Announcing NGINX Plus Release 20

limit_conn.conf

limit_conn_zone $binary_remote_addr zone=by_ip:10m;

server {
    listen 80;

    location / {
        limit_conn by_ip 10;
        limit_conn_dry_run on;
        if ($limit_conn_status = REJECTED_DRY_RUN) {
            limit_rate 100;
        }
    
        proxy_pass http://my_backend;
}

# vim: syntax=nginx

limit_req.conf

limit_req_zone $jwt_claim_sub zone=my_limit:1m rate=10r/s;
limit_req_status 429;
 
log_format kv 'time=$msec client=$remote_addr sub=$jwt_claim_sub '
              'uri=$request_uri limit_req=$limit_req_status';
 
map $limit_req_status $in_excess {
    default 1;
    PASSED  0;
}
 
server {
    listen 80;
    auth_jwt ''; # Require JWT authentication
    auth_jwt_key_file jwks.json;
 
    location / {
        limit_req zone=my_limit nodelay; # Reject excessive requests
        proxy_pass http://my_backend;
    }
 
    access_log /var/log/nginx/access.log main;             # Default log
    access_log /var/log/nginx/reject.log kv if=$in_excess; # Rejected
}

# vim: syntax=nginx

prefix_cache_control.conf

keyval_zone zone=paths:512K type=prefix;
keyval $uri $cache_control_directive zone=paths;
 
server {
    listen 80;
 
    location / {
        proxy_pass http://my_backend;
        add_header Cache-Control $cache_control_directive;
    }
}

# vim: syntax=nginx

upstream_resolver.conf

http {
    resolver 10.0.0.1 valid=300s status_zone=global; # Global resolver
    resolver_timeout 5s;
 
    upstream website {
        zone website 64k;
        server www-public.prod.example.com resolve; # Use global resolver
    }
 
    upstream mobile_app {
        zone mobile_app 64k;
        resolver 192.168.53.1 192.168.53.2 valid=5s status_zone=consul;
        resolver_timeout 1s;
        server mobile.prod.example.com resolve; # Use upstream resolver
    }
 
    # ...
}

# vim: syntax=nginx

For a discussion of these files, see Announcing NGINX Plus Release 20