nginx.conf.j2 (1845B)
1 # Managed by Ansible. Separate from the exchange webserver configuration. 2 {% set node = monitoring_public_bundle.monitoring_client.node_exporter %} 3 {% set bind = node.proxy_bind_address | default('127.0.0.1') | replace('[', '') | replace(']', '') %} 4 user www-data; 5 worker_processes 1; 6 pid /run/node-exporter-proxy.pid; 7 error_log stderr warn; 8 9 events { 10 worker_connections 128; 11 } 12 13 http { 14 access_log off; 15 server_tokens off; 16 map_hash_bucket_size 128; 17 map $ssl_client_s_dn $taler_node_exporter_client_allowed { 18 default 0; 19 {{ ('CN=' ~ node.prometheus_client_identity) | to_json }} 1; 20 } 21 22 server { 23 {% if bind == '*' %} 24 listen 0.0.0.0:{{ node.proxy_port }} ssl; 25 listen [::]:{{ node.proxy_port }} ssl ipv6only=on; 26 {% else %} 27 listen {{ '[' ~ bind ~ ']' if ':' in bind else bind }}:{{ node.proxy_port }} ssl; 28 {% endif %} 29 server_name _; 30 ssl_certificate /etc/taler-monitoring/tls/server.cert.pem; 31 ssl_certificate_key /etc/taler-monitoring/tls/server.key.pem; 32 ssl_client_certificate /etc/taler-monitoring/tls/ca.cert.pem; 33 ssl_verify_client on; 34 ssl_verify_depth 1; 35 ssl_protocols TLSv1.2 TLSv1.3; 36 ssl_session_tickets off; 37 38 if ($taler_node_exporter_client_allowed = 0) { 39 return 403; 40 } 41 42 location = /metrics { 43 proxy_pass http://{{ node.backend_listen_address }}; 44 proxy_http_version 1.1; 45 proxy_set_header Connection ""; 46 proxy_buffering off; 47 } 48 location = /fluent-bit/metrics { 49 proxy_pass http://127.0.0.1:2020/api/v1/metrics/prometheus; 50 proxy_http_version 1.1; 51 proxy_set_header Connection ""; 52 proxy_buffering off; 53 } 54 location / { 55 return 404; 56 } 57 } 58 }