Announcing NGINX Plus R22

logging.conf

js_import logging.js; # Load this JS file as the 'logging' module
js_set $raw_headers_in logging.rawHeadersOnError;

log_format json escape=none '{"response":'
                            '{"timestamp":"$time_iso8601","status":$status},'
                            '"request":'
                            '{"client":"$remote_addr","uri":"$request_uri","headers":$raw_headers_in}}';

server {
    listen 80;
    access_log /var/log/nginx/access.log main;
    access_log /var/log/nginx/access_json.log json if=$raw_headers_in;

    #...
}

# vim: syntax=nginx

logging.js

export default { rawHeadersOnError };

function rawHeadersOnError(r) {
    if (r.status >= 400) {
        return JSON.stringify(r.rawHeadersIn);
    } else {
        return ''; // Do not trigger access_log if= condition
    }
}

ocsp-validation.conf

server {
    # Server TLS configuration
    listen 443 ssl; 
    ssl_certificate /etc/ssl/foo.example.com.crt; 
    ssl_certificate_key /etc/ssl/foo.example.com.key; 

    # Client certificate authentication 
    ssl_verify_client on; 
    ssl_trusted_certificate /etc/ssl/cachain.pem; 
    ssl_ocsp on; # Enable OCSP validation 

    location / { 
        proxy_pass http://my_backend; 
    } 
}

# vim: syntax=nginx

oidc.conf

map $host $oidc_authz_endpoint {
    www.example.com "https://my-idp.example.com/oauth2/v1/authorize";
    my-app.dev.test "http://10.0.0.11:8080/auth/realms/master/protocol/openid-connect/auth";
}
 
map $host $oidc_token_endpoint {
    www.example.com "https://my-idp.example.com/oauth2/v1/token";
    my-app.dev.test "http://10.0.0.11:8080/auth/realms/master/protocol/openid-connect/token";
}
 
map $host $oidc_jwt_keyfile {
    www.example.com "https://my-idp.example.com/oauth2/v1/keys";    
    my-app.dev.test "http://10.0.0.11:8080/auth/realms/master/protocol/openid-connect/certs";
}
 
map $host $oidc_client {
    www.example.com "client-id-one";
    my-app.dev.test "client-id-two";
}
 
map $host $oidc_client_secret {
    www.example.com "client-secret-one";
    my-app.dev.test "client-secret-two";
}

# vim: syntax=nginx

For a discussion of these files, see Announcing NGINX Plus R22