/back2basics2

#Back to Basics Configuration Repository for Episode 2

Primary LanguageHTML

Back to Basics - Episode 2

This repo has the necessary files to take you through capabilities as listed below which you can achieve with NGINX & NGINX Plus.

  1. Metrics Dashboard - View metrics and add/update upstream servers (N+ Only)
  2. Metrics - Look at alternative options for capturing NGINX metrics, stub_status & prometheus integeration (N+ Only)
  3. Key-value store - Configure IP Allow/Deny List (N+ Only)
  4. Key-value store - Dynamic SSL Certificate Management (N+ Only)
  5. Cache Management - Configure caching & enable headers to identify if cache was "HIT" or "MISS"
  6. JWT Validation - Generate tokens from https://jwt.io and validate JWT and re-direct based on value from the jwt payload (N+ Only)

Link to YouTube Video:

Prerequisites

What will you require to run these configuration files as-is:

  • Ubuntu 18.04 VM with sudo access

    • Ensure you have the static files (App1, App2, App3, covid-app & jwt-app) available in location "/opt/services"
    • You have included a hosts file entry; <internal-ip> example.com www.example.com example123.com www.example123.com

  • NGINX Plus (R22)

Metrics Dashboard | ep1.dashboard.conf

  • This .conf file serves 3 Apps on ports 9001, 9002 & 9003
  • Load Balancing is configured on port 9000 ( LB'ing across 9001 & 9002 only )
  • API Dashboard is being served on port 8080

Access the Dashboard and edit the "backend_servers"; "Add server" with address 127.0.0.1:9003, click set-state to "Up" and click Add. Access the localhost on port 9000 and view the App3 in the rotation when you refresh.

Useful Links:

Key-value Store | key.value.store.conf

IP Allow/Deny List

Enable a key-value zone & keyval for the allowlist_zone datastore.

  • curl -X GET 'http://<internal-ip>:8080/api/6/http/keyvals/allowlist_zone' which should return an empty response {}
  • Note: Because we are on making the changes on the same VM, we can perform the same task via localhost [127.0.0.1]
  • curl -X POST -d ‘{“<internal-ip>":”1"}' -s 'http://localhost:8080/api/6/http/keyvals/allowlist_zone’
  • We have now blocked access from internal IP, 1 for Deny and 0 for Allow.
  • Running GET agains the should now throw a 403
  • curl -X GET 'http://<internal-ip>:8080/api/6/http/keyvals/allowlist_zone' If you are presented with '403 Forbidden', we have successfully enabled IP Allow/Deny list.

SSL Certificate Management

This .conf takes you through the use of key-value store for SSL Management in a few steps [Please don't use this .conf file as is]

  • Step 1: Serving content on PORT 8443 - non-secure
  • Step 2: Serving content on PORT 8443 - secure | SSL Cert & Key are stored on disk
  • Step 3: Enabled key-value store for storing key & cert files. Variable $ssl_server_name matches the request host name with the name of crt/key
  • Step 4: Dynamically add a crt/key for www.example123.com and revist the page again, now to be able to view the content.
Useful Links:

Cache Management | cache.management.conf

This .conf takes you through enabling Caching

  • With the .conf file included, you can see that we have enabled proxy_cache_path
  • Within the location block of your server, we have used a few directives to capture a few additional Headers and defined the proxy_cache and it's validity
  • Note: You can't cache content from within the same server block, you have to go out to another server
Useful Links:

JWT Validation | jwt.validation.conf

This .conf takes you through configuring JWT Validation.

  • With the .conf file included, I have followed the details from a Blog Post by Alan Murphy - Link in the Useful Links section below.

ID - 111 http://example.com/index.html?myjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MDk0NDg0MDAsIm5hbWUiOiJDcmVhdGUgTmV3IFVzZXIiLCJzdWIiOiJjdXNlciIsImduYW1lIjoid2hlZWwiLCJndWlkIjoiMTAiLCJmdWxsTmFtZSI6IkpvaG4gRG9lIiwidW5hbWUiOiJqZG9lIiwidWlkIjoiMTExIiwic3VkbyI6dHJ1ZSwiZGVwdCI6IklUIiwidXJsIjoiaHR0cDovL2V4YW1wbGUuY29tOjgwODkifQ.mp2ug5m8rP9djpY5O5j6KRG1RM5C8D1DQmDoBkMIPzs

ID - 222 http://example.com/index.html?myjwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MDk0NDg0MDAsIm5hbWUiOiJDcmVhdGUgTmV3IFVzZXIiLCJzdWIiOiJjdXNlciIsImduYW1lIjoid2hlZWwiLCJndWlkIjoiMTAiLCJmdWxsTmFtZSI6IkpvaG4gRG9lIiwidW5hbWUiOiJqZG9lIiwidWlkIjoiMjIyIiwic3VkbyI6dHJ1ZSwiZGVwdCI6IklUIiwidXJsIjoiaHR0cDovL2V4YW1wbGUuY29tOjgwODkifQ.fkfXTfAqX6gRnfxlcseCys-nAXtEbYWMFK8lDuBZc9c`

Useful Links:

Troubleshooting

  • Check the prmisssions on the .crt & key if you see errors in NGINX with $ssl_server_name variable.
  • Ensure that you have verified that the .crt/.key files are both valid.

Built With

Author