Add a copy of the nginx builder module

sysadmin/nginx/config/common.py

@@ -0,0 +1,203 @@
+"""
+This module contains functions and variables that provide a variety of commonly used nginx config
+boilerplate.
+"""
+from . import helpers
+from .api import Block, EmptyBlock, KeyMultiValueOption, KeyValueOption
+from .headers import uwsgi_param
+
+
+def listen_options(port, ipv6_enabled=False):
+    if ipv6_enabled:
+        return KeyMultiValueOption(
+            'listen',
+            ['[::]:{}'.format(port), 'ipv6only=off']
+        )
+    else:
+        return KeyValueOption('listen', port)
+
+
+def listen_options_ssl(port, ipv6_enabled=False):
+    if ipv6_enabled:
+        return KeyMultiValueOption(
+            'listen',
+            ['[::]:{}'.format(port), 'ipv6only=off', 'ssl']
+        )
+    else:
+        return KeyMultiValueOption('listen', [port, 'ssl'])
+
+
+def _uwsgi_params():
+    return helpers.duplicate_options(
+        'uwsgi_param',
+        [
+            [uwsgi_param.QUERY_STRING, '$query_string'],
+            [uwsgi_param.REQUEST_METHOD, '$request_method'],
+            [uwsgi_param.CONTENT_TYPE, '$content_type'],
+            [uwsgi_param.CONTENT_LENGTH, '$content_length'],
+            [uwsgi_param.REQUEST_URI, '$request_uri'],
+            [uwsgi_param.PATH_INFO, '$document_uri'],
+            [uwsgi_param.DOCUMENT_ROOT, '$document_root'],
+            [uwsgi_param.SERVER_PROTOCOL, '$server_protocol'],
+            [uwsgi_param.REMOTE_ADDR, '$remote_addr'],
+            [uwsgi_param.REMOTE_PORT, '$remote_port'],
+            [uwsgi_param.SERVER_ADDR, '$server_addr'],
+            [uwsgi_param.SERVER_PORT, '$server_port'],
+            [uwsgi_param.SERVER_NAME, '$server_name'],
+        ]
+    )
+
+
+def _uwsgi_ssl_params():
+    return helpers.duplicate_options(
+        'uwsgi_param',
+        [
+            [uwsgi_param.CLIENT_SSL_CERT, '$ssl_client_raw_cert'],
+        ]
+    )
+
+
+def _gzip_options():
+    """ These are some decent default settings for gzip compression """
+    return EmptyBlock(
+        **dict(
+            gzip='on',
+            gzip_types='application/json',
+            gzip_comp_level=2,
+            gzip_min_length=1024,
+        )
+    )
+
+
+def _uwsgi_cache():
+    """ A set of useful defaults for using nginx's response cache with uWSGI
+
+    This block of options belongs in your HTTP section.
+
+    NB! you must set "set $nocache 0;" in the Location block of your uwsgi backend.
+
+    see: http://nginx.org/en/docs/http/ngx_http_uwsgi_module.html
+    """
+    return EmptyBlock(
+        **dict(
+            uwsgi_cache_path=[
+                'var/nginx_cache',
+                'keys_zone=one:10m',
+                'loader_threshold=300',
+                'loader_files=200',
+                'max_size=200m'
+            ],
+            uwsgi_cache_key='$request_uri',
+            uwsgi_cache_min_uses=1,
+        )
+    )
+
+
+def _uwsgi_cache_location():
+    """ These are some decent defaults for caching uwsgi responses """
+    cache_options = EmptyBlock()
+    # This is a bit of a hack to deal with the Cache-Control header
+    # normally, the uwsgi nginx module doesn't honor the Cache-Control
+    # header at all. For the cases where a user sends `max-age=0` or
+    # `no-cache`, this will do the right thing and bypass the uwsgi
+    # module's cache. This hack does not handle cases where max-age
+    # is set to something else - it will just use the cache in that
+    # case regardless of age
+    cache_options.sections.add(
+        EmptyBlock(set=['$nocache', '0']),
+        Block(
+            'if ($http_cache_control = "max-age=0")',
+            set=['$nocache', '1']
+        ),
+        Block(
+            'if ($http_cache_control = "no-cache")',
+            set=['$nocache', '1']
+        ),
+        EmptyBlock(uwsgi_cache_valid=['404', '5s']),
+        EmptyBlock(uwsgi_cache_valid=['200', '301', '302', '1d']),
+    )
+
+    return cache_options
+
+
+def _large_buffers():
+    """ These are some larger than default buffer settings.
+
+    Use at your own risk!
+
+    """
+    return EmptyBlock(
+        **dict(
+            client_body_buffer_size='128k',
+            client_max_body_size='10m',
+            client_header_buffer_size='1k',
+            large_client_header_buffers=[4, '4k'],
+            output_buffers=[1, '32k'],
+            postpone_output=1460,
+        )
+    )
+
+
+def _statsd_options_location():
+    """ These are some good defaults to supply to Nginx when using the statsd plugin.
+
+    https://github.com/zebrafishlabs/nginx-statsd
+
+    NB! it requires you to include a "statsd_server" directive in your http section.
+    This set of common directives should go in any Location block.
+
+    """
+    statsd = EmptyBlock()
+    statsd.sections.add(
+        EmptyBlock(statsd_count=['"nginx.requests"', '1']),
+        EmptyBlock(statsd_count=['"nginx.responses.$status"', '1', '"$status"']),
+        EmptyBlock(statsd_timing=['"nginx.request_time"', '"$request_time"']),
+        EmptyBlock(statsd_timing=['"nginx.upstream_response_time"', '"$upstream_response_time"']),
+        EmptyBlock(statsd_count=['"nginx.response_length"', '"$request_length"']),
+        EmptyBlock(statsd_count=['"nginx.bytes_sent"', '"$bytes_sent"']),
+    )
+    return statsd
+
+
+# aliases
+uwsgi_params = _uwsgi_params()
+uwsgi_ssl_params = _uwsgi_ssl_params()
+uwsgi_cache = _uwsgi_cache()
+gzip_options = _gzip_options()
+buffer_options = _large_buffers()
+uwsgi_cache_location = _uwsgi_cache_location()
+statsd_options_location = _statsd_options_location()
+
+
+def user_agent_block(blocklist, return_code=403):
+    return Block(
+        'if ($http_user_agent ~* ({}))'.format('|'.join(blocklist)),
+        **{'return': return_code}
+    )
+
+
+def ratelimit_options(qps):
+    """ Rcreate rate limit shared memory zone, used for tracking different connections.
+
+    :param int|str qps: Queries per second to rate limit.
+    """
+    return EmptyBlock(
+        limit_req_zone=[
+            '$binary_remote_addr',
+            'zone=ratelimit_zone:10m',
+            'rate={qps}r/s'.format(qps=qps),
+        ]
+    )
+
+
+def ratelimit_options_location(burst_qps):
+    """ This needs to be added to a location block in order for that location to get rate limiting
+
+    :param int|str burst_qps: Queries per second to allow bursting to.
+    """
+    return EmptyBlock(
+        limit_req_zone=[
+            'zone=ratelimit_zone',
+            'burst={burst_qps}'.format(burst_qps=burst_qps),
+        ]
+    )