-
-
Save nginx-gists/37ce65292a06219ff8d35d293c05e0b5 to your computer and use it in GitHub Desktop.
Deploying NGINX Plus as an API Gateway, Part 1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| upstream warehouse_inventory { | |
| zone inventory_service 64k; | |
| server 10.0.0.1:80; | |
| server 10.0.0.2:80; | |
| server 10.0.0.3:80; | |
| } | |
| upstream warehouse_pricing { | |
| zone pricing_service 64k; | |
| server 10.0.0.7:80; | |
| server 10.0.0.8:80; | |
| server 10.0.0.9:80; | |
| } | |
| # vim: syntax=nginx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| log_format api_main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent ' | |
| '"$http_referer" '"$http_user_agent" "$http_x_forwarded_for" "$api_name"'; | |
| include api_endpoints.conf; | |
| include api_keys.conf; | |
| server { | |
| set $api_name -; # Start with an undefined API name, each API will update this value | |
| access_log /var/log/nginx/api_access.log api_main; # Each API may also log to a separate file | |
| listen 443 ssl; | |
| server_name api.example.com; | |
| # TLS config | |
| ssl_certificate /etc/ssl/certs/api.example.com.crt; | |
| ssl_certificate_key /etc/ssl/private/api.example.com.key; | |
| ssl_session_cache shared:SSL:10m; | |
| ssl_session_timeout 5m; | |
| ssl_ciphers HIGH:!aNULL:!MD5; | |
| ssl_protocols TLSv1.1 TLSv1.2; | |
| # API definitions, one per file | |
| include api_conf.d/*.conf; | |
| # Error responses | |
| error_page 404 = @400; # Invalid paths are treated as bad requests | |
| proxy_intercept_errors on; # Do not send endpoint errors to the client | |
| include api_json_errors.conf; # API client friendly JSON error responses | |
| default_type application/json; # If no content-type then assume JSON | |
| } | |
| # vim: syntax=nginx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| error_page 400 = @400; | |
| location @400 { return 400 '{"status":400,"message":"Bad request"}\n'; } | |
| error_page 401 = @401; | |
| location @401 { return 401 '{"status":401,"message":"Unauthorized"}\n'; } | |
| error_page 403 = @403; | |
| location @403 { return 403 '{"status":403,"message":"Forbidden"}\n'; } | |
| error_page 404 = @404; | |
| location @404 { return 404 '{"status":404,"message":"Resource not found"}\n'; } | |
| error_page 405 = @405; | |
| location @405 { return 405 '{"status":405,"message":"Method not allowed"}\n'; } | |
| error_page 408 = @408; | |
| location @408 { return 408 '{"status":408,"message":"Request timeout"}\n'; } | |
| error_page 413 = @413; | |
| location @413 { return 413 '{"status":413,"message":"Payload too large"}\n'; } | |
| error_page 414 = @414; | |
| location @414 { return 414 '{"status":414,"message":"Request URI too large"}\n'; } | |
| error_page 415 = @415; | |
| location @415 { return 415 '{"status":415,"message":"Unsupported media type"}\n'; } | |
| error_page 426 = @426; | |
| location @426 { return 426 '{"status":426,"message":"HTTP request was sent to HTTPS port"}\n'; } | |
| error_page 429 = @429; | |
| location @429 { return 429 '{"status":429,"message":"API rate limit exceeded"}\n'; } | |
| error_page 500 = @500; | |
| location @500 { return 500 '{"status":500,"message":"Server error"}\n'; } | |
| error_page 501 = @501; | |
| location @501 { return 501 '{"status":501,"message":"Not implemented"}\n'; } | |
| error_page 502 = @502; | |
| location @502 { return 502 '{"status":502,"message":"Bad gateway"}\n'; } | |
| # vim: syntax=nginx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| map $http_apikey $api_client_name { | |
| default ""; | |
| "7B5zIqmRGXmrJTFmKa99vcit" "client_one"; | |
| "QzVV6y1EmQFbbxOfRCwyJs35" "client_two"; | |
| "mGcjH8Fv6U9y3BVF9H3Ypb9T" "client_six"; | |
| } | |
| # vim: syntax=nginx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| user nginx; | |
| worker_processes auto; | |
| error_log /var/log/nginx/error.log notice; | |
| pid /var/run/nginx.pid; | |
| load_module /etc/nginx/modules/ngx_http_js_module.so; | |
| events { | |
| worker_connections 1024; | |
| } | |
| http { | |
| include /etc/nginx/mime.types; | |
| default_type application/octet-stream; | |
| log_format main '$remote_addr - $remote_user [$time_local] "$request" ' | |
| '$status $body_bytes_sent "$http_referer" ' | |
| '"$http_user_agent" "$http_x_forwarded_for"'; | |
| access_log /var/log/nginx/access.log main; | |
| sendfile on; | |
| #tcp_nopush on; | |
| keepalive_timeout 65; | |
| include /etc/nginx/api_gateway.conf; # All API gateway configuration | |
| include /etc/nginx/conf.d/*.conf; # Regular web traffic | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # API definition (precise) | |
| # | |
| location = /api/warehouse/inventory { # Complete inventory | |
| set $upstream inventory_service; | |
| rewrite ^ /_warehouse last; | |
| } | |
| location ~ ^/api/warehouse/inventory/shelf/[^/]*$ { # Shelf inventory | |
| set $upstream inventory_service; | |
| rewrite ^ /_warehouse last; | |
| } | |
| location ~ ^/api/warehouse/inventory/shelf/[^/]*/box/[^/]*$ { # Box on shelf | |
| set $upstream inventory_service; | |
| rewrite ^ /_warehouse last; | |
| } | |
| location ~ ^/api/warehouse/pricing/[^/]*$ { # Price for specific item | |
| set $upstream pricing_service; | |
| rewrite ^ /_warehouse last; | |
| } | |
| # Policy section | |
| # | |
| location = /_warehouse { | |
| internal; | |
| set $api_name warehouse_api; | |
| # Policy configuration here (authentication, rate limiting, logging, more...) | |
| proxy_pass http://$upstream$request_uri; | |
| } | |
| # vim: syntax=nginx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # API definition | |
| # | |
| location /api/warehouse/inventory { | |
| set $upstream warehouse_inventory; | |
| rewrite ^ /_warehouse last; | |
| } | |
| location /api/warehouse/pricing { | |
| set $upstream warehouse_pricing; | |
| rewrite ^ /_warehouse last; | |
| } | |
| # Policy section | |
| # | |
| location = /_warehouse { | |
| internal; | |
| set $api_name "Warehouse"; | |
| # Policy configuration here (authentication, rate limiting, logging, more...) | |
| proxy_pass http://$upstream$request_uri; | |
| } | |
| # vim: syntax=nginx |
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
For a discussion of these files, see Deploying NGINX Plus as an API Gateway, Part 1