nginx.tmpl

user  nginx;
worker_processes  {{.WorkerProcesses}};
{{- if .WorkerRlimitNofile}}
worker_rlimit_nofile {{.WorkerRlimitNofile}};{{end}}
{{- if .WorkerCPUAffinity}}
worker_cpu_affinity {{.WorkerCPUAffinity}};{{end}}
{{- if .WorkerShutdownTimeout}}
worker_shutdown_timeout {{.WorkerShutdownTimeout}};{{end}}
daemon off;

error_log  /var/log/nginx/error.log {{.ErrorLogLevel}};
pid        /var/run/nginx.pid;

{{- if .MainSnippets}}
{{range $value := .MainSnippets}}
{{$value}}{{end}}
{{- end}}

events {
    worker_connections  {{.WorkerConnections}};
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    {{- if .HTTPSnippets}}
    {{range $value := .HTTPSnippets}}
    {{$value}}{{end}}
    {{- end}}

    {{if .LogFormat -}}
    log_format  main  '{{.LogFormat}}';
    {{- else -}}
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    {{- end}}

    {{if .AccessLogOff}}
    access_log off;
    {{else}}
    access_log  /var/log/nginx/access.log  main;
    {{end}}

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout {{.KeepaliveTimeout}};
    keepalive_requests {{.KeepaliveRequests}};

    #gzip  on;

    server_names_hash_max_size {{.ServerNamesHashMaxSize}};
    {{if .ServerNamesHashBucketSize}}server_names_hash_bucket_size {{.ServerNamesHashBucketSize}};{{end}}

    variables_hash_bucket_size {{.VariablesHashBucketSize}};
    variables_hash_max_size {{.VariablesHashMaxSize}};

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }
    {{if .SSLProtocols}}ssl_protocols {{.SSLProtocols}};{{end}}
    {{if .SSLCiphers}}ssl_ciphers "{{.SSLCiphers}}";{{end}}
    {{if .SSLPreferServerCiphers}}ssl_prefer_server_ciphers on;{{end}}
    {{if .SSLDHParam}}ssl_dhparam {{.SSLDHParam}};{{end}}

    server {
        listen 80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};
        listen 443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};

        ssl_certificate /etc/nginx/secrets/default;
        ssl_certificate_key /etc/nginx/secrets/default;

        server_name _;
        server_tokens "{{.ServerTokens}}";
        access_log off;

        {{if .HealthStatus}}
        location /nginx-health {
            default_type text/plain;
            return 200 "healthy\n";
        }
        {{end}}

        location / {
           return 404;
        }
    }

    {{- if .NginxStatus}}
    # stub_status
    server {
        listen {{.NginxStatusPort}};
        {{range $value := .NginxStatusAllowCIDRs}}
        allow {{$value}};{{end}}
        deny all;
        location /stub_status {
            stub_status;
        }
    }
    {{- end}}

    {{- if .StubStatusOverUnixSocketForOSS }}
    server {
        listen unix:/var/run/nginx-status.sock;
        access_log off;

        location /stub_status {
            stub_status;
        }
    }
    {{- end}}

    include /etc/nginx/config-version.conf;
    include /etc/nginx/conf.d/*.conf;

    server {
        listen unix:/var/run/nginx-502-server.sock;
        access_log off;

        location / {
            return 502;
        }
    }
}

stream {
    {{if .StreamLogFormat -}}
    log_format  stream-main  '{{.StreamLogFormat}}';
    {{- else -}}
    log_format  stream-main  '$remote_addr [$time_local] '
                      '$protocol $status $bytes_sent $bytes_received '
                      '$session_time';
    {{- end}}

    access_log  /var/log/nginx/stream-access.log  stream-main;

    {{range $value := .StreamSnippets}}
    {{$value}}{{end}}
}