#=====
# nginx: see `nginx.ng` state instead.
#======
nginx:
  install_from_source: True
  use_upstart: True
  use_sysvinit: False
  user_auth_enabled: True
  with_luajit: False
  with_openresty: True
  repo_version: development  # Must be using ppa install by setting `repo_source = ppa`
  set_real_ips: # NOTE: to use this, nginx must have http_realip module enabled
    from_ips:
      - 10.10.10.0/24
    real_ip_header: X-Forwarded-For
  modules:
    headers-more:
      source: http://github.com/agentzh/headers-more-nginx-module/tarball/v0.21
      source_hash: sha1=dbf914cbf3f7b6cb7e033fa7b7c49e2f8879113b
  #pid: /var/run/nginx.pid
             # Directory location must exist (i.e. it's  /run/nginx.pid on EL7)

# ========
# nginx.ng
# ========

nginx:
  ng:
    # The following three `install_from_` options are mutually exclusive. If none is used, the distro's provided
    # package will be installed. If one of the `install_from` option is set to `True`, the state will
    # make sure the other two repos are removed.

    # Use the official's nginx repo binaries
    install_from_repo: false

    # Use Phusionpassenger's repo to install nginx and passenger binaries
    # Debian, Centos, Ubuntu and Redhat are currently available
    install_from_phusionpassenger: false

    # PPA install
    install_from_ppa: false
    # Set to 'stable', 'development' (mainline), 'community', or 'nightly' for each build accordingly ( https://launchpad.net/~nginx )
    ppa_version: 'stable'

    # Source install
    source_version: '1.10.0'
    source_hash: ''

    # These are usually set by grains in map.jinja
    # Typically you can comment these out.
    lookup:
      package: nginx-custom (can be a list)
      service: nginx
      webuser: www-data
      conf_file: /etc/nginx/nginx.conf
      server_available: /etc/nginx/sites-available
      server_enabled: /etc/nginx/sites-enabled
      server_use_symlink: True
      # If you install nginx+passenger from phusionpassenger in Debian, these values will probably be needed
      passenger_package: libnginx-mod-http-passenger
      passenger_config_file: /etc/nginx/conf.d/mod-http-passenger.conf

      # This is required for RedHat like distros (Amazon Linux) that don't follow semantic versioning for $releasever
      rh_os_releasever: '6'
      # Currently it can be used on rhel/centos/suse when installing from repo
      gpg_check: True
      pid_file: /var/run/nginx.pid   ### prevents rendering SLS error nginx.server.config.pid undefined ###


    # Source compilation is not currently a part of nginx.ng
    from_source: False

    source:
      opts: {}

    package:
      opts: {} # this partially exposes parameters of pkg.installed

    service:
      enable: True # Whether or not the service will be enabled/running or dead
      opts: {} # this partially exposes parameters of service.running / service.dead

    ##--- --- - - - - - - -- - - - - -- - - --- -- - -- - - - -- - - - - -- - - - -- - - - -- - ##
    ## You can use snippets to define often repeated configuration once and include it later
    ## The letsencrypt example below is consumed by "- include: 'snippets/letsencrypt.conf'"
    ##--- --- - - - - - - --  - - -- -- - - --- -- - -- - - - -- - - - - -- - - - -- - - - -- - ##
    snippets:
      letsencrypt:
        - location ^~ /.well-known/acme-challenge/:
          - proxy_pass: http://localhost:9999
      cloudflare_proxy:
        - set_real_ip_from: 103.21.244.0/22
        - set_real_ip_from: 103.22.200.0/22
        - set_real_ip_from: 104.16.0.0/12
        - set_real_ip_from: 108.162.192.0/18
      blacklist:
        - map $http_user_agent $bad_bot:
          - default: 0
          - '~*^Lynx': 0
          - '~*malicious': 1
          - '~*bot': 1
          - '~*crawler': 1
          - '~*bandit': 1
          - libwww-perl: 1
          - '~(?i)(httrack|htmlparser|libwww)': 1
      upstream_netdata_tcp:
        - upstream netdata:
          - server: 127.0.0.1:19999
          - keepalive: 64


    server:
      opts: {} # this partially exposes file.managed parameters as they relate to the main nginx.conf file

      #-- - - - - -- - - -- - - - - -- - - -- - - - -- - - - - - -- - - - - - -- - - - - -- - - - - -- - - #
      # nginx.conf (main server) declarations
      # dictionaries map to blocks {} and lists cause the same declaration to repeat with different values
      # see also http://nginx.org/en/docs/example.html
      #-- - - - - -- - - -- - - - - -- - - -- - - - -- - - - - - -- - - - - - -- - - - - -- - - - - -- - - #
      config:
        include 'snippets/letsencrypt.conf'
        source_path: salt://path_to_nginx_conf_file/nginx.conf # IMPORTANT: This option is mutually exclusive with the rest of the
                                                          # options; if it is found other options (worker_processes: 4 and so
                                                          # on) are not processed and just upload the file from source
        worker_processes: 4
        load_module: modules/ngx_http_lua_module.so  # pass as very first in configuration; otherwise nginx will fail to start
        #pid: /var/run/nginx.pid                     # Directory location must exist (i.e. it's  /run/nginx.pid on EL7)
        events:
          worker_connections: 768
        http:
          sendfile: 'on'
          include:
            #### Note: Syntax issues in these files generate nginx [emerg] errors on startup.  ####
            - /etc/nginx/mime.types

        ### module ngx_http_log_module example
        log_format: |-
          main '...';
            access_log /var/log/nginx/access_log main
        access_log: []       #suppress default access_log option from being added

        ### module nngx_stream_core_module
        ### https://docs.nginx.com/nginx/admin-guide/load-balancer/tcp-udp-load-balancer/#example
        stream:
          upstream lb-1000:
            - server:
              - hostname1.example.com:1000
              - hostname2.example.com:1000
          upstream stream_backend:
            least_conn: ''
            'server backend1.example.com:12345 weight=5':
            'server backend2.example.com:12345 max_fails=2 fail_timeout=30s':
            'server backend3.example.com:12345 max_conns=3':
          upstream dns_servers:
            least_conn:
            'server 192.168.136.130:53':
            'server 192.168.136.131:53':
            'server 192.168.136.132:53':
          server:
            listen: 1000
            proxy_pass: lb-1000
          'server ':
            listen: '53 udp'
            proxy_pass: dns_servers
          'server   ':
            listen: 12346
            proxy_pass: backend4.example.com:12346


    servers:
      disabled_postfix: .disabled # a postfix appended to files when doing non-symlink disabling
      symlink_opts: {} # partially exposes file.symlink params when symlinking enabled sites
      rename_opts: {} # partially exposes file.rename params when not symlinking disabled/enabled sites
      managed_opts: {} # partially exposes file.managed params for managed server files
      dir_opts: {} # partially exposes file.directory params for site available/enabled and snippets dirs


      #####################
      # server declarations; placed by default in server "available" directory
      #####################
      managed:

        mysite:  # relative filename of server file  (defaults to '/etc/nginx/sites-available/mysite')
          # may be True, False, or None where True is enabled, False, disabled, and None indicates no action
          enabled: True

          # Remove the site config file shipped by nginx (i.e. '/etc/nginx/sites-available/default' by default)
          # It also remove the symlink (if it is exists).
          # The site MUST be disabled before delete it (if not the nginx is not reloaded).
          #deleted: True

          #available_dir: /etc/nginx/sites-available-custom   # custom directory (not sites-available) for server filename
          #enabled_dir: /etc/nginx/sites-enabled-custom       # custom directory (not sites-enabled) for server filename
          disabled_name: mysite.aint_on                       # an alternative disabled name to be use when not symlinking
          overwrite: True                                     # overwrite an existing server file or not

          # May be a list of config options or None, if None, no server file will be managed/templated
          # Take server directives as lists of dictionaries. If the dictionary value is another list of
          # dictionaries a block {} will be started with the dictionary key name
          config:
            - server:
              - server_name: localhost
              - listen:
                - '80 default_server'
              - listen:
                - '443 ssl'
              - index: 'index.html index.htm'
              - location ~ .htm:
                - try_files: '$uri $uri/ =404'
                - test: something else
              - include 'snippets/letsencrypt.conf'

          # Or a slightly more compact alternative syntax:

            - server:
              - server_name: localhost
              - listen:
                - '80 default_server'
                - '443 ssl'
              - index: 'index.html index.htm'
              - location ~ .htm:
                - try_files: '$uri $uri/ =404'
                - test: something else
              - include 'snippets/letsencrypt.conf'

          # both of those output:
          # server {
          #    server_name localhost;
          #    listen 80 default_server;
          #    listen 443 ssl;
          #    index index.html index.htm;
          #    location ~ .htm {
          #        try_files $uri $uri/ =404;
          #        test something else;
          #    }
          # }

        mysite2: # Using source_path options to upload the file instead of templating all the file
          enabled: True
          available_dir: /etc/nginx/sites-available
          enabled_dir: /etc/nginx/sites-enabled
          config:
            source_path: salt://path-to-site-file/mysite2

        # Below configuration becomes handy if you want to create custom configuration files
        # for example if you want to create /usr/local/etc/nginx/http_options.conf with
        # the following content:

        # sendfile on;
        # tcp_nopush on;
        # tcp_nodelay on;
        # send_iowait 12000;

        http_options.conf:
          enabled: True
          available_dir: /usr/local/etc/nginx
          enabled_dir: /usr/local/etc/nginx
          config:
            - sendfile: 'on'
            - tcp_nopush: 'on'
            - tcp_nodelay: 'on'
            - send_iowait: 12000

    certificates_path: '/etc/nginx/ssl'  # Use this if you need to deploy below certificates in a custom path.
    # If you're doing SSL termination, you can deploy certificates this way.
    # The private one(s) should go in a separate pillar file not in version
    # control (or use encrypted pillar data).
    certificates:
      'www.example.com':

        # choose one of: deploying this cert by pillar (e.g. in combination with ext_pillar and file_tree)
        # public_cert_pillar: certs:example.com:fullchain.pem
        # private_key_pillar: certs:example.com:privkey.pem
        # or directly pasting the cert
        public_cert: |
          -----BEGIN CERTIFICATE-----
          (Your Primary SSL certificate: www.example.com.crt)
          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----
          (Your Intermediate certificate: ExampleCA.crt)
          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----
          (Your Root certificate: TrustedRoot.crt)
          -----END CERTIFICATE-----
        private_key: |
          -----BEGIN RSA PRIVATE KEY-----
          (Your Private Key: www.example.com.key)
          -----END RSA PRIVATE KEY-----

    dh_param:
      'mydhparam1.pem': |
        -----BEGIN DH PARAMETERS-----
        (Your custom DH prime)
        -----END DH PARAMETERS-----
      # or to generate one on-the-fly
      'mydhparam2.pem':
        keysize: 2048

    # Passenger configuration
    # Default passenger configuration is provided, and will be deployed in
    # /etc/nginx/conf.d/passenger.conf
    passenger:
      passenger_root: /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
      passenger_ruby: /usr/bin/ruby
      passenger_instance_registry_dir: /var/run/passenger-instreg