Announcing NGINX Plus R15

cookie_signing.js

function signCookie(r) {
    if (r.headers["set-cookie"].length) {
        // Response includes a new cookie
        var cookie_data = r.headers["set-cookie"].split(";");
        var c = require('crypto');
        var h = c.createHmac('sha256').update(cookie_data[0] + r.remoteAddress);
        return "signature=" + h.digest('hex');
    }
    return "";
}

function validateCookieSignature(r) {
    var raw_cookie = r.variables["cookie_" + r.variables.cookie_name];
    if (raw_cookie.length) {
        // Cookie is present, ensure signed version
        var sig_cookie = r.variables["cookie_signature"];
        if (sig_cookie.length) {
            // Signature presented, check for match
            var c = require('crypto');
            var h = c.createHmac('sha256').update(r.variables.cookie_name + "=" + raw_cookie + r.remoteAddress);
            if (h.digest('hex') == sig_cookie) {
                return ""; // Success
            }
        }
    } else {
        return ""; // No cookie presented therefore no validation
    }
    return "1"; // Failure
}

export default { signCookie, validateCookieSignature }

fastest_wins.js

function sendFastest(r) {
    var n = 0;
    function done(reply) { // Callback for completed subrequests
        if (n++ == 0) {
            r.log("WINNER is " + reply.uri);
            r.return(reply.status, reply.body);
        }
    }
    r.subrequest("/server_one", r.variables.args, done);
    r.subrequest("/server_two", r.variables.args, done);
}

export default { sendFastest }

http_push.conf

server {
    # Ensure that HTTP/2 is enabled for the server        
    listen 443 ssl http2;

    ssl_certificate     ssl/certificate.pem;
    ssl_certificate_key ssl/key.pem;

    root /var/www/html;

    # when a client requests demo.html, also push
    # /style.css, /image1.jpg and /image2.jpg
    location = /demo.html {
        http2_push /style.css;
        http2_push /image1.jpg;
        http2_push /image2.jpg;
    }
}
# vim: syntax=nginx

http_push_preload.conf

server {
    listen 443 ssl http2;

    ssl_certificate ssl/certificate.pem;
    ssl_certificate_key ssl/key.pem;

    root /var/www/html;

    http2_push_preload on;
}
# vim: syntax=nginx

log_upstream_queueing.conf

log_format timing '$remote_addr - $remote_user [$time_local] "$request" $status '
                  '$body_bytes_sent "$http_referer" "$http_user_agent" '
                  '$request_time $upstream_queue_time $upstream_response_time';

upstream my_backend {
    zone my_backend 64k;
    server backends.example.com resolve max_conns=250;
    queue 20 timeout=5s; # Queue up to 20 requests when no backends available
}

server {
    listen 80;
    location / {
        proxy_pass http://my_backend;
        access_log /var/log/nginx/access.log timing;
    }
}
# vim: syntax=nginx

njs_hash_functions.conf

js_import cookie_signing.js
js_set $signature_error cookie_signing.validateCookieSignature;
js_set $signed_cookie cookie_signing.signCookie;

server {
    listen 80;

    set $cookie_name "session"; # The cookie name to be signature-checked
    location / {
        if ($signature_error) {
            return 403; # Unauthorized
        }
        proxy_pass http://my_backend;
        add_header Set-Cookie $signed_cookie;
    }
}
# vim: syntax=nginx

njs_subrequest.conf

js_import fastest_wins.js;

server {
    listen 80;

    location / {
        js_content fastest_wins.sendFastest;
    }

    location /server_one {
        proxy_pass http://10.0.0.1$request_uri; # Pass the original URI
    }

    location /server_two {
        proxy_pass http://10.0.0.2$request_uri;
    }
}
# vim: syntax=nginx

stream_alpn.conf

stream {
    map $ssl_preread_alpn_protocols $upstream {
        "xmpp-client"     xmpp_backend;
        "~\bh2\b"         grpc_backend; # 'h2' appears within word boundaries (\b)
        default           http_backend; # Treat all other clients as HTTP
    }

    upstream xmpp_backend {
        #...
    }
    upstream grpc_backend {
        #...
    }
    upstream http_backend {
        #...
    }

    server {
        listen 443 ssl;
        # Set ssl_certificate and ciphers here

        ssl_preread on;
        proxy_pass $upstream;
    }
}
# vim: syntax=nginx

zone_sync_basic.conf

stream {
    resolver 10.0.0.53 valid=20s;

    server {
        listen 9000;
        zone_sync;
        zone_sync_server nginx-cluster.example.com:9000 resolve;
    }
}
# vim: syntax=nginx

zone_sync_production.conf

stream {
    resolver 10.0.0.53 valid=20s;

    server {
        zone_sync;
        zone_sync_server nginx-cluster.example.com:9000 resolve;

        listen 10.0.0.1:9000 ssl; # Listen on internal IP address, require TLS
        ssl_certificate_key  /etc/ssl/nginx-1.example.com.key.pem;
        ssl_certificate      /etc/ssl/nginx-1.example.com.server_cert.pem;

        allow 10.0.0.0/24;  # Only accept connections from internal network
        deny  all;

        zone_sync_ssl_verify              on; # Peers must connect with client cert
        zone_sync_ssl_trusted_certificate /etc/ssl/ca_chain.crt.pem;
        zone_sync_ssl_verify_depth        2;

        zone_sync_ssl                 on; # Connect to peers with TLS, offer client cert
        zone_sync_ssl_certificate     /etc/ssl/nginx-1.example.com.client_cert.pem;
        zone_sync_ssl_certificate_key /etc/ssl/nginx-1.example.com.key.pem;
    }
}
# vim: syntax=nginx

zone_sync_sticky_learn.conf

upstream my_backend {
    zone my_backend 64k;
    server backends.example.com resolve;
    sticky learn zone=sessions:1m
                 create=$upstream_cookie_session
                 lookup=$cookie_session
                 sync;
}

server {
    listen 80;
    location / {
        proxy_pass http://my_backend;
    }
}
# vim: syntax=nginx

For a discussion of these files, see Announcing NGINX Plus R15