nginx.conf

worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /usr/local/openresty/nginx/conf/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                      'request ID "$upstream_http_x_men_requestid" '
                      '$request_time';

    log_format access_log_json    '{ "timestamp": "$msec", '
                                '"nginx": { '
                                '"remote_addr": "$remote_addr", '
                                '"remote_user": "$remote_user", '
                                '"body_bytes_sent": "$body_bytes_sent", '
                                '"status": "$status", '
                                '"request_method": "$request_method", '
                                '"request_uri": "$request_uri", '
                                '"uri": "$uri", '
                                '"request_time": "$request_time", '
                                '"request_id": "$upstream_http_x_men_requestid", '
                                '"http_referrer": "$http_referer", '
                                '"http_x_forwarded_for": "$http_x_forwarded_for", '
                                '"http_user_agent": "$http_user_agent" } }';

    access_log  /var/log/nginx/access.log  @LOGS_FORMAT@;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    proxy_cache_path /data/nginx/cache/ui levels=1:2 keys_zone=ui_cache:10m max_size=100m
                     inactive=1h use_temp_path=off;

    limit_req_zone $binary_remote_addr zone=mylimit:10m rate=@RATE_LIMIT_GLOBAL_RATE@;
    limit_req zone=mylimit @RATE_LIMIT_GLOBAL_BURST@ nodelay;
    limit_req_status 429;

    #gzip  on;
    server {
        listen 80;

        server_name _;

        return 301 https://$http_host$request_uri;
    }

    server {
        listen 443 ssl http2;
        server_name @ALLOWED_HOSTS@;

        include /usr/local/openresty/nginx/conf/optional/endpoints/*.conf;

        ssl_certificate /var/www/mendersoftware/cert/cert.crt;
        ssl_certificate_key /var/www/mendersoftware/cert/private.key;

        ssl_protocols TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!MD5:!SHA;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_tickets off;
        ssl_stapling on;
        ssl_stapling_verify on;

        # non https requests are redirected to https
        error_page 497 =301 https://$http_host$request_uri;

        # validate Origin header if present
        set $origin_valid 0;
        if ($http_origin = '') {
            set $origin_valid 1;
        }
        if ($http_origin = $scheme://$host) {
            set $origin_valid 1;
        }
        if ($http_origin = $scheme://$host:$server_port) {
            set $origin_valid 1;
        }
        if ($http_origin ~* ^((https?:\/\/)?(@ALLOWED_ORIGIN_HOSTS@))$) {
            set $origin_valid 1;
        }
        if ($origin_valid = 0) {
            return 400;
        }

        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        # additional headers for application security
        add_header X-XSS-Protection "1; mode=block";
        add_header Cache-Control "no-cache, no-store";
        add_header Pragma "no-cache";

        # more_set_headers cannot be used in server if block, and we want to
        # avoid adding it to every location block, so we're going to set
        # Access-Control-Allow-Origin on every 401 response
        more_set_headers -s 401 "Access-Control-Allow-Origin: *";

        # the following locations are for device-originating requests to our APIs
        # we route selected requests to devauth via the 'auth_request' module
        # we also transform the url scheme:
        #
        # /api/devices/v1/authentication -> mender-device-auth:8080/api/0.0.1/...
        # /api/devices/v1/deployments/... -> mender-deployments:8080/api/0.0.1/...

        # device authentication
        location /api/devices/v1/authentication/{
            proxy_pass http://mender-device-auth:8080;
        }

        # deployments
        location = /api/devices/v1/deployments/device/deployments/next{
            auth_request /devauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            proxy_pass http://mender-deployments:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }
        location ~ /api/devices/v1/deployments/device/deployments/(?<depid>.*)/log{
            auth_request /devauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            client_max_body_size 10M;
            proxy_pass http://mender-deployments:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }
        location ~ /api/devices/v1/deployments/device/deployments/(?<depid>.*)/status{
            auth_request /devauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            proxy_pass http://mender-deployments:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }

        location ~ /api/devices/v1/inventory/device/attributes{
            auth_request /devauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            rewrite ^.*$ /api/0.1.0/attributes break;
            proxy_pass http://mender-inventory:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }

        # the following locations are for requests to our APIs from UIs, etc
        # no auth
        # examples:
        # /api/management/v1/devauth -> mender-device-auth/api/0.1.0/...
        # /api/management/v1/deployments/... -> mender-deployments:8080/api/0.0.1/...

        # user authz endpoint
        location = /api/management/v1/useradm/auth/login{
            proxy_pass http://mender-useradm:8080/api/management/v1/useradm/auth/login;
        }

        # exclude Device API endpoints from Management API routing
        # todo: remove with unifying routing
        location ~ /api/management/v1/deployments/device/.*{
            return 404;
        }

        location = /api/management/v1/inventory/device/attributes{
            return 404;
        }

        # user administration
        location ~ /api/management/(v[0-9]+)/useradm/{
            auth_request /userauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            proxy_pass http://mender-useradm:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }

        # device authentication
       location ~ /api/management/(v[0-9]+)/devauth/{
            auth_request /userauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            proxy_pass http://mender-device-auth:8080;
           proxy_set_header X-MEN-RequestID $requestid;
       }

        # device admission
        location ~ /api/management/v1/admission(?<endpoint>/.*){
            auth_request /userauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            proxy_pass http://mender-device-auth:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }

        # deployments
        location = /api/management/v1/deployments/artifacts {
            auth_request /userauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            client_max_body_size 10G;

            # do not buffer incoming upload requests into an intermediate file,
            # deployments service performs an upload to storage engine while
            # receiving the file from the client
            proxy_request_buffering off;

            proxy_pass http://mender-deployments:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }
        location ~ /api/management/v1/deployments(?<endpoint>/.*){
            auth_request /userauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            proxy_pass http://mender-deployments:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }

        # inventory
        location ~ /api/management/v1/inventory(?<endpoint>/.*){
            auth_request /userauth;
            auth_request_set $requestid $upstream_http_x_men_requestid;

            rewrite ^.*$ /api/0.1.0$endpoint break;
            proxy_pass http://mender-inventory:8080;
            proxy_set_header X-MEN-RequestID $requestid;
        }

        # this is our verification endpoint definition (alias over /devauth/tokens/verify)
        # used only internally to authenticate device requests (not a real endpoint)
        location = /devauth {
            internal;
            proxy_method POST; #default would be GET, but our endpoint doesn't accept that
            proxy_pass http://mender-device-auth:8080/api/internal/v1/devauth/tokens/verify;
            proxy_pass_request_body off;
            proxy_set_header Content-Length "";
        }

        # case similar to /devauth but this time for user verification
        location = /userauth {
            internal;

            if ($request_method = OPTIONS) {
                return 200;
            }

            client_max_body_size 0;
            proxy_method POST;
            proxy_pass http://mender-useradm:8080/api/internal/v1/useradm/auth/verify;
            proxy_pass_request_body off;
            proxy_set_header Content-Length "";
            proxy_set_header X-Original-URI $request_uri;
            proxy_set_header X-Original-Method $request_method;
        }

        # UI
        location = /ui {
            return 301 /ui/;
        }

        location /ui {

            proxy_cache ui_cache;
            proxy_cache_revalidate on;
            proxy_ignore_headers Cache-Control Set-Cookie;
            proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;

            proxy_cache_valid 200 301 302 @CACHE_UI_SUCCESS_PERIOD@;
            proxy_cache_valid any @CACHE_UI_FAILURE_PERIOD@;

            add_header X-Cache-Status $upstream_cache_status;

            # UI application is in React.js all content is static.
            expires @CACHE_UI_BROWSER_PERIOD@;

            rewrite ^/ui/(.*)$ /$1 break;
            proxy_pass http://mender-gui:80;
        }

        # redirect / to UI
        location = / {
            return 301 https://$http_host/ui/;
        }

    }
}