ansible_playbooks/roles/waf_manual/templates/template_angie.conf.j2

# angie configuration file
# inserts into http location

{% if app_config[app].USUAL_SETTINGS %} 
{% for item in range(app_config[app].SID_NUMBERS | length) %}
upstream secure{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }} {
{% for i in range(1, (app_config[app].CONTAINER_NUMBERS | int) + 1) %}
    server 127.0.0.1:{{ finded_port | int + i + item * ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) }} weight=50;
{% endfor %}
    keepalive 60;
    keepalive_timeout 70s;
}
 
upstream unsecure{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }} {
{% for i in range(1, (app_config[app].CONTAINER_NUMBERS | int) + 1) %}
    server 127.0.0.1:{{ finded_port | int + i - 1000 + item * ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) }} weight=50;
{% endfor %}
    keepalive 60;
    keepalive_timeout 70s;
}

server {
    listen 80;
    server_name {{ app_config[app].SERVER_NAMES_FOR_APPS[item] }};

    access_log                        /var/log/angie/{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }}_access.log waf;
    error_log                         /var/log/angie/{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }}_error.log  error;

    # waf networks
    {% for nets in waf_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}
# antibot networks
    {% for nets in antibot_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}

    real_ip_header                     X-Forwarded-For;
    real_ip_recursive                  on;


    server_tokens                      off;
    sendfile                           on;
    gzip                               on;
    client_max_body_size               0;
    large_client_header_buffers        4 128k;


    proxy_next_upstream                error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_http_version                 1.1;
    proxy_connect_timeout              3s;
    proxy_busy_buffers_size            32k;
    proxy_buffers                      4 32k;
    proxy_buffer_size                  16k;
    proxy_read_timeout                 120s;
    proxy_send_timeout                 120s;
    send_timeout                       60s;
    keepalive_timeout                  75s;
    keepalive_requests                 1000;
    resolver_timeout                   30s;


    proxy_set_header                   X-Real-IP          $remote_addr;
    proxy_set_header                  X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header                   Connection         "upgrade";
    proxy_set_header                   Upgrade            $http_upgrade;
    proxy_set_header                   Host               $host;
    proxy_pass_header                  Date;
    proxy_pass_header                  Server;


    location / {
        proxy_pass http://unsecure{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }} ;
    }
}


server {
    listen 443 ssl;
    server_name {{ app_config[app].SERVER_NAMES_FOR_APPS[item] }};


    access_log                        /var/log/angie/{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }}_access.log waf;
    error_log                         /var/log/angie/{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }}_error.log  error;


    ssl_certificate                    /etc/ssl/certs/sp.crt;
    ssl_certificate_key                /etc/ssl/private/sp.key;

    ssl_protocols                      TLSv1.3 TLSv1.2;
    ssl_prefer_server_ciphers          on;

    # waf networks
    {% for nets in waf_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}
# antibot networks
    {% for nets in antibot_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}

    real_ip_header                     X-Forwarded-For;
    real_ip_recursive                  on;


    server_tokens                      off;
    sendfile                           on;
    gzip                               on;
    client_max_body_size               0;
    large_client_header_buffers        4 128k;


    proxy_next_upstream                error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_http_version                 1.1;
    proxy_connect_timeout              3s;
    proxy_busy_buffers_size            32k;
    proxy_buffers                      4 32k;
    proxy_buffer_size                  16k;
    proxy_read_timeout                 120s;
    proxy_send_timeout                 120s;
    send_timeout                       60s;
    keepalive_timeout                  75s;
    keepalive_requests                 1000;
    resolver_timeout                   30s;


    proxy_set_header                   X-Real-IP          $remote_addr;
    proxy_set_header                  X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header                   Connection         "upgrade";
    proxy_set_header                   Upgrade            $http_upgrade;
    proxy_set_header                   Host               $host;
    proxy_pass_header                  Date;
    proxy_pass_header                  Server;


    location / {
        proxy_pass http://secure{{ app_config[app].SID_NUMBERS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES[item] }} ;

    }

}
{% endfor %}
{% endif %}

{% if app_config[app].CUSTOM_CONFIG_ANGIE_NEED %}
{% for item in range(app_config[app].SID_NUMBERS_WITH_CUSTOM | length) %}
upstream secure{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }} {
{% for i in range(1, (app_config[app].CONTAINER_NUMBERS | int) + 1) %}
    server 127.0.0.1:{{ finded_port | int + ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) * (app_config[app].SID_NUMBERS | length) + i + item * ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) }} weight=50;
{% endfor %}
{% if app_config[app].CUSTOM_CONFIG_ANGIE_UPSTREAM_NEED %}
    {{ app_config[app].CUSTOM_CONFIG_ANGIE_UPSTREAM[item] }}
{% else %}
    keepalive 60;
    keepalive_timeout 70s;
{% endif %}
}
 
upstream unsecure{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }} {
{% for i in range(1, (app_config[app].CONTAINER_NUMBERS | int) + 1) %}
    server 127.0.0.1:{{ finded_port | int + ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) * (app_config[app].SID_NUMBERS | length) + i - 1000 + item * ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) }} weight=50;
{% endfor %}
{% if app_config[app].CUSTOM_CONFIG_ANGIE_UPSTREAM_NEED %}
    {{ app_config[app].CUSTOM_CONFIG_ANGIE_UPSTREAM[item] }}
{% else %}
    keepalive 60;
    keepalive_timeout 70s;
{% endif %}
}

server {
    listen 80;
    server_name {{ app_config[app].SERVER_NAMES_FOR_CUSTOM_APPS[item] }};

    access_log                        /var/log/angie/{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }}_access.log waf;
    error_log                         /var/log/angie/{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }}_error.log  error;

    # waf networks
    {% for nets in waf_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}
# antibot networks
    {% for nets in antibot_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}

    real_ip_header                     X-Forwarded-For;
    real_ip_recursive                  on;


    server_tokens                      off;
    sendfile                           on;
    gzip                               on;
    client_max_body_size               0;
    large_client_header_buffers        4 128k;


    proxy_next_upstream                error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_http_version                 1.1;
    proxy_connect_timeout              3s;
    proxy_busy_buffers_size            32k;
    proxy_buffers                      4 32k;
    proxy_buffer_size                  16k;
    proxy_read_timeout                 120s;
    proxy_send_timeout                 120s;
    send_timeout                       60s;
    keepalive_timeout                  75s;
    keepalive_requests                 1000;
    resolver_timeout                   30s;


    proxy_set_header                   X-Real-IP          $remote_addr;
    proxy_set_header                  X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header                   Connection         "upgrade";
    proxy_set_header                   Upgrade            $http_upgrade;
    proxy_set_header                   Host               $host;
    proxy_pass_header                  Date;
    proxy_pass_header                  Server;


    location / {
        proxy_pass http://unsecure{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }} ;
        {{ app_config[app].CUSTOM_CONFIG_ANGIE[item] }}
    }
}


server {
    listen 443 ssl;
    server_name {{ app_config[app].SERVER_NAMES_FOR_CUSTOM_APPS[item] }};


    access_log                        /var/log/angie/{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }}_access.log waf;
    error_log                         /var/log/angie/{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }}_error.log  error;


    ssl_certificate                    /etc/ssl/certs/sp.crt;
    ssl_certificate_key                /etc/ssl/private/sp.key;

    ssl_protocols                      TLSv1.3 TLSv1.2;
    ssl_prefer_server_ciphers          on;

    # waf networks
    {% for nets in waf_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}
# antibot networks
    {% for nets in antibot_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}

    real_ip_header                     X-Forwarded-For;
    real_ip_recursive                  on;


    server_tokens                      off;
    sendfile                           on;
    gzip                               on;
    client_max_body_size               0;
    large_client_header_buffers        4 128k;


    proxy_next_upstream                error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_http_version                 1.1;
    proxy_connect_timeout              3s;
    proxy_busy_buffers_size            32k;
    proxy_buffers                      4 32k;
    proxy_buffer_size                  16k;
    proxy_read_timeout                 120s;
    proxy_send_timeout                 120s;
    send_timeout                       60s;
    keepalive_timeout                  75s;
    keepalive_requests                 1000;
    resolver_timeout                   30s;


    proxy_set_header                   X-Real-IP          $remote_addr;
    proxy_set_header                  X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header                   Connection         "upgrade";
    proxy_set_header                   Upgrade            $http_upgrade;
    proxy_set_header                   Host               $host;
    proxy_pass_header                  Date;
    proxy_pass_header                  Server;


    location / {
        proxy_pass http://secure{{ app_config[app].SID_NUMBERS_WITH_CUSTOM[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM[item] }} ;
        {{ app_config[app].CUSTOM_CONFIG_ANGIE[item] }}
    }
{% if app_config[app].CUSTOM_LOCATIONS_NEED %}
    {{ app_config[app].CUSTOM_LOCATIONS_ANGIE[item] }}
{% endif %}

}
{% endfor %}
{% endif %}

{% if app_config[app].CUSTOM_PORTS_NEED %}
{% for item in range(app_config[app].SID_NUMBERS_WITH_CUSTOM_PORTS | length) %}
upstream secure{{ app_config[app].SID_NUMBERS_WITH_CUSTOM_PORTS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM_PORTS[item] }}_{{ app_config[app].CUSTOM_PORTS[item] }} {
{% for i in range(1, (app_config[app].CONTAINER_NUMBERS | int) + 1) %}
{% if app_config[app].CUSTOM_CONFIG_ANGIE_NEED == false %}
    server 127.0.0.1:{{ finded_port | int + ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) * (app_config[app].SID_NUMBERS | length) + i + item * ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) }} weight=50;
{% else %}
    server 127.0.0.1:{{ finded_port | int + (finded_port | int + ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10) * (app_config[app].SID_NUMBERS | length) + i + item * ((app_config[app].CONTAINER_NUMBERS | int + 9) // 10 * 10)) }} weight=50;
{% endif %}
{% endfor %}
{% if app_config[app].CUSTOM_CONFIG_ANGIE_UPSTREAM_NEED_WITH_CUSTOM_PORTS %}
    {{ app_config[app].CUSTOM_CONFIG_ANGIE_UPSTREAM_WITH_CUSTOM_PORTS[item] }}
{% else %}
    keepalive 60;
    keepalive_timeout 70s;
{% endif %}
}

server {
    listen {{ app_config[app].CUSTOM_PORTS[item] }} ssl;
    server_name {{ app_config[app].SERVER_NAMES_FOR_CUSTOM_APPS_PORTS[item] }};


    access_log                        /var/log/angie/{{ app_config[app].SID_NUMBERS_WITH_CUSTOM_PORTS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM_PORTS[item] }}_access.log waf;
    error_log                         /var/log/angie/{{ app_config[app].SID_NUMBERS_WITH_CUSTOM_PORTS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM_PORTS[item] }}_error.log  error;


    ssl_certificate                    /etc/ssl/certs/sp.crt;
    ssl_certificate_key                /etc/ssl/private/sp.key;

    ssl_protocols                      TLSv1.3 TLSv1.2;
    ssl_prefer_server_ciphers          on;

    # waf networks
    {% for nets in waf_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}
# antibot networks
    {% for nets in antibot_networks %}
set_real_ip_from                   {{ nets }};
    {% endfor %}

    real_ip_header                     X-Forwarded-For;
    real_ip_recursive                  on;


    server_tokens                      off;
    sendfile                           on;
    gzip                               on;
    client_max_body_size               0;
    large_client_header_buffers        4 128k;


    proxy_next_upstream                error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_http_version                 1.1;
    proxy_connect_timeout              3s;
    proxy_busy_buffers_size            32k;
    proxy_buffers                      4 32k;
    proxy_buffer_size                  16k;
    proxy_read_timeout                 120s;
    proxy_send_timeout                 120s;
    send_timeout                       60s;
    keepalive_timeout                  75s;
    keepalive_requests                 1000;
    resolver_timeout                   30s;


    proxy_set_header                   X-Real-IP          $remote_addr;
    proxy_set_header                  X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header                   Connection         "upgrade";
    proxy_set_header                   Upgrade            $http_upgrade;
    proxy_set_header                   Host               $host;
    proxy_pass_header                  Date;
    proxy_pass_header                  Server;


    location / {
        proxy_pass http://secure{{ app_config[app].SID_NUMBERS_WITH_CUSTOM_PORTS[item] }}_{{ app_config[app].APP_IN_TENANT_NAMES_WITH_CUSTOM_PORTS[item] }}_{{ app_config[app].CUSTOM_PORTS[item] }} ;
{% if app_config[app].CUSTOM_CONFIG_ANGIE_NEED_WITH_CUSTOM_PORTS %}
        {{ app_config[app].CUSTOM_CONFIG_ANGIE_WITH_CUSTOM_PORTS[item] }}
{% endif %}
    }

}
{% endfor %}
{% endif %}