supermq/docker/nginx/nginx-key.conf

# Copyright (c) Abstract Machines
# SPDX-License-Identifier: Apache-2.0

# This is the default Magistrala NGINX configuration.

user nginx;
worker_processes auto;
worker_cpu_affinity auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    # Explanation: https://serverfault.com/questions/787919/optimal-value-for-nginx-worker-connections
    # We'll keep 10k connections per core (assuming one worker per core)
    worker_connections 10000;
}

http {
    include snippets/http_access_log.conf;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    # Include single-node or multiple-node (cluster) upstream
    include snippets/mqtt-ws-upstream.conf;

    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        listen 443 ssl default_server;
        listen [::]:443 ssl default_server;
        http2 on;

        set $dynamic_server_name "$MG_NGINX_SERVER_NAME";

        if ($dynamic_server_name = '') {
            set $dynamic_server_name "localhost";
        }

        server_name $dynamic_server_name;

        include snippets/ssl.conf;

        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header Access-Control-Allow-Origin '*';
        add_header Access-Control-Allow-Methods '*';
        add_header Access-Control-Allow-Headers '*';

        location ~ ^/(channels)/(.+)/(things)/(.+) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://things:${MG_THINGS_HTTP_PORT};
        }
        # Proxy pass to users & groups id to things service for listing of channels
        # /users/{userID}/channels - Listing of channels belongs to userID
        # /groups/{userGroupID}/channels - Listing of channels belongs to userGroupID
        location ~ ^/(users|groups)/(.+)/(channels|things) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            if ($request_method = GET) {
                proxy_pass http://things:${MG_THINGS_HTTP_PORT};
                break;
            }
            proxy_pass http://users:${MG_USERS_HTTP_PORT};
        }

        # Proxy pass to channel id to users service for listing of channels
        # /channels/{channelID}/users - Listing of Users belongs to channelID
        # /channels/{channelID}/groups - Listing of User Groups belongs to channelID
        location ~ ^/(channels|things)/(.+)/(users|groups) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            if ($request_method = GET) {
                proxy_pass http://users:${MG_USERS_HTTP_PORT};
                break;
            }
            proxy_pass http://things:${MG_THINGS_HTTP_PORT};
        }

        # Proxy pass to user id to auth service for listing of domains
        # /users/{userID}/domains - Listing of Domains belongs to userID
        location ~ ^/(users)/(.+)/(domains) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            if ($request_method = GET) {
                proxy_pass http://auth:${MG_AUTH_HTTP_PORT};
                break;
            }
            proxy_pass http://users:${MG_USERS_HTTP_PORT};
        }

        # Proxy pass to domain id to users service for listing of users
        # /domains/{domainID}/users - Listing of Users belongs to domainID
        location ~ ^/(domains)/(.+)/(users) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            if ($request_method = GET) {
                proxy_pass http://users:${MG_USERS_HTTP_PORT};
                break;
            }
            proxy_pass http://auth:${MG_AUTH_HTTP_PORT};
        }


        # Proxy pass to auth service
        location ~ ^/(domains) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://auth:${MG_AUTH_HTTP_PORT};
        }

        # Proxy pass to users service
        location ~ ^/(users|groups|password|authorize|oauth/callback/[^/]+) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://users:${MG_USERS_HTTP_PORT};
        }

        location ^~ /users/policies {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://users:${MG_USERS_HTTP_PORT}/policies;
        }

        # Proxy pass to things service
        location ~ ^/(things|channels|connect|disconnect|identify) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://things:${MG_THINGS_HTTP_PORT};
        }

        location ^~ /things/policies {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://things:${MG_THINGS_HTTP_PORT}/policies;
        }

        # Proxy pass to invitations service
        location ~ ^/(invitations) {
            include snippets/proxy-headers.conf;
            add_header Access-Control-Expose-Headers Location;
            proxy_pass http://invitations:${MG_INVITATIONS_HTTP_PORT};
        }

        location /health {
            include snippets/proxy-headers.conf;
            proxy_pass http://things:${MG_THINGS_HTTP_PORT};
        }

        location /metrics {
            include snippets/proxy-headers.conf;
            proxy_pass http://things:${MG_THINGS_HTTP_PORT};
        }

        # Proxy pass to magistrala-http-adapter
        location /http/ {
            include snippets/proxy-headers.conf;

            # Trailing `/` is mandatory. Refer to the http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass
            # If the proxy_pass directive is specified with a URI, then when a request is passed to the server,
            # the part of a normalized request URI matching the location is replaced by a URI specified in the directive
            proxy_pass http://http-adapter:${MG_HTTP_ADAPTER_PORT}/;
        }

        # Proxy pass to magistrala-mqtt-adapter over WS
        location /mqtt {
            include snippets/proxy-headers.conf;
            include snippets/ws-upgrade.conf;
            proxy_pass http://mqtt_ws_cluster;
        }

        # Proxy pass to magistrala-ws-adapter
        location /ws/ {
            include snippets/proxy-headers.conf;
            include snippets/ws-upgrade.conf;
            proxy_pass http://ws-adapter:${MG_WS_ADAPTER_HTTP_PORT}/;
        }
    }
}

# MQTT
stream {
   include snippets/stream_access_log.conf;

    # Include single-node or multiple-node (cluster) upstream
    include snippets/mqtt-upstream.conf;

    server {
        listen ${MG_NGINX_MQTT_PORT};
        listen [::]:${MG_NGINX_MQTT_PORT};
        listen ${MG_NGINX_MQTTS_PORT} ssl;
        listen [::]:${MG_NGINX_MQTTS_PORT} ssl;

        include snippets/ssl.conf;

        proxy_pass mqtt_cluster;
    }
}

error_log info.log info;