Jeppe Bundgaard
8c8de541be
- Add new upstream PHP-FPM servers to Nginx configuration for enhanced load balancing. - Introduce Elastic APM PHP agent in `php.ini` and update Dockerfile for better dependency management. - Secure Kibana and Elasticsearch connections in Metricbeat/Filebeat configurations with credentials. - Remove unused PHP dependencies from `composer.json` and `composer.lock`.
88 lines
3.2 KiB
Plaintext
88 lines
3.2 KiB
Plaintext
worker_processes auto;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Structured JSON access logs and correlation id
|
|
map $http_x_request_id $req_id { default $http_x_request_id; "" $request_id; }
|
|
log_format json escape=json '{"time":"$time_iso8601","req_id":"$req_id","remote":"$remote_addr","host":"$host","method":"$request_method","uri":"$request_uri","status":$status,"bytes":$bytes_sent,"referer":"$http_referer","ua":"$http_user_agent","up_addr":"$upstream_addr","up_st":"$upstream_status","up_rt":$upstream_response_time,"rt":$request_time}';
|
|
|
|
# Log settings
|
|
access_log /var/log/nginx/access.ndjson json; # structured JSON for ELK
|
|
access_log /var/log/nginx/access.log; # standard combined for Elastic Agent nginx integration
|
|
error_log /var/log/nginx/error.log warn;
|
|
|
|
# Gzip settings (optional)
|
|
gzip on;
|
|
gzip_disable "msie6";
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_buffers 16 8k;
|
|
gzip_http_version 1.1;
|
|
gzip_types text/plain application/xml text/css application/javascript application/json application/x-javascript text/javascript;
|
|
|
|
# Upstream pool for PHP-FPM (load-balanced)
|
|
upstream php_fpm {
|
|
least_conn;
|
|
server php1:9000 max_fails=3 fail_timeout=10s;
|
|
server php2:9000 max_fails=3 fail_timeout=10s;
|
|
keepalive 32;
|
|
}
|
|
|
|
# HTTP server (no HTTPS for local development)
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Logging headers
|
|
add_header X-Request-Id $req_id always;
|
|
|
|
# Root and index
|
|
root /var/www/html;
|
|
index index.php index.html index.htm;
|
|
|
|
# Main application location
|
|
location / {
|
|
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
|
|
add_header Access-Control-Allow-Credentials true;
|
|
if ($request_method = 'OPTIONS') {
|
|
add_header Access-Control-Allow-Origin *;
|
|
add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
|
|
add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
|
|
return 204;
|
|
}
|
|
|
|
include fastcgi_params;
|
|
fastcgi_pass php_fpm;
|
|
fastcgi_index index.php;
|
|
fastcgi_read_timeout 60s;
|
|
fastcgi_param SCRIPT_FILENAME $document_root/index.php;
|
|
fastcgi_param X_REQUEST_ID $req_id;
|
|
fastcgi_keep_conn on;
|
|
}
|
|
|
|
# Deny access to hidden files
|
|
location ~ /\. { deny all; }
|
|
location ~ /\.ht { deny all; }
|
|
}
|
|
|
|
# Internal metrics endpoint for Metricbeat (not exposed to host)
|
|
# Scraped at http://nginx:8080/stub_status by the metricbeat nginx module
|
|
server {
|
|
listen 8080;
|
|
server_name _;
|
|
access_log off;
|
|
location /stub_status {
|
|
stub_status;
|
|
allow all; # safe within the docker network; not published to host
|
|
}
|
|
}
|
|
}
|