60 lines
1.6 KiB
Nginx Configuration File
60 lines
1.6 KiB
Nginx Configuration File
load_module /usr/lib64/nginx/modules/ngx_stream_module.so;
|
|
|
|
worker_processes 8;
|
|
|
|
events {}
|
|
|
|
stream {
|
|
log_format basic '$remote_addr $domain [$time_local] '
|
|
'$protocol $status $bytes_sent $bytes_received '
|
|
'$session_time';
|
|
|
|
include /etc/nginx/stream.d/*.conf;
|
|
|
|
# Map all SSL parsed server names to hosts
|
|
map $ssl_preread_server_name $domain {
|
|
|
|
"" 127.0.0.1:443;
|
|
|
|
# For each domain we need to stream to a remote server, forward to internal ip
|
|
{% for item in (stream | subelements('external.domains')) %}
|
|
{{ item.1 }} {{ item.0.internal.ip }}:{{ item.0.internal.port }};
|
|
{% endfor %}
|
|
|
|
# For each domain we want to terminate, forward to internal http server
|
|
{% for item in (http | subelements('external.domains')) %}
|
|
{{ item.1 }} 127.0.0.1:443;
|
|
{% endfor %}
|
|
|
|
default {{ nginx.defaults.domain }}:443;
|
|
}
|
|
|
|
# Forward 443 traffic
|
|
server {
|
|
access_log /var/log/nginx/stream-access-443.log basic;
|
|
listen {{ ansible_default_ipv4.address }}:443;
|
|
resolver 1.1.1.1;
|
|
proxy_pass $domain;
|
|
ssl_preread on;
|
|
proxy_socket_keepalive on;
|
|
}
|
|
}
|
|
|
|
http {
|
|
log_format compression '$remote_addr - $remote_user [$time_local] '
|
|
'"$request" $status $bytes_sent '
|
|
'"$http_referer" "$http_user_agent" "$gzip_ratio"';
|
|
|
|
server {
|
|
access_log /var/log/nginx/http-access.log compression;
|
|
|
|
listen 80 default_server;
|
|
|
|
if ($scheme = "http") {
|
|
return 301 https://$host:443$request_uri;
|
|
}
|
|
}
|
|
|
|
include /etc/nginx/http.d/*.conf;
|
|
}
|