nginx-gists

function kvAccess(r) {
    var log = `${r.variables.time_iso8601} client=${r.remoteAddress} method=${r.method} uri=${r.uri} status=${r.status}`;
    r.rawHeadersIn.forEach(h => log += ` in.${h[0]}=${h[1]}`);
    r.rawHeadersOut.forEach(h => log += ` out.${h[0]}=${h[1]}`);
    return log;
}

export default { kvAccess }

nginx-gists

upstream old {
    server 10.0.0.1;
    server 10.0.0.2;
}

upstream new {
    server 10.0.0.9;
    server 10.0.0.10;
}

nginx-gists

match homepage_etag {
    header ETag = '"58ad6e69-264"';
}

upstream my_website {
    server 10.0.0.1:80;
    zone   health 64k; # Allow workers to share health info
}

server {

nginx-gists

# This NGINX Plus configuration implements route-based session persistence 
# and enables the NGINX Plus API. Because the NGINX Plus API is used to 
# dynamically configure the servers in the upstream group, servers are not 
# defined statically in this file.

# To add an upstream server, run this command, replacing 
# <IP-ADDRESS:PORT> and <API-VERSION> with appropriate values:
#
#    curl -sX POST -d '{"server":"<IP-ADDRESS:PORT>", "route":"www.example.com"}' http://127.0.0.1:8888/api/<API-VERSION>/http/upstreams/vhosts/servers

nginx-gists

# Standard HTTP-to-gRPC status code mappings
# Ref: https://github.com/grpc/grpc/blob/master/doc/http-grpc-status-mapping.md
#
error_page 400 = @grpc_internal;
error_page 401 = @grpc_unauthenticated;
error_page 403 = @grpc_permission_denied;
error_page 404 = @grpc_unimplemented;
error_page 429 = @grpc_unavailable;
error_page 502 = @grpc_unavailable;
error_page 503 = @grpc_unavailable;

nginx-gists

function method_up(s) {
    var proxy_proto_header = '';
    var req = '';

    s.on('upload', function(data, flags) {
        var n;

	  req += data;
	  n = req.search('\n');

nginx-gists

server {
    listen 443 ssl;

    ssl_certificate      /etc/ssl/$ssl_server_name.crt; # Lazy load from SNI    
    ssl_certificate_key  /etc/ssl/$ssl_server_name.key; # ditto                     
    ssl_protocols        TLSv1.3 TLSv1.2 TLSv1.1;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_set_header Host $host;

nginx-gists

function signCookie(r) {
    if (r.headers["set-cookie"].length) {
        // Response includes a new cookie
        var cookie_data = r.headers["set-cookie"].split(";");
        var c = require('crypto');
        var h = c.createHmac('sha256').update(cookie_data[0] + r.remoteAddress);
        return "signature=" + h.digest('hex');
    }
    return "";
}

nginx-gists

keyval_zone zone=denylist:128K type=ip timeout=24h;
keyval $remote_addr $in_denylist zone=denylist;

server {
    listen 80;

    location / {
        if ($in_denylist) {
            return 403; # Forbidden
        }

nginx-gists

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress
spec:
  tls:
    - hosts:
      - cafe.example.com
      secretName: cafe-secret
  rules: