<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div id="compose-container" itemscope="" itemtype="https://schema.org/EmailMessage" style="direction:ltr">
<span itemprop="creator" itemscope="" itemtype="https://schema.org/Organization"><span itemprop="name"></span></span>
<div>
<div>
<div style="direction:ltr">Hi peter,</div>
<div><br>
</div>
<div style="direction:ltr">I generate configs already using a template engine (more specific Laravel Blade), so creating the functionality in the template is easy, however, I generally don’t like having server blocks that can be 100s of lines because of repeating
things</div>
<div><br>
</div>
<div style="direction:ltr">I don’t know the internals of nginx fully, how it uses memory when storing configs, but I would assume that inheritance is better than duplication in terms of memory usage.</div>
<div><br>
</div>
<div style="direction:ltr">I’m just wondering if there’s a way I can avoid the if condition within the location blocks.</div>
<div><br>
</div>
<div style="direction:ltr">- lucas</div>
</div>
<div><br>
</div>
<div class="acompli_signature">Get <a href="https://aka.ms/o0ukef">Outlook for iOS</a></div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> nginx <nginx-bounces@nginx.org> on behalf of Peter Booth <peter_booth@me.com><br>
<b>Sent:</b> Wednesday, March 7, 2018 11:08:40 PM<br>
<b>To:</b> nginx@nginx.org<br>
<b>Subject:</b> Re: location blocks, and if conditions in server context</font>
<div> </div>
</div>
<div>I agree that avoiding if is a good thing. But avoiding duplication isn’t always good.
<div><br>
</div>
<div>Have you considered a model where your configuration file is generated with a templating engine? The input file that you modify to add/remove/change configurations could be free of duplication but the conf file that nginx reads could be concrete and verbose <br>
<br>
<div id="AppleMailSignature">Sent from my iPhone</div>
<div><br>
On Mar 7, 2018, at 11:55, Lucas Rolff <<a href="mailto:lucas@lucasrolff.com">lucas@lucasrolff.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>
<!--
@font-face
{font-family:"Cordia New"}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:DengXian}
@font-face
{font-family:Calibri}
@font-face
{}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif}
a:link, span.MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
span.EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
.MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:3.0cm 2.0cm 3.0cm 2.0cm}
div.WordSection1
{}
-->
</style>
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Hi guys,</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I have a few hundred nginx zones, where I try to remove as much duplicate code as possible, and inherit as much as possible to prevent nginx from consuming memory (and also to keep things clean).</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"><br>
However I came across something today, that I don’t know how to get my head around without duplicating code, even within a single server context.</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I have a set of distributed nginx servers, all these requires SSL certificates, where I use Let’s Encrypt to do this.</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">When doing the Let’s Encrypt validation, it uses a path such as /.well-known/acme-challenge/<hash></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">For this, I made a location block such as:</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> location ~* /.well-known {</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_pass
<a href="http://letsencrypt.validation.backend.com$request_uri">http://letsencrypt.validation.backend.com$request_uri</a>;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> }</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Basically, I proxy_pass to the backend where I actually run the acme client – works great.</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">However, I have an option to force a redirect from http to https, and I’ve implemented that by doing an if condition on the server block level (so not within a location):</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> if ($sslproxy_protocol = "http") {</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> return 301
<a href="https://$host$request_uri">https://$host$request_uri</a>;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> }</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">This means I have something like:</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">1: location ~* /.well-known</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">2: if condition doing redirect if protocol is http</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">3: location /</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">4: location /api</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">5: location /test</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">All my templates include 1 to 3, and *<b>might</b>* have additional locations.</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">I’ve decided to not put e.g. location /api inside the location / - because there’s things I don’t want to inherit, thus keeping them at the same “level”, and not a location context inside a location
context.</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Things I don’t want to inherit, is stuff such as headers, max_ranges directive etc.</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">My issue is – because of this if condition that does the redirect to https – it also applies to my
<b>location ~* /.well-known</b> – thus causing a redirect, and I want to prevent this, since it breaks the Let’s Encrypt validation (they do not accept 301 redirects).</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">A solution would be to move the if condition into each location block that I want to have redirected, but then I start repeating myself 1, 2 or even 10 times – which I don’t wanna do.</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Is there a smart way without adding too much complexity, which is still super-fast (I know if is evil) ?</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">A config example is seen below:</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">server {</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> listen 80;</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> listen 443 ssl http2;</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><span lang="EN-US" style="font-size:11.0pt">server_name
<a href="http://secure.domain.com">secure.domain.com</a>;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> access_log /var/log/nginx/<a href="http://secure.domain.com">secure.domain.com</a> main;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> location ~* /.well-known {</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_pass
<a href="http://letsencrypt.validation.backend.com$request_uri">http://letsencrypt.validation.backend.com$request_uri</a>;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> }</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> if ($sslproxy_protocol = "http") {</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> return 301
<a href="https://$host$request_uri">https://$host$request_uri</a>;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> }</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> location / {</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> expires 10m;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> etag off;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_ignore_client_abort on;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_intercept_errors on;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_next_upstream error timeout invalid_header;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_ignore_headers Set-Cookie Vary X-Accel-Expires Expires Cache-Control;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> more_clear_headers Set-Cookie Cookie Upgrade;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache one;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache_min_uses 1;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache_lock off;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache_valid 200 10m;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache_valid any 1m;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache_revalidate on;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_ssl_server_name on;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> include /etc/nginx/server.conf;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_set_header Host
<a href="http://backend-host.com">backend-host.com</a>;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_cache_key "<a href="http://backend-host.com-1-$request_uri">http://backend-host.com-1-$request_uri</a>";</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_pass
<a href="http://backend-host.com$request_uri">http://backend-host.com$request_uri</a>;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> proxy_redirect off;</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> }</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">}</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Thank you in advance!</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt"> </span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Best Regards,</span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt">Lucas Rolff</span></p>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>nginx mailing list</span><br>
<span><a href="mailto:nginx@nginx.org">nginx@nginx.org</a></span><br>
<span><a href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a></span></div>
</blockquote>
</div>
</div>
</body>
</html>