gistfile1.txt

# define a proxy cache called 'puppetcache'
# with an in-memory zone of 10MiB (increase this number if you want to be able to cache
# more keys)
# the cache disk path should be on the same filesystem as the proxy_temp_path
proxy_cache_path  /var/cache/nginx/cache  levels=1:2   keys_zone=puppetcache:10m;

server {

    ... normal nginx for puppet config...

    proxy_set_header    Host             $host;
    proxy_set_header    X-Real-IP        $remote_addr;
    proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header    X-Client-Verify  $ssl_client_verify;
    proxy_set_header    X-SSL-Subject    $ssl_client_s_dn;
    proxy_set_header    X-SSL-Issuer     $ssl_client_i_dn;
    proxy_buffer_size   16k;
    proxy_buffers       8 32k;
    proxy_busy_buffers_size    64k;
    proxy_temp_file_write_size 64k;
    proxy_read_timeout  65;

    # we handle catalog differently
    # because we want to cache them
    location /production/catalog {
        proxy_pass          http://puppet-production;
        proxy_redirect      off;

        # it is a good thing to actually restrict who
        # can ask for a catalog (especially for cached
        # catalogs)
        allow 172.16.10.0/24;
        allow 127.0.0.0/8;
        deny all;

        # where to cache contents
        proxy_cache         puppetcache;
    
        # we cache content by catalog host
        # we could also use $args to take into account request
        # facts, but those change too often (ie uptime or memory)
        # to be really usefull
        proxy_cache_key     $uri;

        # define how long to cache response
    
        # normal catalogs will be cached 2 weeks
        proxy_cache_valid  200 302 301 2w;

        # errors are not cached long
        proxy_cache_valid  500 403 1m;
    
        # the rest is cached a little bit
        proxy_cache_valid  any 30m;             
    }

    # catch all location for other terminii
    location / {
        proxy_pass          http://puppet-production;
        proxy_redirect      off;
    }
}