diff --git a/content/nginx-one/workshops/LICENSE b/content/nginx-one/workshops/LICENSE new file mode 100644 index 000000000..d9a10c0d8 --- /dev/null +++ b/content/nginx-one/workshops/LICENSE @@ -0,0 +1,176 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS diff --git a/content/nginx-one/workshops/_index.md b/content/nginx-one/workshops/_index.md new file mode 100644 index 000000000..ddd2b58bd --- /dev/null +++ b/content/nginx-one/workshops/_index.md @@ -0,0 +1,6 @@ +--- +title: Workshops +description: +weight: 300 +url: /nginx-one/workshops +--- diff --git a/content/nginx-one/workshops/lab1/getting-started-with-nginx-one.md b/content/nginx-one/workshops/lab1/getting-started-with-nginx-one.md new file mode 100644 index 000000000..cfc7c6ad2 --- /dev/null +++ b/content/nginx-one/workshops/lab1/getting-started-with-nginx-one.md @@ -0,0 +1,126 @@ +--- +title: "Lab 1: Get started with NGINX One Console" +weight: 100 +toc: true +nd-content-type: tutorial +nd-product: NGINX-ONE +--- + +## Introduction + +This guide helps you log in to NGINX One Console and understand the basics of how it works. You’ll learn how to get started, find your way around the console, and manage your NGINX instances using data plane keys. + +## What you’ll learn + +By the end of this tutorial, you’ll know how to: + +- Open and use NGINX One Console +- Understand what NGINX One Console does and how it works +- Create, copy, and save a data plane key +- Revoke or delete a data plane key (optional) + +## Before you begin + +Make sure you have: + +- An F5 Distributed Cloud (XC) account +- NGINX One service enabled in your account +- Basic knowledge of Linux and NGINX + +--- + +## Learn what NGINX One Console does + +NGINX One Console is a cloud-based service in the F5 Distributed Cloud platform. It helps you: + +- Manage all your NGINX instances from one place +- Monitor performance and health metrics +- Catch security risks like expired SSL certificates and known vulnerabilities +- Keep track of software versions and get performance tips + +With NGINX One Console, you don’t need to switch between tools. You get a single dashboard with real-time data and alerts. + +--- + +## How NGINX One Console works + +NGINX One Console connects to each NGINX instance using a lightweight agent called **NGINX Agent**. + +The agent is responsible for securely registering and managing each instance through the console. + +There are a few ways to install NGINX Agent: + +- Use public Docker images of NGINX OSS that already include the agent +- Use NGINX Plus containers with the agent preinstalled +- Install manually using package managers like `apt` or `yum` +- Use the one-line curl command that NGINX One provides during registration + +When you register a new instance in the console, you'll get a ready-to-use `curl` command that downloads and installs the NGINX Agent on your target system. + +For more information about NGINX Agent, see the [NGINX Agent documentation](https://docs.nginx.com/nginx-agent/overview/). + +--- + +## Open and use NGINX One Console + +1. Go to [https://console.ves.volterra.io/login/start](https://console.ves.volterra.io/login/start). +2. Sign in using your Distributed Cloud account. +3. On the home page, find the **NGINX One** tile. +4. Select the tile to open the console. +5. Make sure the service status shows **Enabled**. +6. Select **Visit Service** to go to the **Overview** dashboard. + +If NGINX One Console isn’t enabled, contact your XC administrator to request access. + +When no NGINX instances are connected, the dashboard will be empty. Once you add instances, it will show metrics like availability, version, and usage trends. + +--- + +## Create and save a data plane key + +To register NGINX instances, you need a data plane key. + +1. In the console, go to **Manage > Data Plane Keys**. +2. Select **Add Data Plane Key**. +3. Enter a name for the key. +4. Set an expiration date (or keep the default of one year). +5. Select **Generate**. +6. Copy the key when it appears—**you won’t be able to see it again**. +7. Save it somewhere safe. + +You can use the same key to register many instances. If you lose the key, you’ll need to create a new one. + +--- + +## (Optional) Revoke a data plane key + +To disable a key: + +1. On the **Data Plane Keys** page, find the key you want to revoke. +2. Select the key. +3. Choose **Revoke**, then confirm. + +--- + +## (Optional) Delete a revoked key + +You can only delete a key after you revoke it. + +1. On the **Revoked Keys** tab, find the key you want to delete. +2. Select the key. +3. Choose **Delete Selected**, then confirm. + +--- + +## Next steps + +Now that you’ve explored NGINX One Console and created a key, you’re ready to connect your first NGINX instance. + +Go to [Lab 2: Run workshop components with Docker]({{< ref "nginx-one/workshops/lab2/run-workshop-components-with-docker.md" >}}) + +--- + +## References + +- [Create and manage data plane keys]({{< ref "nginx-one/connect-instances/create-manage-data-plane-keys.md" >}}) +- [NGINX Agent overview]({{< ref "agent/overview.md" >}}) \ No newline at end of file diff --git a/content/nginx-one/workshops/lab2/run-workshop-components-with-docker.md b/content/nginx-one/workshops/lab2/run-workshop-components-with-docker.md new file mode 100644 index 000000000..13eefc45d --- /dev/null +++ b/content/nginx-one/workshops/lab2/run-workshop-components-with-docker.md @@ -0,0 +1,155 @@ +--- +title: "Lab 2: Run workshop components with Docker" +weight: 200 +toc: true +nd-content-type: tutorial +nd-product: nginx-one +--- + +## Introduction + +This guide shows you how to run a demo backend application and multiple NGINX OSS and Plus containers with Docker. The backend application runs in three `nginxinc/ingress-demo` containers, each serving a simple web page. You’ll also link each NGINX container to NGINX One Console for management and monitoring. + +## What you’ll learn + +By the end of this tutorial, you’ll know how to: + +- Set up environment variables for your data plane key and license +- Log in to the NGINX private registry +- Generate self-signed certificates +- Run Docker Compose to start 9 containers +- Verify your containers in Docker and in NGINX One Console + +## Before you begin + +Make sure you have: + +- An F5 Distributed Cloud (XC) account +- NGINX One service enabled in your XC account +- Docker and Docker Compose installed and running +- An active data plane key from [Lab 1: Get started with NGINX One Console]({{< ref "nginx-one/workshops/lab1/getting-started-with-nginx-one.md" >}}) +- A trial or paid NGINX Plus JWT license (saved as `nginx-repo.jwt`) from [MyF5](https://my.f5.com/manage/s/). +- Basic Linux and NGINX know-how +- Git installed and SSH key set up for GitHub access + +--- + +## Clone the NGINX documentation repo + +1. **Clone the repo via SSH** + + ```shell + git clone git@github.com:nginx/documentation.git + ``` + +2. **Change to the Lab 2 directory** + + ```shell + cd static/workshops/nginx-one/lab2 + ``` + +This folder contains `docker-compose.yml` and `generate_certs.sh`. + +{{}} {{}} + +{{}} {{}} + +--- + +## Set environment variables + +1. **Set your data plane key** + + ```shell + export TOKEN="paste-your-data-plane-key-here" + echo "$TOKEN" + ``` + +2. **Set your NGINX Plus JWT** + + ```shell + export JWT=$(cat path/to/nginx-repo.jwt) + echo "$JWT" + ``` + +3. **Give your setup a unique name** + + Replace `your.initials` with something that identifies you or your setup (for example, `s.jobs`) + + ```shell + export NAME="your.initials" + echo "$NAME" + ``` + +--- + +## Log in to the private registry + +Pipe your JWT into Docker login: + +```shell +echo "$JWT" | docker login private-registry.nginx.com \ + --username "$JWT" --password-stdin +``` + +You should see **Login Succeeded**. + +--- + +## Generate certificates + +Run the script to create self-signed certs: + +```shell +chmod +x generate_certs.sh +./generate_certs.sh +``` + +This creates `1-day.key`, `1-day.crt`, `30-day.key`, and `30-day.crt` in the `nginx-oss/etc/ssl/nginx` subfolder. + +--- + +## Run Docker Compose + +Start all nine containers in detached mode: + +```shell +docker compose up --force-recreate -d +``` + +Wait until you see "Started" for each container. + +--- + +## Verify containers + +1. **Check Docker** + + ```shell + docker ps | grep "$NAME" + ``` + + You should see 9 containers listed. + +2. **Check NGINX One Console** + + - Go to the **Instances** page in the NGINX One Console + - Refresh and search by your `$NAME` (for example, `s.jobs`) + - Confirm each instance shows a green **Online* icon. + +If you don’t see them, double-check your `$TOKEN` or generate a new data plane key. + +--- + +## Next steps + +Now that your containers are up and registered, go on to explore NGINX One Console features in Lab 3. + +Go to [Lab 3: Explore NGINX One Console features]({{< ref "nginx-one/workshops/lab3/explore-nginx-one-console-and-features.md" >}}) + +--- + +## References + +- [NGINX One Console docs](https://docs.nginx.com/nginx-one/) +- [NGINX Agent overview](https://docs.nginx.com/nginx-agent/overview/) diff --git a/content/nginx-one/workshops/lab3/explore-nginx-one-console-and-features.md b/content/nginx-one/workshops/lab3/explore-nginx-one-console-and-features.md new file mode 100644 index 000000000..3d2a7a296 --- /dev/null +++ b/content/nginx-one/workshops/lab3/explore-nginx-one-console-and-features.md @@ -0,0 +1,189 @@ +--- +title: "Lab 3: Explore NGINX One Console features" +weight: 300 +toc: true +nd-content-type: tutorial +nd-product: nginx-one +--- + +## Introduction + +This guide shows you how to explore and use key NGINX One Console features: + +- Overview dashboard +- TLS certificate management +- Configuration recommendations +- CVE scanning +- AI Assistant for config insights + +You’ll see how each feature helps you monitor and secure your NGINX fleet without writing custom scripts. + +## What you’ll learn + +By the end of this tutorial, you’ll know how to: + +- Navigate the Overview Dashboard panels +- View and filter certificate status +- Review and apply config recommendations +- Investigate CVEs and jump to details +- Use the AI Assistant to explain directives and variables + +## Before you begin + +Make sure you have: + +- An F5 Distributed Cloud (XC) account with NGINX One enabled +- All containers from [Lab 2](nginx-one/workshops/lab2/run-workshop-components-with-docker.md) running and registered +- Your unique identifier in the `NAME` environment variable (set in Lab 2), for example `s.jobs`: + + ```shell + export NAME="s.jobs" + ``` + +- Basic NGINX and Linux knowledge + +--- + +## 1. Overview Dashboard panels + +Open NGINX One Console and select **Overview**. Here are the key metrics you’ll see and what they tell you: + + +{{< img src="nginx-one/images/nginx-one-dashboard.png" + alt="Overview dashboard showing panels for instance availability, NGINX versions, operating systems, certificates status, configuration recommendations, CVE severity, CPU and memory utilization, disk space usage, unsuccessful response codes, and network usage." >}} + + +- **Instance availability** + Understand the operational state of each instance. + - **Online**: Agent and NGINX are connected and working. + - **Offline**: Agent is running but NGINX isn’t installed, isn’t running, or can’t talk to the agent. + - **Unavailable**: Agent lost connection or instance was removed. + - **Unknown**: Current state can’t be determined. + +- **NGINX versions by instance** + See which NGINX OSS or Plus versions your instances are running. + +- **Operating systems** + Find out which Linux distributions are in use. + +- **Certificates** + Monitor your SSL certificates—expiring soon or still valid. + +- **Config recommendations** + Get actionable suggestions to improve security, performance, and best practices. + +- **CVEs (Common Vulnerabilities and Exposures)** + Evaluate threats by severity. + - **Major**: High-severity; fix immediately. + - **Medium**: Moderate-severity; plan a fix soon. + - **Low/Minor**: Lower-severity; monitor. + - **Other**: Any non-standard categories. + +- **CPU utilization** + Track which instances are using the most CPU over time. + +- **Memory utilization** + Watch which instances consume the most RAM over time. + +- **Disk space utilization** + See which instances are nearing full disk capacity. + +- **Unsuccessful response codes** + Spot instances with high counts of HTTP 4xx/5xx errors. + +- **Top network usage** + Review network throughput (in/out) trends for your instances. + +--- + +## 2. Investigate CVEs + +Use the **CVEs** panel to investigate vulnerabilities in your instances: + +1. In the **CVEs** panel, select **High** to list instances with high-severity issues. +2. Select your `$NAME-plus1` instance to view its CVE details, including ID, severity, and description. +3. Select any CVE ID (for example, `CVE-2024-39792`) to open its official page with full details and remediation guidance. +4. Switch to the **Security** tab to see every CVE NGINX One tracks, along with how many instances each affects. +5. Select **View More** next to a CVE name for a direct link to the CVE database. + +--- + +## 3. Investigate certificates + +The **Certificates** panel shows the total number of certificates and their status distribution across all instances. + +**Note:** NGINX One only scans certificates that are part of a running NGINX configuration. + +The statuses mean: + +- **Expired**: The certificate’s expiration date is past. +- **Expiring**: The certificate will expire within 30 days. +- **Valid**: The certificate is not near expiration. +- **Not Ready**: NGINX One can’t determine this certificate’s status. + + +1. In the **Certificates** panel, select **Expiring** to list certificates that will expire soon. +2. Select your `$NAME-oss1` instance and switch to the **Unmanaged** tab to see each certificate’s name, status, expiration date, and subject. +3. Select a certificate name (for example, `30-day.crt`) to open its details page. +4. Scroll to **Placements** to see all instances that use that certificate. + +--- + +## 4. Configuration recommendations + +The **Configuration Recommendations** pane provides actionable suggestions: + +- **Orange** = Security +- **Green** = Optimization +- **Blue** = Best practices + +1. In the Console, navigate to **Overview > Dashboard**. +2. In the **Configuration Recommendations** pane, select **Security** to view instances with security-related suggestions. +3. Select an instance hostname. +4. Switch to the **Configuration** tab. +5. Select a config file (for example, `cafe.example.com.conf`) to see recommendations highlighted by line number. +6. Select **Edit Configuration** (pencil icon) to enter edit mode. +7. Update the configuration to address each recommendation. +8. Select **Next** to preview your changes, then select **Save and Publish** to apply them. + + +{{< img src="nginx-one/images/config-recommendation.png" + alt="NGINX One Console configuration recommendation panel showing a Best Practice warning: ‘log should not be set to off on line 34’, with a pencil icon to enter edit mode." >}} + + +--- + +## 5. AI Assistant + +Highlight any configuration text, such as a directive, variable, or phrase, in a config preview and select **Explain with AI**. The AI Assistant panel shows: + +- A concise definition of the selected element +- Practical best-practice tips +- Guidance on common use cases + +Try it on: + +- `stub_status` +- `proxy_buffering off` +- `$upstream_response_time` + + +{{< img src="nginx-one/images/ai-assistant.png" + alt="NGINX One AI Assistant panel showing a highlighted $upstream_response_time snippet alongside the assistant’s response with Purpose and Guidance headings." >}} + + +> **Pro tip:** You can learn about NGINX directives and variables without leaving the Console. + + +--- + +## Next steps + +Go to [Lab 4: Config Sync Groups]({{< ref "nginx-one/workshops/lab4/config-sync-groups.md" >}}) + +--- + +## References + +- [NGINX One Console docs]({{< ref "nginx-one/" >}}) +- [CVE.org](https://www.cve.org/) \ No newline at end of file diff --git a/content/nginx-one/workshops/lab4/config-sync-groups.md b/content/nginx-one/workshops/lab4/config-sync-groups.md new file mode 100644 index 000000000..0ae85bb55 --- /dev/null +++ b/content/nginx-one/workshops/lab4/config-sync-groups.md @@ -0,0 +1,213 @@ +--- +title: "Lab 4: Config Sync Groups" +weight: 400 +toc: true +nd-content-type: tutorial +nd-product: nginx-one +--- + +## Overview + +In this lab, you create and manage Config Sync Groups in NGINX One Console. Config Sync Groups keep your NGINX instances in sync with a shared configuration. You learn to create a group, add instances, apply a shared config, and fix sync errors. + +## What you’ll learn + +By the end of this lab, you'll know how to: + +- Create a Config Sync Group +- Add instances to a Config Sync Group +- Update the shared configuration for a Config Sync Group + +## Before you begin + +Make sure you have: + +- Completed [Lab 2: Run workshop components with Docker]({{< ref "nginx-one/workshops/lab2/run-workshop-components-with-docker.md" >}}) +- Docker and Docker Compose installed and running +- Your data plane key in the `TOKEN` environment variable (set in Lab 2): + + ```shell + export TOKEN="your-data-plane-key" + ``` + +- Your NGINX Plus JWT license file saved as `nginx-repo.jwt`, and `JWT` set (set in Lab 2): + + ```shell + export JWT=$(cat path/to/nginx-repo.jwt) + ``` + +- Your unique identifier in the NAME environment variable (set in Lab 2), for example `s.jobs`: + + ```shell + export NAME="s.jobs" + ``` + +- Basic familiarity with Linux command line and NGINX concepts + +--- + +## Exercise 1: Create a Config Sync Group + +A Config Sync Group lets you apply one configuration to multiple NGINX instances and keep them in sync. + +1. In the NGINX One Console, select **Manage > Config Sync Groups**. +2. In the **Config Sync Groups** pane, select **Add Config Sync Group**. +3. In the **Add Config Sync Group** form, in the **Name** field, enter `$NAME-sync-group` (for example, `s.jobs-sync-group`). +4. Select **Create**. The new group appears with **Details** and **Configuration** tabs. + - The **Details** tab shows: + - Object ID + - Last publication status and config version ID + - Config Sync Status (for example, Unknown) + - Instance status counts (In Sync, Out of Sync, Offline, Unavailable) +5. Switch to the **Configuration** tab to view your group’s configuration files. It’s empty for now. You’ll add one in Exercise 2. + +--- + +## Exercise 2: Add instances to the Config Sync Group + +{{< call-out "note" "Note" "" >}} You can mix NGINX Open Source and NGINX Plus instances in one group. But any config feature you use must work on every instance. If you need NGINX Plus-only features, put them in a separate group. {{}} + +When you create a Config Sync Group, it has no shared config to begin with. You can add a shared config in two ways: + +- **Define config manually**: select your group, go to the **Configuration** tab, then select **Edit Configuration**. Add or paste your NGINX config, select **Next**, review the diff, and select **Save and Publish**. +- **Populate from first instance**: add one NGINX instance. The console uses that instance’s existing config as the group’s shared config. + +### Populate group config from first instance + +Add a single NGINX instance so the console uses its existing config as the group’s shared config. + +1. Select **Manage > Config Sync Groups**. +2. Select your `$NAME-sync-group` group. (For example, `s.jobs-sync-group`.) +3. On the **Details** tab, in the **Instances** pane, select **Add Instance to Config Sync Group**. +4. Select **Register a new instance with NGINX One then add to config sync group**, then select **Next**. +5. Select **Use existing key**, paste `$TOKEN` (or your actual data plane key) into the **Data Plane Key** box. +6. Select the **Docker Container** tab. The tab shows sample commands for logging in, pulling an image, and running the container. Copy those sample commands and modify them as follows: + +7. Log in to the private registry: + + ```shell + echo "$JWT" \ + | docker login private-registry.nginx.com \ + --username "$JWT" --password-stdin + ``` + +8. Pull a Docker (replace version as needed). Subject to availability, you can replace the agent with the specific NGINX Plus version, OS type, and OS version you need. Here we are going to pull the r31 version of NGINX+ on alpine to demonstrate that.See [Pulling the image]({{< ref "nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image" >}}). + + ```shell + docker pull private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-alpine-3.19-20240522 + ``` + +9. Copy the docker run command from the user interface and modify it as follows: + + - Replace `YOUR_JWT_HERE` in `--env NGINX_LICENSE_JWT` with `$JWT` + - Replace `YOUR_DATA_PLANE_KEY` in `--env NGINX_AGENT_SERVER_TOKEN` with `$TOKEN` + - Add `--hostname "$NAME-one-manual"` and `--name "$NAME-one-manual"` flags + - Ensure `--env NGINX_AGENT_INSTANCE_GROUP="$NAME-sync-group"` is set + + ```shell + docker run \ + --hostname "$NAME-one-manual" \ + --name "$NAME-one-manual" \ + --env NGINX_LICENSE_JWT="$JWT" \ + --env NGINX_AGENT_SERVER_GRPCPORT=443 \ + --env NGINX_AGENT_SERVER_HOST=agent.connect.nginx.com \ + --env NGINX_AGENT_SERVER_TOKEN="$TOKEN" \ + --env NGINX_AGENT_INSTANCE_GROUP="$NAME-sync-group" \ + --env NGINX_AGENT_TLS_ENABLE=true \ + --restart always \ + --runtime runc \ + -d private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-alpine-3.19-20240522 + ``` + +10. In the **Config Sync Groups** panel, select **Refresh**. The new instance appears and the shared config populates. The first instance added becomes the default config source. +11. Select the **Configuration** tab to view the shared config. + +#### Add instances using Docker Compose + +Instead of registering each container manually, you can set the sync group in your compose file and restart all containers at once. + +You can edit the `docker-config.yaml` file to add those instances to the config sync group: + +1. Stop the running containers: + + ```shell + docker compose down + ``` + +2. Open `docker-compose.yaml` in a text editor. +3. Uncomment the lines beginning with: + + ```yaml + NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + ``` + +4. Restart all containers: + + ```shell + docker compose up --force-recreate -d + ``` + +5. In the NGINX One Console, select **Refresh**. The instances with `NGINX_AGENT_INSTANCE_GROUP` set appear in the Config Sync Group. + +6. Instances automatically sync the existing NGINX config. When the sync finishes, the **Config Sync Status** shows `In Sync`. + + +{{< img src="nginx-one/images/config-sync-status.png" + alt="Table showing hostnames, NGINX versions, operating systems, availability status, and green In Sync indicators for each instance in the config sync group" >}} + + + +## Exercise 3: Edit the group config and sync changes + +Modify the shared group configuration and apply those changes to all group members. + +1. Select **Manage > Config Sync Groups**, then choose your `$NAME-sync-group` (for example, `s-jobs-sync-group`). +2. Select the **Configuration** tab. +3. Select **Edit Configuration** (pencil icon). +4. In the file list, select `default.conf`. +5. In the editor pane, add these lines at 21–24: + + ```yaml + location /test_header { + add_header X-Test-App true; + return 200 'HTTP/1.1 200 OK\nContent-Type: text/html\n\nWelcome to Lab 4 of the NGINX One Console Workshop!'; + } + ``` + + + {{< img src="nginx-one/images/config-sync-edits.png" + alt="" >}} + + + When you make these edits, the file is marked "modified" and the validator shows **NGINX Config OK**. +6. Select **Next**, review the diff, then select **Save and Publish**. +7. Select the **Details** tab and confirm **Last Publication Status** shows **Succeeded**. +8. In the **Instances** table, confirm each host shows **Config Sync Status** = **In Sync**. +9. Test your change by curling any instance’s HTTP endpoint. Replace `` and `` with your instance’s host name or IP and the port shown in the Instances table (for example, `localhost:80`): + + ```shell + curl http://localhost:80/test_header + ``` + + You should see: + + ```text + HTTP/1.1 200 OK + Content-Type: text/html + + Welcome to Lab 4 of the NGINX One Console Workshop! + ``` + +--- + +## Next steps + +You have created a Config Sync Group and added instances. In Lab 5, you will install your NGINX Plus license (JWT) on each instance so you can upgrade them to NGINX R34. + +Go to [Lab 5: Upgrade to R34]() + +--- + +## References + +- [NGINX One Console docs](https://docs.nginx.com/nginx-one/) diff --git a/static/nginx-one/images/ai-assistant.png b/static/nginx-one/images/ai-assistant.png new file mode 100644 index 000000000..df28268b1 Binary files /dev/null and b/static/nginx-one/images/ai-assistant.png differ diff --git a/static/nginx-one/images/config-recommendation.png b/static/nginx-one/images/config-recommendation.png new file mode 100644 index 000000000..e02179d20 Binary files /dev/null and b/static/nginx-one/images/config-recommendation.png differ diff --git a/static/nginx-one/images/config-sync-edits.png b/static/nginx-one/images/config-sync-edits.png new file mode 100644 index 000000000..f8a47580c Binary files /dev/null and b/static/nginx-one/images/config-sync-edits.png differ diff --git a/static/nginx-one/images/config-sync-status.png b/static/nginx-one/images/config-sync-status.png new file mode 100644 index 000000000..272f36963 Binary files /dev/null and b/static/nginx-one/images/config-sync-status.png differ diff --git a/static/workshops/nginx-one/lab2/docker-compose.yml b/static/workshops/nginx-one/lab2/docker-compose.yml new file mode 100644 index 000000000..a22431c7d --- /dev/null +++ b/static/workshops/nginx-one/lab2/docker-compose.yml @@ -0,0 +1,164 @@ +# NGINX Plus / OSS with NGINX Agent +# NGINX webservers with ingress-demo pages +# NGINX One Console Instance Registration +# NGINX Basics, Dec 2024 +# Chris Akker, Shouvik Dutta, Adam Currier +# +services: + plus1: # Alpine NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey From One Console + # NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + hostname: $NAME-plus1 + container_name: $NAME-plus1 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r32-alpine-3.20-20240613 # CVE - From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - 80:80 # Open for HTTP + - 443:443 # Open for HTTPS + - 9000:9000 # Open for stub status page + - 9113:9113 # Open for Prometheus Scraper page + restart: always + # + plus2: # Alpine NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + # NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + hostname: $NAME-plus2 + container_name: $NAME-plus2 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-alpine-3.19-20240522 # CVE - From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for API / Dashboard page + - '9113' # Open for Prometheus Scraper page + restart: always + # + plus3: # RHEL UBI NGINX Plus Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + # NGINX_AGENT_INSTANCE_GROUP: $NAME-sync-group + hostname: $NAME-plus3 + container_name: $NAME-plus3 + image: private-registry.nginx.com/nginx-plus/agent:nginx-plus-r31-ubi-9-20240522 # From Nginx Private Registry + volumes: # Sync these folders to container + - ./nginx-plus/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-plus/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-plus/etc/nginx/includes:/etc/nginx/includes + - ./nginx-plus/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for API / Dashboard page + - '9113' # Open for Prometheus Scraper page + restart: always + # + oss1: # Debian NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: $NAME-oss1 + container_name: $NAME-oss1 + image: docker-registry.nginx.com/nginx/agent:mainline # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for stub status page + - '9113' # Open for Prometheus Scraper page + restart: always + # + oss2: # Alpine NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: $NAME-oss2 + container_name: $NAME-oss2 + image: docker-registry.nginx.com/nginx/agent:alpine # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for stub status page + - '9113' # Open for Prometheus Scraper page + restart: always + # + oss3: # Older Alpine NGINX OSS Web / Load Balancer + environment: + NGINX_AGENT_SERVER_HOST: 'agent.connect.nginx.com' + NGINX_AGENT_SERVER_GRPCPORT: '443' + NGINX_AGENT_TLS_ENABLE: 'true' + NGINX_AGENT_SERVER_TOKEN: $TOKEN # Datakey Fron Nginx One Console + hostname: $NAME-oss3 + container_name: $NAME-oss3 + image: docker-registry.nginx.com/nginx/agent:1.26-alpine # From Docker Public Registry + volumes: # Sync these folders to container + - ./nginx-oss/etc/nginx/nginx.conf:/etc/nginx/nginx.conf + - ./nginx-oss/etc/nginx/conf.d:/etc/nginx/conf.d + - ./nginx-oss/etc/nginx/includes:/etc/nginx/includes + - ./nginx-oss/etc/ssl/nginx:/etc/ssl/nginx + - ./nginx-oss/usr/share/nginx/html:/usr/share/nginx/html + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + - '9000' # Open for stub status page + - '9113' # Open for Prometheus Scraper page + restart: always + # + web1: + hostname: $NAME-web1 + container_name: $NAME-web1 + platform: linux/amd64 + image: nginxinc/ingress-demo # Image from Docker Hub + ports: + - '80' # Open for HTTP + - '443' # Open for HTTPS + web2: + hostname: $NAME-web2 + container_name: $NAME-web2 + platform: linux/amd64 + image: nginxinc/ingress-demo + ports: + - '80' + - '433' + web3: + hostname: $NAME-web3 + container_name: $NAME-web3 + platform: linux/amd64 + image: nginxinc/ingress-demo + ports: + - '80' + - '443' + diff --git a/static/workshops/nginx-one/lab2/generate_certs.sh b/static/workshops/nginx-one/lab2/generate_certs.sh new file mode 100755 index 000000000..4ea736e4f --- /dev/null +++ b/static/workshops/nginx-one/lab2/generate_certs.sh @@ -0,0 +1,7 @@ +echo "Generate 1-day cert." +openssl req -x509 -nodes -days 1 -newkey rsa:2048 -keyout nginx-oss/etc/ssl/nginx/1-day.key -out nginx-oss/etc/ssl/nginx/1-day.crt -subj "/CN=$NAME-NginxOneWorkshop" +echo "Generate 30-day cert." +openssl req -x509 -nodes -days 30 -newkey rsa:2048 -keyout nginx-oss/etc/ssl/nginx/30-day.key -out nginx-oss/etc/ssl/nginx/30-day.crt -subj "/CN=$NAME-NginxOneWorkshop" +echo "copy certs to lab5 for future labs" +cp nginx-oss/etc/ssl/nginx/1-day.* ../lab5/nginx-oss/etc/ssl/nginx/ +cp nginx-oss/etc/ssl/nginx/30-day.* ../lab5/nginx-oss/etc/ssl/nginx/ \ No newline at end of file diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf new file mode 100644 index 000000000..3af707162 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/cafe.example.com.conf @@ -0,0 +1,27 @@ +# cafe.example.com HTTP +server { + # Listening on port 80 on all IP addresses on this machine + listen 80; + + server_name cafe.example.com; + + # status_zone cafe-VirtualServer; + + # Server specific logging + access_log /var/log/nginx/cafe.example.com.log main_ext; + error_log /var/log/nginx/cafe.example.com_error.log info; + + location / { + + proxy_buffering off; + + # Including best-practice headers are bonus points + include includes/proxy_headers.conf; + include includes/keepalive.conf; + + # status_zone /; + + proxy_pass http://nginx_cafe; + } + +} diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/stub_status.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/stub_status.conf new file mode 100644 index 000000000..8869acd65 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/stub_status.conf @@ -0,0 +1,19 @@ +# ngx_http_stub_status_module (Available in NGINX OSS) +# provides Basic Status information http://nginx.org/en/docs/http/ngx_http_stub_status_module.html + +server { + listen 9000 ssl; # Listener for Stub Status + + ssl_certificate /etc/ssl/nginx/30-day.crt; + ssl_certificate_key /etc/ssl/nginx/30-day.key; + + location /basic_status { + stub_status; + } + + # Redirect requests for "/" to "/basic_status" + location / { + return 301 /basic_status; + } + +} \ No newline at end of file diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf new file mode 100644 index 000000000..89c78dea4 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/tls-cars.example.com.conf @@ -0,0 +1,54 @@ +# cars.example.com HTTP/HTTPS +# NGINX Basics Workshop +# Nov 2024, Chris Akker, Shouvik Dutta, Adam Currier +# +server { + + listen 443 ssl; # Uncomment to change to port 443, add "ssl" parameter for terminating TLS on all IP addresses on this machine + + server_name cars.example.com; # Set hostname to match in request + +# Update the following lines for NGINX cert and key directives and file locations + + ssl_certificate /etc/ssl/nginx/cars.crt; + ssl_certificate_key /etc/ssl/nginx/cars.key; + + ssl_protocols TLSv1.1 TLSv1.3; + ssl_ciphers HIGH:!aNULL:3DES; + ssl_prefer_server_ciphers on; + + access_log /var/log/nginx/cars.example.com.log main; + + error_log /var/log/nginx/cars.example.com_error.log info; + + root /usr/share/nginx/html; # Set the root folder for the HTML and JPG files + + location / { + + default_type text/html; + return 200 "Let's go fast, you have reached cars.example.com, path $uri\n"; + } + + location /gtr { + + try_files $uri $uri.html; # Look for filename that matches the URI requested + } + + location /nsx { + + try_files $uri $uri.html; + } + + location /rcf { + + try_files $uri $uri.html; + } + + location /browse { # new URL path + + alias /usr/share/nginx/html; # Browse this folder + index index.html; # Use this file, but if it does *not* exist + autoindex on; # Perform directory/file browsing + } + +} diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/upstreams.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/upstreams.conf new file mode 100644 index 000000000..8570729c4 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/conf.d/upstreams.conf @@ -0,0 +1,34 @@ +# NGINX Basics, Plus Proxy to three upstream NGINX containers +# Nov 2024 - Chris Akker, Shouvik Dutta, Adam Currier +# nginx_cafe servers +# +upstream nginx_cafe { # Upstream block, the name is "nginx_cafe" + + # Uncomment the zone directive below to add metrics to the Dashboard + # zone nginx_cafe 256k; + + # Load Balancing Algorithms supported by NGINX + # - Round Robin (Default if nothing specified) + # - Least Connections + # - IP Hash + # - Hash (Any generic Hash) + + # Load Balancing Algorithms supported by NGINX Plus + # - Least Time Last Byte / Header + # - Random Two + + # Uncomment for Least-Time Last-Byte algorithm + # least_time last_byte; + + # From Docker-Compose: + server web1:80; + server web2:80; + server web3:80; + + # Uncomment for Cookie persistence + # sticky cookie srv_id expires=1m domain=.example.com path=/; + + # Uncomment for keepalive TCP connections to upstreams + keepalive 16; + +} \ No newline at end of file diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/keepalive.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/keepalive.conf new file mode 100644 index 000000000..a9fbcf4ad --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/keepalive.conf @@ -0,0 +1,9 @@ +# Default is HTTP/1, keepalive is only enabled in HTTP/1.1 +proxy_http_version 1.1; + +# Remove the Connection header if the client sends it, +# it could be "close" to close a keepalive connection +proxy_set_header Connection ""; + +# Host request header field, or the server name matching a request +proxy_set_header Host $host; \ No newline at end of file diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf new file mode 100644 index 000000000..296ea7bfc --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/log_formats/main_ext.conf @@ -0,0 +1,20 @@ +# Extended Log Format +# Nginx Basics +log_format main_ext 'remote_addr="$remote_addr", ' + '[time_local=$time_local], ' + 'request="$request", ' + 'status="$status", ' + 'http_referer="$http_referer", ' + 'body_bytes_sent="$body_bytes_sent", ' + 'Host="$host", ' + 'sn="$server_name", ' + 'request_time=$request_time, ' + 'http_user_agent="$http_user_agent", ' + 'http_x_forwarded_for="$http_x_forwarded_for", ' + 'request_length="$request_length", ' + 'upstream_address="$upstream_addr", ' + 'upstream_status="$upstream_status", ' + 'upstream_connect_time="$upstream_connect_time", ' + 'upstream_header_time="$upstream_header_time", ' + 'upstream_response_time="$upstream_response_time", ' + 'upstream_response_length="$upstream_response_length", '; diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/proxy_headers.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/proxy_headers.conf new file mode 100644 index 000000000..23a83d1dc --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/includes/proxy_headers.conf @@ -0,0 +1,12 @@ +## Set Headers to the proxied servers ## + +# client address in a binary form, value’s length is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses +proxy_set_header X-Real-IP $remote_addr; + +# X-Forwarded-For client request header field with the $remote_addr variable appended to it, +# separated by a comma. If the “X-Forwarded-For” field is not present in the client request header, +# the $proxy_add_x_forwarded_for variable is equal to the $remote_addr variable. +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + +# request scheme, “http” or “https” +proxy_set_header X-Forwarded-Proto $scheme; \ No newline at end of file diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/nginx.conf b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/nginx.conf new file mode 100644 index 000000000..a3b502b64 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/nginx/nginx.conf @@ -0,0 +1,33 @@ +user nginx; +worker_processes 1; + +error_log /var/log/nginx/error.log info; +pid /var/run/nginx.pid; + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + include /etc/nginx/includes/log_formats/*.conf; # Custom Access logs formats found here + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; + +} diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/ssl/nginx/cars.crt b/static/workshops/nginx-one/lab2/nginx-oss/etc/ssl/nginx/cars.crt new file mode 100644 index 000000000..4eb6334ff --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/ssl/nginx/cars.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDFTCCAf2gAwIBAgIUEQHIC+pN7UA+PwpufAGW4sFczqowDQYJKoZIhvcNAQEL +BQAwGjEYMBYGA1UEAwwPTmdpbnhQbHVzQmFzaWNzMB4XDTI1MDEwMjIyMDY0OVoX +DTI1MDEwMzIyMDY0OVowGjEYMBYGA1UEAwwPTmdpbnhQbHVzQmFzaWNzMIIBIjAN +BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA17iXl8xC2AApcMaoPEu5w42U++ai +ZPPtgEoDGE/tgNZmWwHsmfdkKbhvcFX8vLwI1OD+mKPW0RcB56x0I29KRk8HGwwX +XXUuALmWuYVYNE71O2cBE/8JpgLlFgkbjYyFZekQeyb9QHeYxI47vCQqptBzQoCx +Bs/zi4lh+wgRYyXmHdTQ60183Gvxs4ujIDWnOC4/PGLr/ZLjySyBDM4+rtoz5xia +HZVBFA8HINTz4vjMkP1zrN4RsgSQQop8vuxlZsLlJCSWDMgkidu/uCvXxo+gHLMs +nrvDloEJuU1zx2va4i0e8Zr/eV/zVRIghKx9g/mBFFPnEdu0x7B48EfTnwIDAQAB +o1MwUTAdBgNVHQ4EFgQUDQzkk+0qMyn/nczCV7vJVlpFLnAwHwYDVR0jBBgwFoAU +DQzkk+0qMyn/nczCV7vJVlpFLnAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B +AQsFAAOCAQEAWXBbXqEckARXPGQtasa5+uVqwokH4TJwbnQLfZsQV766OltS4Bv/ +MFDqmFxFLvsuM2jf1vodtJTq+cuUWtn1o+0MCDFWy3lTifk0wpQyg3xF6boHdBi4 +oGFKn7oPwWaTU8yjJzbvH6A5mfjO57YklAXlmZwWsEylsgR9D9jPTUkX82P+8Ad6 +UjWmFsopTwjit1rBAnBOL/oIGl2IFE5L4Vv8tcFsfpDGpCK/h9D3G25uQY36c0av +Q10lfV2+1eTQz//In+Li8zgGZa+XHtCxFPCEdcFQeEF3VkefgN7aL8qxmPgmSrqd +P13gMgo7HwFPoxvuUD3vN2DKIeqfa/H7Mg== +-----END CERTIFICATE----- diff --git a/static/workshops/nginx-one/lab2/nginx-oss/etc/ssl/nginx/cars.key b/static/workshops/nginx-one/lab2/nginx-oss/etc/ssl/nginx/cars.key new file mode 100644 index 000000000..3777400b3 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/etc/ssl/nginx/cars.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDXuJeXzELYAClw +xqg8S7nDjZT75qJk8+2ASgMYT+2A1mZbAeyZ92QpuG9wVfy8vAjU4P6Yo9bRFwHn +rHQjb0pGTwcbDBdddS4AuZa5hVg0TvU7ZwET/wmmAuUWCRuNjIVl6RB7Jv1Ad5jE +jju8JCqm0HNCgLEGz/OLiWH7CBFjJeYd1NDrTXzca/Gzi6MgNac4Lj88Yuv9kuPJ +LIEMzj6u2jPnGJodlUEUDwcg1PPi+MyQ/XOs3hGyBJBCiny+7GVmwuUkJJYMyCSJ +27+4K9fGj6Acsyyeu8OWgQm5TXPHa9riLR7xmv95X/NVEiCErH2D+YEUU+cR27TH +sHjwR9OfAgMBAAECggEAGspO8UgpyP+EJgBV5l8VK+cKaJpE8rqkdTk71yod+dEm +lwjPJHPn2ZKRLGdRYvMLObzTgYtfY0ozL11ocvogREkOPdqrkCy8UNS7lkCsKprf +s8fgB2a2AQr8/laVOGgKLRTbuh+mdfokW8y6OGxZa6wZlFm9InZy7ZJbO7zNw/03 +jkAnDAzcAD4T9AgbR0zCVrRxehR6wGR220VWG8kw6gXswBvGvQaVAnwmjlTrh3pp +EhZGC+iZ2el05JfGw6MlM7g6NKBK18KgrGYkhvKiML7BsOJPJD0vMId1jiVsejJR +9xaPoBEaeTOLVWFisBfO5EZtkSZPF7nHwZGHSqZvoQKBgQDttK94ItRS33Uv/HAk +2W+WKGSagSJeqHG9Hi3DEVLPE355QsOxgx/3h5EXnqHRVnu+CXqMHqEhf9afUZsJ +0iMYVShYYELauRhcL8+XSrg+jFXp7Tvokv4XVbkwUyFnY+fM+coQ1rvamd5+1deX +x1x629e/QtOtnaqkuvr9Xn8ArwKBgQDoUsKa3Eq8rx0vzI6KV4F6WncShObiKqkV +0TR79SaNawT0vEhdDOhHuO5BNaiOI3+mbx/CRwnVedIicoi99cDgZrQPncaisnkC +KZVcQpNMoFM8+ZYGyeYDo86sBi05WQRI/vxGKrOIUcaSsdieBLpS3E2btcNGkaLY +pilcnRW4EQKBgQC2rR4QaEvd6GbJ2ulgGE3eCurNpiIAtti56wBmIeEOzL9sdzen +KssdUmzZxwo6s4jjUauBFWTlNrZ8t507XeekooUf7dJS/t5OsluJvF19jCHWZX+d +y6FD05g/IBPSvf99EhYM/MlfRNKtjK9jsE1NCbhy/utoSHvEnwGWR9G4dwKBgQCa +fbZ1frqgYJ67E39SVcB/WbtG8GQM0Cuim30YVTyu3BTunmpMnnG0iDC/4mvVIZwY +VFs9OTo74IexapKuJ8d8Mi/ZFqVpud8oZfix4n/Le+3+ZUaz+vzfPMYJtQ3LzftA +g3fFPU4n/6FaGbQf2KsCwQdG3Yce3Wf6Q/zLXpZ70QKBgEseUKnmYKvFjmyVdO94 +nesTUuu7DITx4M7I3ssdKz/9KdqjmnVQn3yiNEEHEvItvKEZvFMAKB7uJFmY/oGr +5DvP29lsr45FDTz2UWElz/LhsOkSBzRYQpXDkuaCl+lz7YE76S6F45vAy7RSY8TU ++57833tZa5uHl5GKhytuhGyQ +-----END PRIVATE KEY----- diff --git a/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/gtr.html b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/gtr.html new file mode 100644 index 000000000..1b1bdfcd1 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/gtr.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx GTR ! + + + +

Welcome to nginx GTR !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +GTR + +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/gtr.jpg b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/gtr.jpg new file mode 100644 index 000000000..be39ffe4a Binary files /dev/null and b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/gtr.jpg differ diff --git a/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/index.html b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/index.html new file mode 100644 index 000000000..5d2b3044c --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/index.html @@ -0,0 +1,24 @@ + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/nsx.html b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/nsx.html new file mode 100644 index 000000000..fc1de05d1 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/nsx.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx NSX ! + + + +

Welcome to nginx NSX !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +NSX + +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/nsx.jpg b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/nsx.jpg new file mode 100644 index 000000000..f3c27f59e Binary files /dev/null and b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/nsx.jpg differ diff --git a/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/rcf.html b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/rcf.html new file mode 100644 index 000000000..468ddae0b --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/rcf.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx RCF ! + + + +

Welcome to nginx RCF !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +RCF + +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/rcf.jpg b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/rcf.jpg new file mode 100644 index 000000000..40faef6dc Binary files /dev/null and b/static/workshops/nginx-one/lab2/nginx-oss/usr/share/nginx/html/rcf.jpg differ diff --git a/static/workshops/nginx-one/lab2/nginx-plus/etc/nginx/conf.d/default.conf b/static/workshops/nginx-one/lab2/nginx-plus/etc/nginx/conf.d/default.conf new file mode 100644 index 000000000..013d7b423 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-plus/etc/nginx/conf.d/default.conf @@ -0,0 +1,64 @@ +server { + listen 80 default_server; + server_name localhost; + + #access_log /var/log/nginx/host.access.log main; + + location / { + root /usr/share/nginx/html; + index index.html index.htm; + } + + #error_page 404 /404.html; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + location = /50x.html { + root /usr/share/nginx/html; + } + + location /test_header { + add_header X-Test-App true; + return 200 'HTTP/1.1 200 OK\nContent-Type: text/html\n\nWelcome to Lab 4 of the NGINX One Console Workshop!'; + } + + # proxy the PHP scripts to Apache listening on 127.0.0.1:80 + # + #location ~ \.php$ { + # proxy_pass http://127.0.0.1; + #} + + # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000 + # + #location ~ \.php$ { + # root html; + # fastcgi_pass 127.0.0.1:9000; + # fastcgi_index index.php; + # fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name; + # include fastcgi_params; + #} + + # deny access to .htaccess files, if Apache's document root + # concurs with nginx's one + # + #location ~ /\.ht { + # deny all; + #} + + # enable /api/ location with appropriate access control in order + # to make use of NGINX Plus API + # + #location /api/ { + # api write=on; + # allow 127.0.0.1; + # deny all; + #} + + # enable NGINX Plus Dashboard; requires /api/ location to be + # enabled and appropriate access control for remote access + # + #location = /dashboard.html { + # root /usr/share/nginx/html; + #} +} diff --git a/static/workshops/nginx-one/lab2/nginx-plus/etc/nginx/nginx.conf b/static/workshops/nginx-one/lab2/nginx-plus/etc/nginx/nginx.conf new file mode 100644 index 000000000..f0ece9626 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-plus/etc/nginx/nginx.conf @@ -0,0 +1,75 @@ + +user nginx; +worker_processes auto; + +error_log /var/log/nginx/error.log notice; +pid /var/run/nginx.pid; + + +events { + worker_connections 1024; +} + + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + + access_log /var/log/nginx/access.log main; + + sendfile on; + #tcp_nopush on; + + keepalive_timeout 65; + + #gzip on; + + include /etc/nginx/conf.d/*.conf; +} + + +# TCP/UDP proxy and load balancing block +# +#stream { + # Example configuration for TCP load balancing + + #upstream stream_backend { + # zone tcp_servers 64k; + # server backend1.example.com:12345; + # server backend2.example.com:12345; + #} + + #server { + # listen 12345; + # status_zone tcp_server; + # proxy_pass stream_backend; + #} +#} + +# NGINX Plus Usage Reporting +# +# By default, every 30 minutes, NGINX Plus will send usage information +# to NGINX Instance Manager, resolved by a "nginx-mgmt.local" DNS entry. +# Alternate settings can be configured by uncommenting the "mgmt" block +# and optional directives. +# +#mgmt { + #usage_report endpoint=nginx-mgmt.local interval=30m; + #resolver DNS_IP; + + #uuid_file /var/lib/nginx/nginx.id; + + #ssl_protocols TLSv1.2 TLSv1.3; + #ssl_ciphers DEFAULT; + + #ssl_certificate client.pem; + #ssl_certificate_key client.key; + + #ssl_trusted_certificate trusted_ca_cert.crt; + #ssl_verify on; + #ssl_verify_depth 2; +#} diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/dashboard.html b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/dashboard.html new file mode 100644 index 000000000..5f1d00bf1 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/dashboard.html @@ -0,0 +1,1929 @@ +NGINX Plus Dashboard + \ No newline at end of file diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/gtr.html b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/gtr.html new file mode 100644 index 000000000..1b1bdfcd1 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/gtr.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx GTR ! + + + +

Welcome to nginx GTR !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +GTR + +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/gtr.jpg b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/gtr.jpg new file mode 100644 index 000000000..be39ffe4a Binary files /dev/null and b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/gtr.jpg differ diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/index.html b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/index.html new file mode 100644 index 000000000..5d2b3044c --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/index.html @@ -0,0 +1,24 @@ + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/nsx.html b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/nsx.html new file mode 100644 index 000000000..fc1de05d1 --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/nsx.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx NSX ! + + + +

Welcome to nginx NSX !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +NSX + +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/nsx.jpg b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/nsx.jpg new file mode 100644 index 000000000..f3c27f59e Binary files /dev/null and b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/nsx.jpg differ diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/rcf.html b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/rcf.html new file mode 100644 index 000000000..468ddae0b --- /dev/null +++ b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/rcf.html @@ -0,0 +1,22 @@ + + + +Welcome to nginx RCF ! + + + +

Welcome to nginx RCF !

+

If you see this page, the nginx web server is successfully installed and +working.

+ +RCF + +

Thank you for using nginx.

+ + diff --git a/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/rcf.jpg b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/rcf.jpg new file mode 100644 index 000000000..40faef6dc Binary files /dev/null and b/static/workshops/nginx-one/lab2/nginx-plus/usr/share/nginx/html/rcf.jpg differ