "/usr/bin/supervisor…" 44 minutes ago Up 44 minutes 0.0.0.0:33382->80/tcp, :::33381->80/tcp, 0.0.0.0:33377->443/tcp, :::33376->443/tcp, 0.0.0.0:33374->9000/tcp, :::33373->9000/tcp, 0.0.0.0:33372->9113/tcp, :::33371->9113/tcp basics-plus2 + ffa65b04e03b private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-ubi-9-20240522 "/usr/bin/supervisor…" 44 minutes ago Up 44 minutes 0.0.0.0:33373->80/tcp, :::33372->80/tcp, 0.0.0.0:33371->443/tcp, :::33370->443/tcp, 0.0.0.0:33370->9000/tcp, :::33369->9000/tcp, 0.0.0.0:33369->9113/tcp, :::33368->9113/tcp basics-plus3 + + # NGINX Ingress Demo containers (not Registered with One Console) + 37c2777c8598 nginxinc/ingress-demo "/docker-entrypoint.…" 44 minutes ago Up 44 minutes 0.0.0.0:33387->80/tcp, :::33386->80/tcp, 0.0.0.0:33379->443/tcp, :::33378->443/tcp web1 + dba569e76e36 nginxinc/ingress-demo "/docker-entrypoint.…" 44 minutes ago Up 44 minutes 443/tcp, 0.0.0.0:33390->80/tcp, :::33389->80/tcp, 0.0.0.0:33384->433/tcp, :::33383->433/tcp web2 + 5cde3c462a27 nginxinc/ingress-demo "/docker-entrypoint.…" 44 minutes ago Up 44 minutes 0.0.0.0:33380->80/tcp, :::33379->80/tcp, 0.0.0.0:33376->443/tcp, :::33375->443/tcp web3 + ``` + + Go back to your One Console Instance page, and click `Refresh`. You should see all 6 of your `basics-` instances appear in the list, and the Online icon should be `green`. If they did not Register with the One Console, it is likely you have an issue with the $TOKEN used, create a new Dataplane Key and try again. It should look similar to this: + + ![NGINX Instances](media/lab2_none-instances.png) + +Now that the NGINX OSS and Plus containers are running and Registered with the NGINX One Console, in subsequent sections you will explore the various features of NGINX One Console, and manage your NGINX Instances! + +
+ +This ends lab2. + +
+ +## References: + +- [NGINX One Console](https://docs.nginx.com/nginx-one/) +- [NGINX Agent](https://docs.nginx.com/nginx-agent/overview/) + +
+ +### Authors + +- Chris Akker - Solutions Architect - Community and Alliances @ F5, Inc. +- Shouvik Dutta - Solutions Architect - Community and Alliances @ F5, Inc. +- Adam Currier - Solutions Architect - Community and Alliances @ F5, Inc. + +------------- + +Navigate to ([Lab3](../lab3/readme.md) | [LabGuide](../readme.md)) diff --git a/labs/lab3/media/lab3_30-day-cert-details.png b/labs/lab3/media/lab3_30-day-cert-details.png new file mode 100644 index 0000000..82dda2c Binary files /dev/null and b/labs/lab3/media/lab3_30-day-cert-details.png differ diff --git a/labs/lab3/media/lab3_basics-oss1-certs.png b/labs/lab3/media/lab3_basics-oss1-certs.png new file mode 100644 index 0000000..8b1c7be Binary files /dev/null and b/labs/lab3/media/lab3_basics-oss1-certs.png differ diff --git a/labs/lab3/media/lab3_basics-oss1-config-colors.png b/labs/lab3/media/lab3_basics-oss1-config-colors.png new file mode 100644 index 0000000..9ec974b Binary files /dev/null and b/labs/lab3/media/lab3_basics-oss1-config-colors.png differ diff --git a/labs/lab3/media/lab3_basics-plus1-cves-redirect.png b/labs/lab3/media/lab3_basics-plus1-cves-redirect.png new file mode 100644 index 0000000..1df6fb1 Binary files /dev/null and b/labs/lab3/media/lab3_basics-plus1-cves-redirect.png differ diff --git a/labs/lab3/media/lab3_basics-plus1-cves.png b/labs/lab3/media/lab3_basics-plus1-cves.png new file mode 100644 index 0000000..afbcc87 Binary files /dev/null and b/labs/lab3/media/lab3_basics-plus1-cves.png differ diff --git a/labs/lab3/media/lab3_basics-plus2-cves.png b/labs/lab3/media/lab3_basics-plus2-cves.png new file mode 100644 index 0000000..24ddc8a Binary files /dev/null and b/labs/lab3/media/lab3_basics-plus2-cves.png differ diff --git a/labs/lab3/media/lab3_cafe-best-practice.png b/labs/lab3/media/lab3_cafe-best-practice.png new file mode 100644 index 0000000..4085d35 Binary files /dev/null and b/labs/lab3/media/lab3_cafe-best-practice.png differ diff --git a/labs/lab3/media/lab3_cafe-config-diff.png b/labs/lab3/media/lab3_cafe-config-diff.png new file mode 100644 index 0000000..f752ca7 Binary files /dev/null and b/labs/lab3/media/lab3_cafe-config-diff.png differ diff --git a/labs/lab3/media/lab3_cafe-edit-line16.png b/labs/lab3/media/lab3_cafe-edit-line16.png new file mode 100644 index 0000000..c2238da Binary files /dev/null and b/labs/lab3/media/lab3_cafe-edit-line16.png differ diff --git a/labs/lab3/media/lab3_cafe-edit-line4.png b/labs/lab3/media/lab3_cafe-edit-line4.png new file mode 100644 index 0000000..d37dc5b Binary files /dev/null and b/labs/lab3/media/lab3_cafe-edit-line4.png differ diff --git a/labs/lab3/media/lab3_cafe-publish-success.png b/labs/lab3/media/lab3_cafe-publish-success.png new file mode 100644 index 0000000..e8811fd Binary files /dev/null and b/labs/lab3/media/lab3_cafe-publish-success.png differ diff --git a/labs/lab3/media/lab3_cafe-publish.png b/labs/lab3/media/lab3_cafe-publish.png new file mode 100644 index 0000000..11934f7 Binary files /dev/null and b/labs/lab3/media/lab3_cafe-publish.png differ diff --git a/labs/lab3/media/lab3_nginx-conf-best-practice.png b/labs/lab3/media/lab3_nginx-conf-best-practice.png new file mode 100644 index 0000000..358fa48 Binary files /dev/null and b/labs/lab3/media/lab3_nginx-conf-best-practice.png differ diff --git a/labs/lab3/media/lab3_none-availability.png b/labs/lab3/media/lab3_none-availability.png new file mode 100644 index 0000000..d1fbdf7 Binary files /dev/null and b/labs/lab3/media/lab3_none-availability.png differ diff --git a/labs/lab3/media/lab3_none-certs.png b/labs/lab3/media/lab3_none-certs.png new file mode 100644 index 0000000..184bea6 Binary files /dev/null and b/labs/lab3/media/lab3_none-certs.png differ diff --git a/labs/lab3/media/lab3_none-config-recommendations.png b/labs/lab3/media/lab3_none-config-recommendations.png new file mode 100644 index 0000000..3073995 Binary files /dev/null and b/labs/lab3/media/lab3_none-config-recommendations.png differ diff --git a/labs/lab3/media/lab3_none-cpu.png b/labs/lab3/media/lab3_none-cpu.png new file mode 100644 index 0000000..a70b517 Binary files /dev/null and b/labs/lab3/media/lab3_none-cpu.png differ diff --git a/labs/lab3/media/lab3_none-cves-high.png b/labs/lab3/media/lab3_none-cves-high.png new file mode 100644 index 0000000..6c8bd3d Binary files /dev/null and b/labs/lab3/media/lab3_none-cves-high.png differ diff --git a/labs/lab3/media/lab3_none-cves.png b/labs/lab3/media/lab3_none-cves.png new file mode 100644 index 0000000..463f6bb Binary files /dev/null and b/labs/lab3/media/lab3_none-cves.png differ diff --git a/labs/lab3/media/lab3_none-disk.png b/labs/lab3/media/lab3_none-disk.png new file mode 100644 index 0000000..0b2d91b Binary files /dev/null and b/labs/lab3/media/lab3_none-disk.png differ diff --git a/labs/lab3/media/lab3_none-linux-versions.png b/labs/lab3/media/lab3_none-linux-versions.png new file mode 100644 index 0000000..fc0763a Binary files /dev/null and b/labs/lab3/media/lab3_none-linux-versions.png differ diff --git a/labs/lab3/media/lab3_none-network.png b/labs/lab3/media/lab3_none-network.png new file mode 100644 index 0000000..2aa84ba Binary files /dev/null and b/labs/lab3/media/lab3_none-network.png differ diff --git a/labs/lab3/media/lab3_none-nginx-versions.png b/labs/lab3/media/lab3_none-nginx-versions.png new file mode 100644 index 0000000..856e8e3 Binary files /dev/null and b/labs/lab3/media/lab3_none-nginx-versions.png differ diff --git a/labs/lab3/media/lab3_none-ram.png b/labs/lab3/media/lab3_none-ram.png new file mode 100644 index 0000000..fa2486b Binary files /dev/null and b/labs/lab3/media/lab3_none-ram.png differ diff --git a/labs/lab3/media/lab3_none-response-codes.png b/labs/lab3/media/lab3_none-response-codes.png new file mode 100644 index 0000000..0f3f41b Binary files /dev/null and b/labs/lab3/media/lab3_none-response-codes.png differ diff --git a/labs/lab3/media/lab3_none-security-pane-details.png b/labs/lab3/media/lab3_none-security-pane-details.png new file mode 100644 index 0000000..1549cd2 Binary files /dev/null and b/labs/lab3/media/lab3_none-security-pane-details.png differ diff --git a/labs/lab3/media/lab3_none-security-pane.png b/labs/lab3/media/lab3_none-security-pane.png new file mode 100644 index 0000000..457a1ad Binary files /dev/null and b/labs/lab3/media/lab3_none-security-pane.png differ diff --git a/labs/lab3/media/lab3_stub-status-best-practice.png b/labs/lab3/media/lab3_stub-status-best-practice.png new file mode 100644 index 0000000..8a6ab11 Binary files /dev/null and b/labs/lab3/media/lab3_stub-status-best-practice.png differ diff --git a/labs/lab3/media/nginx-one-icon.png b/labs/lab3/media/nginx-one-icon.png new file mode 100644 index 0000000..acca29f Binary files /dev/null and b/labs/lab3/media/nginx-one-icon.png differ diff --git a/labs/lab3/readme.md b/labs/lab3/readme.md new file mode 100644 index 0000000..4f44891 --- /dev/null +++ b/labs/lab3/readme.md @@ -0,0 +1,317 @@ +# NGINX One Console Overview and Deep Dive + +## Introduction + +In this lab, you will be log back into NGINX One Console and explore various features within NGINX One console. You will then dive deep into those features and understand their usage. + +
+ +## Learning Objectives + +By the end of the lab you will be able to: + +- [Explore NGINX One Console Overview Dashboard](#explore-the-nginx-one-console-overview-dashboard) +- [Understand NGINX One Certificates feature](#access-and-navigate-the-nginx-one-console) +- [Understand NGINX One Configuration Recommendations feature](#create-and-manage-data-plane-keys-that-would-be-used-to-manage-nginx-instances) +- [Understand NGINX One CVE feature](#create-and-manage-data-plane-keys-that-would-be-used-to-manage-nginx-instances) + +## Prerequisites + +- You must have an F5 Distributed Cloud(XC) Account +- You must have enabled NGINX One service on F5 Distributed Cloud(XC) +- See `Lab0` for instructions on setting up your system for this Workshop. +- You have built all workshop components from previous section. +- Familiarity with basic Linux concepts and commands +- Familiarity with basic NGINX concepts and commands + +
+ +## Explore the NGINX One Console Overview Dashboard + +![NGINX ONE](media/nginx-one-icon.png) + +Within NGINX One Console service, click on the Overview Dashboard, to see the Summary Panels of your NGINX fleet: + +- Availability of your Instances to the Console +- Different Versions of NGINX OSS / Plus being used +- Different Versions of Linux Distros being used +- The Expiration dates/status of your TLS Certificates +- Expert analysis of your NGINX configurations - and YES!! NGINX AI is coming here :-) +- Any CVEs detected, either with NGINX or the Linux OS +- CPU, RAM, and Disk utilization +- Network Throughput metrics +- Summary of HTTP 400/500 Response Codes + +### Availability + +This Panel is pretty self explanatory, which of your NGINX Instances is online and communicating with the Console. Click on the `Online, Offline, or Unavailable` links for more details. You can add a `Filter` to assist with sorting/displaying your Instances. Notice there is a `Last Reported Time` column, so you know when the instance last did a handshake with the Console. Under `Actions`, you can go directly to the Configuration tool, or Delete the Instance. + +![NGINX Availability](media/lab3_none-availability.png) + +### NGINX Versions + +This Panel shows a Summary of which NGINX Versions are in use and by how many instances. Sure, you could write a `bash script to SSH into every Instance`, and query `nginx -v` and collect this data yourself ... but why not use the Console instead? Do you even *have* `root privileges` to SSH in the first place? This makes it easy to know what versions of NGINX are running on your Instances - do they need a patch or an upgrade?? + +![NGINX versions](media/lab3_none-nginx-versions.png) + +### Operating Systems + +This Panel shows a Summary of which Linux Distros are in use and by how many instances. Sure, you could write YABS - yet another bash script - to SSH into every Instance, and query `uname` and collect the versions yourself ... but why not use the Console's Easy Button instead? As the number of people, teams, and projects grow using NGINX, the Version sprawl can become an issue. The Console lets you see this level of detail quite easily. And it makes it easy to find Linux versions that may not be approved by Security for Production, or need a patch applied. + +![Linux versions](media/lab3_none-linux-versions.png) + +### Certificates Overview + +This Panel shows a Summary of the TLS Certificate expiration Status, using each certificate's expiry date as reported with openssl on each Instance. NGINX Agent scans the NGINX config files, then uses openssl to query each Certificate file, and reports this information up to the NGINX One Console. If you click on the `Expired, Expiring, Valid, or Not Ready` links, you get additional details on the name of the certificate and on which Instance it can be found. Once again, this saves you writing another bash script, you can see this TLS metadata at your fingertips. You will update an expired certificate in the next Exercise. + +![Certs](media/lab3_none-certs.png) + +### Configuration Recommendations Overview + +This Panel shows some possible improvements that could be made to your current running NGINX configs. Some are Security related, or an Optimization, or a Best Practice from the experts that built NGINX. Clicking on each of these will give you additional details and provide an easy way to edit / update your NGINX configs. You will do this in the next Exercise. + +![Config recommendations](media/lab3_none-config-recommendations.png) + +### CVEs Overview + +This Panel is a great tool to show you the CVEs that you might have in your NGINX fleet, with `High-Medium-Low Severity` classes, and which Instances are affected. Even better, click on the CVE hyperlink takes you directly to the CVE website for detailed information, and possible remediations. + +![CVEs](media/lab3_none-cves.png) + +Click on the `basics-plus2` Instance, you should see a list of all the CVEs identified by NGINX One Console CVE scanner. NOTE: *This list may not include ALL CVEs*, rather just the list that NGINX One Console knows about at the time of the last scan. + +Basics Plus1 | Basics Plus2 +:-------------------------:|:-------------------------: +![Container CVEs](media/lab3_basics-plus1-cves.png) | ![Container CVEs](media/lab3_basics-plus2-cves.png) + +### CPU, RAM, Disk Utilization + +These Panels show Host level information from the Linux OS about the consumption of hardware resources that the NGINX Agent reports to the One Console. There is a `Time Selector` to show these metrics over different periods of time, with a history graph plotted for you. Click the `See All` button for a columnar list, which you can Filter and Sort. +*NOTE: Docker containers do not report Disk usage.* + +CPU | RAM | Disk +:-------------------------:|:-------------------------:|:---------------: +![Cpu](media/lab3_none-cpu.png) | ![Ram](media/lab3_none-ram.png) | ![Disk](media/lab3_none-disk.png) + +### Unsuccessful Response Codes + +The NGINX Agent scans the Access logs and summarizes the number of 4xx and 5xx HTTP Return codes found, and reports this information to the One Console. There is `Time Selector` and a `See All` button for this Panel as well. + +![Response Codes](media/lab3_none-response-codes.png) + +### Top Network Usage + +This Panel shows basic Network level information from the Linux OS about the network traffic that the NGINX Agent reports to the One Console. There is a `Time Selector` to show these metrics over different periods of time, with a history graph plotted for you. Click the `See All` button for a columnar list, which you can Filter and Sort. + +![Top Network](media/lab3_none-network.png) + +
+ +## NGINX One Console CVEs Deep Dive + +![CVE](media/lab3_none-cves.png) + +One of the nice security feature of the NGINX One Console is the ability to provide a CVE summary with `High-Medium-Low Severity` classes. Clicking those classes reveals which Instances fall under them. + +1. Using the Overview Dashboard CVEs Panel, Click on the `High` Severity link. This will provide a List View of the Instances that have CVEs that are classified under `High` Severity. + + ![High CVEs](media/lab3_none-cves-high.png) + +1. Click on the `basics-plus1` Instance. This will provide the Instance level Details, you will see a `CVEs` Section, this time with the Name, Severity and Description for each CVEs applicable to the instance. + + ![Basics-plus1 CVE](media/lab3_basics-plus1-cves.png) + +1. If you click on one of the CVEs name hyperlink, for example `CVE-2024-39792`, it will directly open the CVE website on a new tab with detailed information and possible remediations. + + ![High CVE redirect](media/lab3_basics-plus1-cves-redirect.png) + +1. In similar fashion explore, click on the `Medium` Severity link within the Overview Dashboard and explore all the other CVEs that are classified under `Medium` Severity. + +1. Another alternate way to look into CVEs is to navigate to the `Security` tab. This opens a new window in the left pane that shows all the F5 announced CVEs that are related to NGINX. This view also has a counter besides the CVE Name that shows how many instances are impacted by that particular CVE. + ![CVE Security Pane](media/lab3_none-security-pane.png) + +1. Clicking on the CVE name opens a new pane that shows you the instances impacted by that particular CVE. `View More` link would directly open the CVE website on a new tab similar to earlier steps. + ![CVE Security Pane Details](media/lab3_none-security-pane-details.png) + +
+ +## NGINX One Console Certificates Deep Dive + +![Certs](media/lab3_none-certs.png) + +Another nice feature of the NGINX One Console is the ability to quickly see the `Expiration Dates of the TLS Certificates` being used by your NGINX Instances. When the nginx-agent reads the NGINX configuration, it looks for the TLS certificate path/name, and uses openssl to collect the Certificate Expiration date and Subject Name, and sends this information to the One Console. It provides both a Summary of all the certificates, and the details on each one. Sure, you can write an bash script to login with root privileges to every NGINX Server, and collect this information yourself. But using the NGINX One Console makes this easy to see and help plan appropriate actions. + +>There is one small caveat to this feature, it only scans the TLS certificates that are part of the running NGINX configuration of the Instance, *it does not check additional TLS certificates*, even if they are in the same location on disk. + +- **Expired** means the current date is past the certificate's Expiration Date. +- **Expiring** means the current data is within 31 days of the certificate's Expiration Date. + +1. Using the Overview Dashboard Certificates Panel, Click on the `Expiring` link. This will provide a List View of the Instances affected, with metadata about the Instances using the Certificate. + +1. Click on the `basics-oss1` Instance. This will provide the Instance level Details, you will see a `Certificates` Section, this time with the Name, Status, `Expiration Date`, and Subject Name for each certificate file. + + ![Certs](media/lab3_basics-oss1-certs.png) + +1. If you Click on the actual certificate file, for example `30-day.crt`, it will give you a List of all the Instances that are using that same certificate. + + ![Cert Details](media/lab3_30-day-cert-details.png) + +**Optional Lab Exercise:** + +Fix the Expired Certificate! If you want to create a new certificate, say with a 91-day expiration, follow these instructions to use `openssl` to create a Self-Signed certificate/key pair, and update your NGINX config files to use the new Certficate. + +1. Create a new 91-day SSL certificate/key, and apply it to your configuration: + + ```bash + openssl req -x509 -nodes -days 91 -newkey rsa:2048 -keyout 91-day.key -out 91-day.crt -subj "/CN=NginxPlusBasics" + + ``` + +1. Copy the 91.* files to the appropriate directory, in this workshop, that would be `lab2/nginx-oss/etc/ssl/nginx`. + +1. Edit the `tls-cars.example.com.conf` file that can be found in `lab2/nginx-oss/etc/nginx/conf.d/` file path. Change the names of the crt/key from `cars.crt and cars.key` to `90-day.crt and 90-day.key`; Lines #13-14. + + ```nginx + ... + # Update the following 2 lines for NGINX cert and key directives and file locations + + ssl_certificate /etc/ssl/nginx/cars.crt; + ssl_certificate_key /etc/ssl/nginx/cars.key; + + ... + + ``` + +1. Once you have made this file edits, you would need to reload nginx within all the NGINX OSS containers to incorporate these configuration changes. To do so run below command in your terminal + + ```bash + docker exec -it basics-oss1 nginx -s reload + docker exec -it basics-oss2 nginx -s reload + docker exec -it basics-oss3 nginx -s reload + ``` + + The above set of commands would reload nginx in all the three NGINX OSS containers: basics-oss1, basics-oss2 and basics-oss3. + +
+ +## NGINX One Console Configuration Recommendations Deep Dive + +One of the Best Features of the NGINX ONE Console is the Configuration analysis and recommendations that it provides. The NGINX Product Management and Development teams are experts at NGINX, and they have collaborated to create these valuable insights. There are three types of Recommendations: + +- Security: NGINX configurations to provide the best levels of security. +- Optimization: NGINX configurations known to provide optimal performance. +- Best Practices: Common configurations that follow standards and conform to ideal configs. + +1. From the Overview Dashboard, click on the `Security` and then Click on the `basics-oss1` Instance. + + ![Config Rec Security](media/lab3_none-config-recommendations.png) + +1. Switch view to `Configuration` tab to see the recommendation details. The Recommendations are at the bottom of the screen, and if you look at the config file list, you see small numbers next to each config file that is affected. These are `color-coded`: the Orange numbers are for Security, Blue numbers are for Best Practices, and the Green numbers for for Optimizations. + + ![Config Recs](media/lab3_basics-oss1-config-colors.png) + +1. If you click on the `cafe.example.com.conf` file, the Recommendations will be shown on the bottom, with details and Line Numbers, so you know which ones are being highlighted. + + ![Cafe Best Practice](media/lab3_cafe-best-practice.png) + +1. Now Click on `stub_status.conf`. One of the security details at the bottom highlighting section is: + + *Security - Error: stub_status should have access control list defined on Line 11*. + + This security recommendation suggests you to consider adding an ACL to the stub_status module, which provides metrics about your NGINX instance. With no access list defined, anyone can see it. + + ![Stub Status Best Practice](media/lab3_stub-status-best-practice.png) + +1. Now Click on the `nginx.conf` file, it will show you a best practice recommendations about the `worker_processes` Directive. + + ![NGINX Conf Best Practice](media/lab3_nginx-conf-best-practice.png) + +Ok, so now what?? You can fix all these. Just Click the `Edit Configuration` Pencil icon at the top, and now you can edit the NGINX config files directly. + +1. Try this on the `cafe.example.com.conf` file. At the bottom, Click the link for `line 4`. It will take you directly to the file's config line, and also display an explanation with details about the parameter. + + Add the `default_server` directive to Line4, so it reads `listen 80 default_server;`. + + >And another Great Feature of the One Console, **NGINX Mice!!** If you `mouse-over` any of the `colored words` in your config, you will see a pop-up with details about the Directive, Variable, or Parameter. No more Googling to try and find details about NGINX configurations, it's at your finger/mouse tips! + + ![Cafe Edit Line4](media/lab3_cafe-edit-line4.png) + +1. Now do the same for Line #16, the `proxy_buffering off` Directive, change it to `on`. + + ![Cafe Edit Line16](media/lab3_cafe-edit-line16.png) + +1. When finished with your Edits, Click the Green `Next` button. This will show you a side-by-side `DIFF` of the before/after configuration changes that you made. + + ![Cafe Edit Line16](media/lab3_cafe-config-diff.png) + +1. Now you can click the Green `Publish` button to commit your changes to the NGINX Instance. The NGINX Agent on the Instance will re-test and then apply your configuration changes. You will see two pop-ups for Publishing Status and `Success`. + + ![Cafe Publish](media/lab3_cafe-publish.png) + ![Cafe Publish completed](media/lab3_cafe-publish-success.png) + +1. You can follow this same procedure for your other NGINX config files, making the edits and Publish your changes. + + >You can even add `new` files to your NGINX configurations, and Publish those as well! Just click on `Add file` while you are in Edit mode. + +
+ +## (Optional Exercise): Check how to Pull and Run individual containers + +If you would like to just run a few containers without Docker Compose, here are some examples to try. Notice that the `$TOKEN with Dataplane Key` must be set and used for Registration with the NGINX One Console: + +1. Run an OSS container, with Debian Linux, called `workshop1` using the $TOKEN variable, as follows. + + ```bash + sudo docker run --name=workshop1 --hostname=workshop1 --env=NGINX_AGENT_SERVER_GRPCPORT=443 --env=NGINX_AGENT_SERVER_HOST=agent.connect.nginx.com --env=NGINX_AGENT_SERVER_TOKEN=$TOKEN --env=NGINX_AGENT_TLS_ENABLE=true --restart=always --runtime=runc -d docker-registry.nginx.com/nginx/agent:mainline + + ``` + +1. Run a second OSS container running Alpine Linux called `workshop2`, as follows: + + ```bash + sudo docker run --name=workshop2 --hostname=workshop2 --env=NGINX_AGENT_SERVER_GRPCPORT=443 --env=NGINX_AGENT_SERVER_HOST=agent.connect.nginx.com --env=NGINX_AGENT_SERVER_TOKEN=$TOKEN --env=NGINX_AGENT_TLS_ENABLE=true --restart=always --runtime=runc -d docker-registry.nginx.com/nginx/agent:alpine + + ``` + +1. Run a third OSS container running NGINX 1.26 / Alpine Linux called `workshop3`, as follows: + + ```bash + sudo docker run --name=workshop3 --hostname=workshop3 --env=NGINX_AGENT_SERVER_GRPCPORT=443 --env=NGINX_AGENT_SERVER_HOST=agent.connect.nginx.com --env=NGINX_AGENT_SERVER_TOKEN=$TOKEN --env=NGINX_AGENT_TLS_ENABLE=true --restart=always --runtime=runc -d docker-registry.nginx.com/nginx/agent:1.26-alpine + + ``` + +## (Optional Exercise): Check Container registry for all NGINX Container Images with NGINX Agent installed + +1. Find all the currently available `NGINX OSS` containers with Agent installed. Curl the `Docker Registry`: + + ```bash + curl https://docker-registry.nginx.com/v2/nginx/agent/tags/list | jq + ``` + +1. Find all the currently available `NGINX Plus` containers with Agent installed. Curl the `NGINX Private Registry` ( **NOTE:** you will need your `nginx-repo Certificate and Key` files to run this command): + + ```bash + curl https://private-registry.nginx.com/v2/nginx-plus/agent/tags/list --key nginx-repo.key --cert nginx-repo.crt | jq + ``` + +
+ +This ends lab3. + +
+ +## References: + +- [NGINX One Console](https://docs.nginx.com/nginx-one/) + +
+ +### Authors + +- Chris Akker - Solutions Architect - Community and Alliances @ F5, Inc. +- Shouvik Dutta - Solutions Architect - Community and Alliances @ F5, Inc. +- Adam Currier - Solutions Architect - Community and Alliances @ F5, Inc. + +------------- + +Navigate to ([Lab4](../lab4/readme.md) | [LabGuide](../readme.md)) diff --git a/labs/media/nginx-icon.png b/labs/media/nginx-icon.png new file mode 100644 index 0000000..5997bd0 Binary files /dev/null and b/labs/media/nginx-icon.png differ diff --git a/labs/media/nginx-one-icon.png b/labs/media/nginx-one-icon.png new file mode 100644 index 0000000..acca29f Binary files /dev/null and b/labs/media/nginx-one-icon.png differ diff --git a/labs/media/nginx-plus-icon.png b/labs/media/nginx-plus-icon.png new file mode 100644 index 0000000..23eb5e5 Binary files /dev/null and b/labs/media/nginx-plus-icon.png differ diff --git a/labs/readme.md b/labs/readme.md index 93166aa..e6e1627 100644 --- a/labs/readme.md +++ b/labs/readme.md @@ -24,9 +24,9 @@ This is the second Workshop in the `NGINXperts Series` from the Nginx Communitie
-NGINX ONE Console | NGINXperts Workshops -:-------------------------:|:-------------------------: -![](media/nginx-one-icon.png) | ![](media/developer-seated.svg) +NGINX ONE Console | +:-------------------------:| +![](media/nginx-one-icon.png) |
@@ -42,46 +42,37 @@ See the [Lab0 Readme.md](lab0/readme.md) for details on Student Prerequisites fo
-NGINX One Console | NGINX Plus | NGINX OSS | Docker -:-------------------------:|:-------------------------:|:-------------------------:|:-------------------------: -![](media/nginx-one-icon.png) | ![](media/nginx-plus-icon.png) | ![](media/nginx-oss-icon.png) | ![](media/docker-icon.png) + NGINX Plus | NGINX One Console | NGINX OSS +:-------------------------:|:-------------------------:|:-------------------------: +![](media/nginx-plus-icon.png) | ![](media/nginx-one-icon.png) | ![](media/nginx-icon.png)
## Lab Outline -### Lab 0: Prerequesites - Student Skills / Resources -- [Lab 0: Prerequesites - Student Skills / Resources](lab0/readme.md) +### Lab 0: Prerequisites - Student Skills / Resources +- [Lab 0: Prerequisites - Student Skills / Resources](lab0/readme.md) -### Lab 1: NGINX One Console Access & Overview -- [Lab 1: NGINX One Console Access & Overview](lab1/readme.md) +### Lab 1: NGINX One Console Introduction & Access +- [Lab 1: NGINX One Console Introduction & Access](lab1/readme.md) -### Lab 2: Add NGINX OSS Container -- [Lab 2: Add NGINX OSS Container](lab2/readme.md) +### Lab 2: Build workshop components within Docker +- [Lab 2: Build workshop components within Docker](lab2/readme.md) -### Lab 3: Add NGINX Plus Container -- [Lab 3: Add NGINX Plus Container](lab3/readme.md) +### Lab 3: NGINX One Console Overview and Deep Dive +- [Lab 3: NGINX One Console Overview and Deep Dive](lab3/readme.md) -### Lab 4: NGINX Instance Groups -- [Lab 4: NGINX Instance Groups](lab4/readme.md) +### Lab 4: Managing your NGINX fleet +- [Lab 4: Managing your NGINX fleet](lab4/readme.md) -### Lab 5: Managing your NGINX fleet -- [Lab 5: Managing your NGINX fleet](lab5/readme.md) +### Lab 5: Placeholder +- [Lab 5: Placeholder](lab8/readme.md) -### Lab 6: TLS Certificates -- [Lab 6: TLS Certificates](lab6/readme.md) +### Lab 6: Placeholder +- [Lab6: Placeholder](lab9/readme.md) -### Lab 7: CVE Overview -- [Lab 7: CVE Overview](lab7/readme.md) - -### Lab 8: Placeholder -- [Lab 8: Placeholder](lab8/readme.md) - -### Lab 9: Placeholder -- [Lab9: Placeholder](lab9/readme.md) - -### Lab 10: Placeholder -- [Lab10: Placeholder](lab10/readme.md) +### Lab 7: Placeholder +- [Lab7: Placeholder](lab10/readme.md) #### Labs Optional: Optional Exercises - [Labs Optional: Optional Exercises](labs-optional/readme.md)