145 lines
5.4 KiB
Django/Jinja
145 lines
5.4 KiB
Django/Jinja
pid /run/nginx.pid;
|
|
{% if ansible_distribution_file_variety == "Debian" %}
|
|
user www-data;
|
|
{% if nginx_use_ppa or ansible_distribution_major_version >= '16' %}
|
|
worker_processes auto;
|
|
include /etc/nginx/modules-enabled/*.conf;
|
|
|
|
{% else %}
|
|
worker_processes {{ nginx_workers }};
|
|
{% endif %}
|
|
{% endif %}
|
|
|
|
{% if ansible_distribution_file_variety == "RedHat" %}
|
|
user nginx;
|
|
worker_processes auto;
|
|
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
|
|
include /usr/share/nginx/modules/*.conf;
|
|
{% endif %}
|
|
|
|
events {
|
|
worker_connections {{ nginx_worker_connections }};
|
|
{% if nginx_use_epoll %}
|
|
use epoll;
|
|
{% endif %}
|
|
multi_accept {{ nginx_multi_accept }};
|
|
}
|
|
worker_rlimit_nofile {{ nginx_worker_rlimit_nofile }};
|
|
|
|
http {
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
log_format graylog_json escape=json '{'
|
|
# '"time_local":"$time_iso8601",'
|
|
# '"remote_addr":"$remote_addr",'
|
|
# '"remote_user":"$remote_user",'
|
|
# '"body_bytes_sent":"$body_bytes_sent",'
|
|
# '"request_time":"$request_time",'
|
|
# '"status":"$status",'
|
|
# '"request":"$request",'
|
|
# '"request_method":"$request_method",'
|
|
# '"http_referrer":"$http_referer",'
|
|
# '"http_user_agent":"$http_user_agent"'
|
|
|
|
# Core & Time Metadata
|
|
'"timestamp": "$time_iso8601", '
|
|
'"connection_requests": $connection_requests, '
|
|
|
|
# Client & Network Info
|
|
'"remote_addr": "$remote_addr", '
|
|
'"realip_remote_addr": "$realip_remote_addr", ' # Requires ngx_http_realip_module
|
|
'"remote_user": "$remote_user", '
|
|
'"http_x_forwarded_for": "$http_x_forwarded_for", '
|
|
'"server_name": "$server_name", '
|
|
'"port": "$server_port", '
|
|
|
|
# Request Details
|
|
'"request_method": "$request_method", '
|
|
'"request_uri": "$request_uri", '
|
|
'"uri": "$uri", '
|
|
'"query_string": "$args", '
|
|
'"server_protocol": "$server_protocol", '
|
|
'"http_referrer": "$http_referer", '
|
|
'"http_user_agent": "$http_user_agent", '
|
|
|
|
# Security & SSL (Crucial for monitoring TLS versions)
|
|
'"ssl_protocol": "$ssl_protocol", '
|
|
'"ssl_cipher": "$ssl_cipher", '
|
|
'"ssl_session_reused": "$ssl_session_reused", '
|
|
|
|
# Performance & Compression Metrics
|
|
'"status": $status, '
|
|
'"body_bytes_sent": $body_bytes_sent, '
|
|
'"bytes_sent": $bytes_sent, '
|
|
'"request_length": $request_length, '
|
|
'"gzip_ratio": "$gzip_ratio", ' # Will be a string or "-" if gzip is off
|
|
|
|
# Detailed NGINX Timings (In seconds with millisecond precision)
|
|
'"request_time": $request_time, ' # Total time spent on request
|
|
# '"ssl_handshake_time": "$ssl_handshake_time", ' # Requires NGINX 1.21.1+
|
|
|
|
# Upstream (Backend Application) Performance
|
|
'"upstream_addr": "$upstream_addr", '
|
|
'"upstream_status": "$upstream_status", '
|
|
'"upstream_response_time": "$upstream_response_time", '
|
|
'"upstream_connect_time": "$upstream_connect_time", '
|
|
'"upstream_header_time": "$upstream_header_time", '
|
|
|
|
# Cache Status (If using NGINX proxy_cache)
|
|
'"upstream_cache_status": "$upstream_cache_status", '
|
|
|
|
# Custom Security Context (Optional headers to trace specific sessions)
|
|
'"correlation_id": "$http_x_correlation_id", ' # Extracts custom tracing headers
|
|
'"cookie_session_id": "$cookie_sessionid"' # Extracts specific cookies
|
|
'}';
|
|
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout {{ nginx_keepalive_timeout }};
|
|
send_timeout {{ nginx_send_timeout }};
|
|
types_hash_max_size 2048;
|
|
server_tokens {{ nginx_server_tokens }};
|
|
server_names_hash_bucket_size {{ nginx_server_names_hash_bucket_size }};
|
|
# server_name_in_redirect off;
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
client_header_buffer_size {{ nginx_client_header_buffer_size }};
|
|
client_body_buffer_size {{ nginx_client_body_buffer_size }};
|
|
large_client_header_buffers {{ nginx_large_client_header_buffers }};
|
|
##
|
|
# Logging Settings
|
|
##
|
|
# access_log /var/log/nginx/access.log;
|
|
# error_log /var/log/nginx/error.log;
|
|
access_log syslog:server=unix:/dev/log,facility=local7,tag=nginx,severity=info graylog_json;
|
|
error_log syslog:server=unix:/dev/log,facility=local7,tag=nginx_error error;
|
|
|
|
map_hash_bucket_size 128;
|
|
map_hash_max_size 2048;
|
|
|
|
{% if nginx_enable_compression %}
|
|
include /etc/nginx/snippets/nginx-compression.conf;
|
|
{% endif %}
|
|
{% if nginx_websockets_support %}
|
|
include /etc/nginx/snippets/nginx-websockets.conf;
|
|
{% endif %}
|
|
include /etc/nginx/conf.d/*.conf;
|
|
|
|
{% if ansible_distribution_file_variety == "RedHat" %}
|
|
# Load configuration files for the default server block.
|
|
# include /etc/nginx/default.d/*.conf;
|
|
{% endif %}
|
|
{% if ansible_distribution_file_variety == "Debian" %}
|
|
include /etc/nginx/sites-enabled/*;
|
|
{% endif %}
|
|
}
|
|
{% if nginx_streams is not none %}
|
|
# Load streams configurations
|
|
stream {
|
|
include /etc/nginx/stream.d/*.conf;
|
|
}
|
|
{% endif %}
|