nginx note

# ACL via X-Forwarded-For
## Simple pattern (1 r-proxy)

```nginx
server {
    listen       80;
    server_name  localhost;
    set_real_ip_from   172.17.0.1/32;
    real_ip_header     X-Forwarded-For;
    #real_ip_recursive off; = default

    location / {
        allow x.x.x.x/32;
        deny all;
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
```

### test pattern
- XFF = `x.x.x.x` & remote-add = `172.17.0.1` : `Allowed`
- XFF = `x.x.x.x,10.10.10.10` & remote-add = `172.17.0.1` : `Denied`
- XFF = `x.x.x.x,172.17.0.1` & remote-add = `172.17.0.1` : `Denied`

I guess..　　

- When we set single `set_real_ip_from` only , evaluate most right side.  

## Multi (r-proxy)

```nginx
server {
    listen       80;
    server_name  localhost;
    set_real_ip_from   172.17.0.1/32;
    set_real_ip_from   10.10.10.10/32;
    real_ip_header     X-Forwarded-For;
    real_ip_recursive on;

    location / {
        allow x.x.x.x/32;
        deny all;
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
```

### test pattern
- XFF = `x.x.x.x` & remote-add = `172.17.0.1` : `Allowed`
- XFF = `x.x.x.x,10.10.10.10` & remote-add = `172.17.0.1` : `Allowed`
- XFF = `x.x.x.x,172.17.0.1` & remote-add = `172.17.0.1` : `Allowed`
- XFF = `x.x.x.x,10.10.10.10,5,5,5,5` & remote-add = `172.17.0.1` : `Denied`
- XFF = `x.x.x.x,5,5,5,5,10.10.10.10` & remote-add = `172.17.0.1` : `Denied`
- XFF = `x.x.x.x,172.17.0.1,10.10.10.10` & remote-add = `172.17.0.1` : `Allowd`

If you set `real_ip_recursive on`, eval `set_real_ip_from` in `XFF`. But `set_real_ip_from` should chained nothing to do with `set_ral_ip_from` oder @ config-file.  
So, if attacker knows both `172.17.0.1/32` , `10.10.10.10/32` and allowed IP, crack it!  
  
# Stop & Start & Signals
https://www.nginx.com/resources/wiki/start/topics/tutorials/commandline/#stopping-or-restarting-nginx

- start
- stop `kill -QUIT <nginx master process id>`

## signal
- `HUP` gracefully!, for new configuration reload
- `USR1` Reopen the log files! Nice! for logrotate
- `USR2` Upgrade Executable on the fly... realy? https://www.nginx.com/resources/wiki/start/topics/tutorials/commandline/#upgrading-to-a-new-binary-on-the-fly
- `KILL` Abort!

For logrotate, use `USR1`


# setEnvIf X-Forwarded-Proto => HTTPS

`fastcgi_param HTTPS on:`

```
  fastcgi_pass   ...
  fastcgi_index  index.php;
  fastcgi_param  SCRIPT_FILENAME $document_root/$fastcgi_script_name;
  fastcgi_param  HTTPS on;
  include        fastcgi_params;
```

# Redirect http => https behind ELB

```
        if ($http_x_forwarded_proto != "https") {
           return 301 https://$http_host$request_uri;
        }
```

# use some conditions @ if directive

Use concat strings insted of...

https://gist.github.com/jrom/1760790


```
    if ($request_uri = /) {
      set $test  root;
    }

    if ($host ~* teambox.com) {
      set $test  "${test}+teambox.com";
    }

    if ($http_cookie !~* "auth_token") {
      set $test  "${test}+no_auth_token";
    }

    if ($test = "root+teambox.com+no_auth_token") {
      proxy_pass http://teambox-cms.heroku.com;
      break;
    }

```



# location ....

http://heartbeats.jp/hbblog/2012/04/nginx05.html