<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Module ngx_http_stub_status_module</title><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="../../../css/style_en.css">

Planning your ingress-nginx migration? Start here:
kubernetes.nginx.org.

<input class="side-menu" type="checkbox" id="side-menu">

english

русский

news

about

download

security

documentation

faq

books

community

enterprise

community forum (new)

x.com

blog

njs

ingress controller

gateway fabric

Module ngx_http_stub_status_module

Example Configuration
Directives
     stub_status
Data
Embedded Variables

The ngx_http_stub_status_module module provides
access to basic status information.

This module is not built by default, it should be enabled with the
--with-http_stub_status_module
configuration parameter.

Example Configuration

location = /basic_status {
    stub_status;
}

This configuration creates a simple web page
with basic status data which may look like as follows:

Active connections: 291
server accepts handled requests
 16630948 16630948 31070465
Reading: 6 Writing: 179 Waiting: 106

Directives

            Syntax:

            stub_status;

            Default:

            —

            Context:

            server, location

The basic status information will be accessible from the surrounding location.

In versions prior to 1.7.5,
the directive syntax required an arbitrary argument, for example,
“stub_status on”.

Data

The following status information is provided:

Active connections

The current number of active client connections
including Waiting connections.

accepts

The total number of accepted client connections.

handled

The total number of handled connections.
Generally, the parameter value is the same as accepts
unless some resource limits have been reached
(for example, the
worker_connections limit).

requests

The total number of client requests.

Reading

The current number of connections where nginx is reading the request header.

Writing

The current number of connections
where nginx is writing the response back to the client.

Waiting

The current number of idle client connections waiting for a request.

Embedded Variables

The ngx_http_stub_status_module module
supports the following embedded variables (1.3.14):

$connections_active

same as the Active connections value;

$connections_reading

same as the Reading value;

$connections_writing

same as the Writing value;

$connections_waiting

same as the Waiting value.


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Module ngx_http_sub_module</title><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="../../../css/style_en.css">

Planning your ingress-nginx migration? Start here:
kubernetes.nginx.org.

<input class="side-menu" type="checkbox" id="side-menu">

english

русский

news

about

download

security

documentation

faq

books

community

enterprise

community forum (new)

x.com

blog

njs

ingress controller

gateway fabric

Module ngx_http_sub_module

Example Configuration
Directives
     sub_filter
     sub_filter_last_modified
     sub_filter_once
     sub_filter_types

The ngx_http_sub_module module is a filter
that modifies a response by replacing one specified string by another.

This module is not built by default, it should be enabled with the
--with-http_sub_module
configuration parameter.

Example Configuration

location / {
    sub_filter '<a href="http://127.0.0.1:8080/'  '<a href="https://$host/';
    sub_filter '<img src="http://127.0.0.1:8080/' '<img src="https://$host/';
    sub_filter_once on;
}

Directives

            Syntax:

            sub_filter string replacement;

            Default:

            —

            Context:

            http, server, location

Sets a string to replace and a replacement string.
The string to replace is matched ignoring the case.
The string to replace (1.9.4) and replacement string can contain variables.
Several sub_filter directives
can be specified on the same configuration level (1.9.4).
These directives are inherited from the previous configuration level
if and only if there are no sub_filter directives
defined on the current level.

            Syntax:

            sub_filter_last_modified on | off;

            Default:

sub_filter_last_modified off;

            Context:

            http, server, location

This directive appeared in version 1.5.1.

Allows preserving the “Last-Modified” header field
from the original response during replacement
to facilitate response caching.

By default, the header field is removed as contents of the response
are modified during processing.

            Syntax:

            sub_filter_once on | off;

            Default:

sub_filter_once on;

            Context:

            http, server, location

Indicates whether to look for each string to replace
once or repeatedly.

            Syntax:

            sub_filter_types mime-type ...;

            Default:

sub_filter_types text/html;

            Context:

            http, server, location

Enables string replacement in responses with the specified MIME types
in addition to “text/html”.
The special value “*” matches any MIME type (0.8.29).


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Module ngx_http_tunnel_module</title><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="../../../css/style_en.css">

Planning your ingress-nginx migration? Start here:
kubernetes.nginx.org.

<input class="side-menu" type="checkbox" id="side-menu">

english

русский

news

about

download

security

documentation

faq

books

community

enterprise

community forum (new)

x.com

blog

njs

ingress controller

gateway fabric

Module ngx_http_tunnel_module

Example Configuration
Directives
     tunnel_allow_upstream
     tunnel_bind
     tunnel_bind_dynamic
     tunnel_buffer_size
     tunnel_connect_timeout
     tunnel_next_upstream
     tunnel_next_upstream_timeout
     tunnel_next_upstream_tries
     tunnel_pass
     tunnel_read_timeout
     tunnel_send_lowat
     tunnel_send_timeout
     tunnel_socket_keepalive

The ngx_http_tunnel_module (1.31.0) handles HTTP/1.1
CONNECT
requests and establishes an end-to-end virtual connection.

Example Configuration

http {

    map $request_port $allow_port {
        443            1;
    }

    map $host $allow_host {
        hostnames;

        example.org    1;
        *.example.org  1;
    }

    server {
        listen 8000;

        resolver dns.example.com;

        if ($allow_port != 1) {
            return 502;
        }

        if ($allow_host != 1) {
            return 502;
        }

        tunnel_pass;
    }
}

Directives

            Syntax:

            tunnel_allow_upstream string ...;

            Default:

            —

            Context:

            http, server, location

Defines conditions under which access to the backend server
is allowed or denied.
If all string parameters are not empty
and not equal to “0” then the access is allowed.
The conditions are evaluated each time
before a connection to a backend server is established.
Parameter values can contain variables:

geo $upstream_last_addr $allow {
    volatile;
    10.10.0.0/24        1;
}

server {
    listen 127.0.0.1:8080;

    tunnel_pass;
    tunnel_allow_upstream $allow;
}

This directive is available as part of our
commercial subscription.

            Syntax:

            tunnel_bind
    address |
    off;

            Default:

            —

            Context:

            http, server, location

Makes outgoing connections to a backend server originate
from the specified local IP address with an optional port.
Parameter value can contain variables.
The special value off cancels the effect
of the tunnel_bind directive
inherited from the previous configuration level, which allows the
system to auto-assign the local IP address and port.

            Syntax:

            tunnel_bind_dynamic on | off;

            Default:

tunnel_bind_dynamic off;

            Context:

            http, server, location

When enabled, makes the tunnel_bind operation
at each connection attempt:

geo $upstream_last_addr $bind_addr {
    volatile;
    10.0.0.0/24    10.0.0.1;
    192.168.0.0/24  192.168.0.1;
}

tunnel_bind         $bind_addr;
tunnel_bind_dynamic on;

This directive is available as part of our
commercial subscription.

            Syntax:

            tunnel_buffer_size size;

            Default:

tunnel_buffer_size 16k;

            Context:

            http, server, location

Sets the size of the buffer used for reading data
from the backend server.
Also sets the size of the buffer used for reading data
from the client.

            Syntax:

            tunnel_connect_timeout time;

            Default:

tunnel_connect_timeout 60s;

            Context:

            http, server, location

Defines a timeout for establishing a connection with a backend server.
It should be noted that this timeout cannot usually exceed 75 seconds.

            Syntax:

            tunnel_next_upstream
    error |
    timeout |
    denied |
    off
    ...;

            Default:

tunnel_next_upstream error timeout;

            Context:

            http, server, location

Specifies in which cases a request should be passed to the next server:

error

an error occurred while establishing a connection with the
server or reading data from the server;

timeout

a timeout has occurred while establishing a connection with the
server, passing a request to it, or reading data from the server;

denied

the server denied
the connection;

This parameter is available as part of our
commercial subscription.

off

disables passing a request to the next server.

One should bear in mind that passing a request to the next server is
only possible if nothing has been sent to a client yet.
That is, if an error or timeout occurs in the middle of the
transferring of a response, fixing this is impossible.

The directive also defines what is considered an
unsuccessful
attempt of communication with a server.
The cases of error, timeout,
and denied
are always considered unsuccessful attempts,
even if they are not specified in the directive.

Passing a request to the next server can be limited by
the number of tries
and by time.

            Syntax:

            tunnel_next_upstream_timeout time;

            Default:

tunnel_next_upstream_timeout 0;

            Context:

            http, server, location

Limits the time during which a request can be passed to the
next server.
The 0 value turns off this limitation.

            Syntax:

            tunnel_next_upstream_tries number;

            Default:

tunnel_next_upstream_tries 0;

            Context:

            http, server, location

Limits the number of possible tries for passing a request to the
next server.
The 0 value turns off this limitation.

            Syntax:

            tunnel_pass [address];

            Default:

            —

            Context:

            server, location, if in location

Enables handling of CONNECT requests and sets the address of a backend server.
By default, the address is
$host:$request_port and is taken from the client request.
In most cases, tunnel_pass does not require
configuring any arguments.

The address can be specified as a domain name or IP address,
and a port:

tunnel_pass localhost:9000;

or as a UNIX-domain socket path:

tunnel_pass unix:/tmp/backend.socket;

If a domain name resolves to several addresses, all of them will be
used in a round-robin fashion.
In addition, an address can be specified as a
server group.

Parameter value can contain variables.
In this case, if an address is specified as a domain name,
the name is searched among the described
server groups,
and, if not found, is determined using a
resolver.

            Syntax:

            tunnel_read_timeout time;

            Default:

tunnel_read_timeout 60s;

            Context:

            http, server, location

Sets the timeout between two successive read or write operations
on client or backend server connections.
If no data is transmitted within this time, the connection is closed.

            Syntax:

            tunnel_send_lowat size;

            Default:

tunnel_send_lowat 0;

            Context:

            http, server, location

If the directive is set to a non-zero value, nginx will try to
minimize the number
of send operations on outgoing connections to a backend server by using either
NOTE_LOWAT flag of the
kqueue method,
or the SO_SNDLOWAT socket option,
with the specified size.

This directive is ignored on Linux, Solaris, and Windows.

            Syntax:

            tunnel_send_timeout time;

            Default:

tunnel_send_timeout 60s;

            Context:

            http, server, location

Sets a timeout for transmitting a request to the backend server.
The timeout is set only between two successive write operations,
not for the transmission of the whole request.
If the backend server does not receive anything within this time,
the connection is closed.

            Syntax:

            tunnel_socket_keepalive on | off;

            Default:

tunnel_socket_keepalive off;

            Context:

            http, server, location

Configures the “TCP keepalive” behavior
for outgoing connections to a backend server.
By default, the operating system’s settings are in effect for the socket.
If the directive is set to the value “on”, the
SO_KEEPALIVE socket option is turned on for the socket.


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Module ngx_http_upstream_conf_module</title><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="../../../css/style_en.css">

Planning your ingress-nginx migration? Start here:
kubernetes.nginx.org.

<input class="side-menu" type="checkbox" id="side-menu">

english

русский

news

about

download

security

documentation

faq

books

community

enterprise

community forum (new)

x.com

blog

njs

ingress controller

gateway fabric

Module ngx_http_upstream_conf_module

Example Configuration
Directives
     upstream_conf

The ngx_http_upstream_conf_module module
allows configuring upstream server groups on-the-fly
via a simple HTTP interface without the need of restarting nginx.
The
http
or
stream
server group must reside in the shared memory.

This module was available as part of our
commercial subscription
until 1.13.10.
It was superseded by the
ngx_http_api_module module
in 1.13.3.

Example Configuration

upstream backend {
    zone upstream_backend 64k;

    ...
}

server {
    location /upstream_conf {
        upstream_conf;
        allow 127.0.0.1;
        deny all;
    }
}

Directives

            Syntax:

            upstream_conf;

            Default:

            —

            Context:

            location

Turns on the HTTP interface of upstream configuration in the surrounding
location.
Access to this location should be
limited.

Configuration commands can be used to:

view the group configuration;

view, modify, or remove a server;

add a new server.

Since addresses in a group are not required to be unique, specific
servers in a group are referenced by their IDs.
IDs are assigned automatically and shown when adding a new server
or viewing the group configuration.

A configuration command consists of parameters passed as request arguments,
for example:

http://127.0.0.1/upstream_conf?upstream=backend

The following parameters are supported:

stream=

Selects a
stream
upstream server group.
Without this parameter, selects an
http
upstream server group.

upstream=name

Selects a group to work with.
This parameter is mandatory.

id=number

Selects a server for viewing, modifying, or removing.

remove=

Removes a server from the group.

add=

Adds a new server to the group.

backup=

Required to add a backup server.

Before version 1.7.2, backup=
was also required to view, modify, or remove existing backup servers.

server=address

Same as the “address” parameter
of the
http
or
stream
upstream server.

When adding a server, it is possible to specify it as a domain name.
In this case, changes of the IP addresses that correspond to a domain name
will be monitored and automatically applied to the upstream
configuration without the need of restarting nginx (1.7.2).
This requires the “resolver” directive in the
http
or
stream
block.
See also the “resolve” parameter
of the
http
or
stream
upstream server.

service=name

Same as the “service” parameter
of the
http
or
stream
upstream server (1.9.13).

weight=number

Same as the “weight” parameter
of the
http
or
stream
upstream server.

max_conns=number

Same as the “max_conns” parameter
of the
http
or
stream
upstream server.

max_fails=number

Same as the “max_fails” parameter
of the
http
or
stream
upstream server.

fail_timeout=time

Same as the “fail_timeout” parameter
of the
http
or
stream
upstream server.

slow_start=time

Same as the “slow_start” parameter
of the
http
or
stream
upstream server.

down=

Same as the “down” parameter
of the
http
or
stream
upstream server.

drain=

Puts the
http
upstream server into the “draining” mode (1.7.5).
In this mode, only requests
bound to the server
will be proxied to it.

up=

The opposite of the “down” parameter
of the
http
or
stream
upstream server.

route=string

Same as the “route” parameter of the
http
upstream server.

The first three parameters select an object.
This can be either the whole http or stream upstream server group,
or a specific server.
Without other parameters, the configuration of the selected
group or server is shown.

For example, to view the configuration of the whole group, send:

http://127.0.0.1/upstream_conf?upstream=backend

To view the configuration of a specific server, also specify its ID:

http://127.0.0.1/upstream_conf?upstream=backend&id=42

To add a new server,
specify its address in the “server=” parameter.
Without other parameters specified, a server will be added with other
parameters set to their default values (see the
http
or
stream
“server” directive).

For example, to add a new primary server, send:

http://127.0.0.1/upstream_conf?add=&upstream=backend&server=127.0.0.1:8080

To add a new backup server, send:

http://127.0.0.1/upstream_conf?add=&upstream=backend&backup=&server=127.0.0.1:8080

To add a new primary server,
set its parameters to non-default values
and mark it as “down”, send:

http://127.0.0.1/upstream_conf?add=&upstream=backend&server=127.0.0.1:8080&weight=2&down=

To remove a server, specify its ID:

http://127.0.0.1/upstream_conf?remove=&upstream=backend&id=42

To mark an existing server as “down”, send:

http://127.0.0.1/upstream_conf?upstream=backend&id=42&down=

To modify the address of an existing server, send:

http://127.0.0.1/upstream_conf?upstream=backend&id=42&server=192.0.2.3:8123

To modify other parameters of an existing server, send:

http://127.0.0.1/upstream_conf?upstream=backend&id=42&max_fails=3&weight=4

The above examples are for an
http
upstream server group.
Similar examples for a
stream
upstream server group require the “stream=” parameter.


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Module ngx_http_upstream_hc_module</title><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="../../../css/style_en.css">

Planning your ingress-nginx migration? Start here:
kubernetes.nginx.org.

<input class="side-menu" type="checkbox" id="side-menu">

english

русский

news

about

download

security

documentation

faq

books

community

enterprise

community forum (new)

x.com

blog

njs

ingress controller

gateway fabric

Module ngx_http_upstream_hc_module

Example Configuration
Directives
     health_check
     match

The ngx_http_upstream_hc_module module
allows enabling periodic health checks of the servers in a
group
referenced in the surrounding location.
The server group must reside in the
shared memory.

If a health check fails,
the server will be considered unhealthy.
If several health checks are defined for the same group of servers,
a single failure of any check will make the corresponding server be
considered unhealthy.
Client requests are not passed to unhealthy servers
and servers in the “checking” state.

Please note that most of the variables will have empty values
when used with health checks.

This module is available as part of our
commercial subscription.

Example Configuration

upstream dynamic {
    zone upstream_dynamic 64k;

    server backend1.example.com      weight=5;
    server backend2.example.com:8080 fail_timeout=5s slow_start=30s;
    server 192.0.2.1                 max_fails=3;

    server backup1.example.com:8080  backup;
    server backup2.example.com:8080  backup;
}

server {
    location / {
        proxy_pass http://dynamic;
        health_check;
    }
}

With this configuration, nginx will send “/” requests to each
server in the backend group every five seconds.
If any communication error or timeout occurs, or a
proxied server responds with the status code other than
2xx or 3xx, the health check will fail, and the server will
be considered unhealthy.

Health checks can be configured to test the status code of a response,
presence of certain header fields and their values,
and the body contents.
Tests are configured separately using the match directive
and referenced in the match parameter
of the  health_check directive:

http {
    server {
    ...
        location / {
            proxy_pass http://backend;
            health_check match=welcome;
        }
    }

    match welcome {
        status 200;
        header Content-Type = text/html;
        body ~ "Welcome to nginx!";
    }
}

This configuration shows that in order for a health check to pass, the response
to a health check request should succeed, have status 200,
and contain “Welcome to nginx!” in the body.

Directives

            Syntax:

            health_check [parameters];

            Default:

            —

            Context:

            location

Enables periodic health checks of the servers in a
group
referenced in the surrounding location.

The following optional parameters are supported:

interval=time

sets the interval between two consecutive health checks,
by default, 5 seconds.

jitter=time

sets the time within which
each health check will be randomly delayed,
by default, there is no delay.

fails=number

sets the number of consecutive failed health checks of a particular server
after which this server will be considered unhealthy,
by default, 1.

passes=number

sets the number of consecutive passed health checks of a particular server
after which the server will be considered healthy,
by default, 1.

uri=uri

defines the URI used in health check requests,
by default, “/”.

mandatory [persistent]

sets the initial “checking” state for a server
until the first health check is completed (1.11.7).
Client requests are not passed to servers in the “checking” state.
If the parameter is not specified,
the server will be initially considered healthy.

The persistent parameter (1.19.7)
sets the initial “up” state for a server after reload
if the server was considered healthy before reload.

match=name

specifies the match block configuring the tests that a
response should pass in order for a health check to pass.
By default, the response should have status code 2xx or 3xx.

port=number

defines the port used when connecting to a server
to perform a health check (1.9.7).
By default, equals the
server port.

type=grpc
[grpc_service=name]
[grpc_status=code]

enables periodic
health
checks of a gRPC server
or a particular gRPC service specified with the optional
grpc_service parameter (1.19.5).
If the server does not support the gRPC Health Checking Protocol,
the optional grpc_status parameter can be used
to specify non-zero gRPC
status
(for example,
status code “12” / “UNIMPLEMENTED”)
that will be treated as healthy:

health_check mandatory type=grpc grpc_status=12;

The type=grpc parameter
must be specified after all other directive parameters,
grpc_service and grpc_status
must follow type=grpc.
The parameter is not compatible with
uri or
match parameters.

keepalive_time=time

enables keepalive
connections for health checks and specifies the time during which
requests can be processed through one keepalive connection (1.21.7).
By default keepalive connections are disabled.

            Syntax:

            match name { ... }

            Default:

            —

            Context:

            http

Defines the named test set used to verify responses to health check requests.

The following items can be tested in a response:

status 200;

status is 200

status ! 500;

status is not 500

status 200 204;

status is 200 or 204

status ! 301 302;

status is neither 301 nor 302

status 200-399;

status is in the range from 200 to 399

status ! 400-599;

status is not in the range from 400 to 599

status 301-303 307;

status is either 301, 302, 303, or 307

header Content-Type = text/html;

header contains “Content-Type”
with value text/html

header Content-Type != text/html;

header contains “Content-Type”
with value other than text/html

header Connection ~ close;

header contains “Connection”
with value matching regular expression close

header Connection !~ close;

header contains “Connection”
with value not matching regular expression close

header Host;

header contains “Host”

header ! X-Accel-Redirect;

header lacks “X-Accel-Redirect”

body ~ "Welcome to nginx!";

body matches regular expression “Welcome to nginx!”

body !~ "Welcome to nginx!";

body does not match regular expression “Welcome to nginx!”

require
                             $variable
                             ...;

all specified variables are not empty and not equal to “0” (1.15.9).

If several tests are specified,
the response matches only if it matches all tests.

Only the first 256k of the response body are examined.

Examples:

# status is 200, content type is "text/html",
# and body contains "Welcome to nginx!"
match welcome {
    status 200;
    header Content-Type = text/html;
    body ~ "Welcome to nginx!";
}

# status is not one of 301, 302, 303, or 307, and header does not have "Refresh:"
match not_redirect {
    status ! 301-303 307;
    header ! Refresh;
}

# status ok and not in maintenance mode
match server_ok {
    status 200-399;
    body !~ "maintenance mode";
}

# status is 200 or 204
map $upstream_status $good_status {
    200 1;
    204 1;
}

match server_ok {
    require $good_status;
}


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Module ngx_http_upstream_module</title><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="../../../css/style_en.css">

Planning your ingress-nginx migration? Start here:
kubernetes.nginx.org.

<input class="side-menu" type="checkbox" id="side-menu">

english

русский

news

about

download

security

documentation

faq

books

community

enterprise

community forum (new)

x.com

blog

njs

ingress controller

gateway fabric

Module ngx_http_upstream_module

Example Configuration
Directives
     upstream
     server
     zone
     state
     hash
     ip_hash
     keepalive
     keepalive_requests
     keepalive_time
     keepalive_timeout
     ntlm
     least_conn
     least_time
     queue
     random
     resolver
     resolver_timeout
     sticky
Embedded Variables

The ngx_http_upstream_module module
is used to define groups of servers that can be referenced
by the proxy_pass,
fastcgi_pass,
uwsgi_pass,
scgi_pass,
memcached_pass, and
grpc_pass directives.

Example Configuration

upstream backend {
    server backend1.example.com       weight=5;
    server backend2.example.com:8080;
    server unix:/tmp/backend3;

    server backup1.example.com:8080   backup;
    server backup2.example.com:8080   backup;
}

server {
    location / {
        proxy_pass http://backend;
    }
}

Dynamically configurable group with
periodic health checks is
available as part of our
commercial subscription:

resolver 10.0.0.1;

upstream dynamic {
    zone upstream_dynamic 64k;

    server backend1.example.com      weight=5;
    server backend2.example.com:8080 fail_timeout=5s slow_start=30s;
    server 192.0.2.1                 max_fails=3;
    server backend3.example.com      resolve;
    server backend4.example.com      service=http resolve;

    server backup1.example.com:8080  backup;
    server backup2.example.com:8080  backup;
}

server {
    location / {
        proxy_pass http://dynamic;
        health_check;
    }
}

Directives

            Syntax:

            upstream name { ... }

            Default:

            —

            Context:

            http

Defines a group of servers.
Servers can listen on different ports.
In addition, servers listening on TCP and UNIX-domain sockets
can be mixed.

Example:

upstream backend {
    server backend1.example.com weight=5;
    server 127.0.0.1:8080       max_fails=3 fail_timeout=30s;
    server unix:/tmp/backend3;

    server backup1.example.com  backup;
}

By default, requests are distributed between the servers using a
weighted round-robin balancing method.
In the above example, each 7 requests will be distributed as follows:
5 requests go to backend1.example.com
and one request to each of the second and third servers.
If an error occurs during communication with a server, the request will
be passed to the next server, and so on until all of the functioning
servers will be tried.
If a successful response could not be obtained from any of the servers,
the client will receive the result of the communication with the last server.

            Syntax:

            server address [parameters];

            Default:

            —

            Context:

            upstream

Defines the address and other parameters
of a server.
The address can be specified as a domain name or IP address,
with an optional port, or as a UNIX-domain socket path
specified after the “unix:” prefix.
If a port is not specified, the port 80 is used.
A domain name that resolves to several IP addresses defines
multiple servers at once.

The following parameters can be defined:

weight=number

sets the weight of the server, by default, 1.

max_conns=number

limits the maximum number of simultaneous active
connections to the proxied server (1.11.5).
Default value is zero, meaning there is no limit.
If the server group does not reside in the shared memory,
the limitation works per each worker process.

If idle keepalive connections,
multiple workers,
and the shared memory are enabled,
the total number of active and idle connections to the proxied server
may exceed the max_conns value.

Since version 1.5.9 and prior to version 1.11.5,
this parameter was available as part of our
commercial subscription.

max_fails=number

sets the number of unsuccessful attempts to communicate with the server
that should happen in the duration set by the fail_timeout
parameter to consider the server unavailable for a duration also set by the
fail_timeout parameter.
By default, the number of unsuccessful attempts is set to 1.
The zero value disables the accounting of attempts.
What is considered an unsuccessful attempt is defined by the
proxy_next_upstream,
fastcgi_next_upstream,
uwsgi_next_upstream,
scgi_next_upstream,
memcached_next_upstream, and
grpc_next_upstream
directives.

fail_timeout=time

sets

the time during which the specified number of unsuccessful attempts to
communicate with the server should happen to consider the server unavailable;

and the period of time the server will be considered unavailable.

By default, the parameter is set to 10 seconds.

backup

marks the server as a backup server.
It will be passed requests when the primary servers are unavailable.

The parameter cannot be used along with the
hash, ip_hash, and random
load balancing methods.

down

marks the server as permanently unavailable.

resolve

monitors changes of the IP addresses
that correspond to a domain name of the server,
and automatically modifies the upstream configuration
without the need of restarting nginx (1.5.12).
The server group must reside in the shared memory.

In order for this parameter to work,
the resolver directive
must be specified in the
http block
or in the corresponding upstream block.

Prior to version 1.27.3, this parameter was available only as part of our
commercial subscription.

service=name

enables resolving of DNS
SRV
records and sets the service name (1.9.13).
In order for this parameter to work, it is necessary to specify
the resolve parameter for the server
and specify a hostname without a port number.

If the service name does not contain a dot (“.”), then
the RFC-compliant name
is constructed
and the TCP protocol is added to the service prefix.
For example, to look up the
_http._tcp.backend.example.com SRV record,
it is necessary to specify the directive:

server backend.example.com service=http resolve;

If the service name contains one or more dots, then the name is constructed
by joining the service prefix and the server name.
For example, to look up the _http._tcp.backend.example.com
and server1.backend.example.com SRV records,
it is necessary to specify the directives:

server backend.example.com service=_http._tcp resolve;
server example.com service=server1.backend resolve;

Highest-priority SRV records
(records with the same lowest-number priority value)
are resolved as primary servers,
the rest of SRV records are resolved as backup servers.
If the backup parameter is specified for the server,
high-priority SRV records are resolved as backup servers,
the rest of SRV records are ignored.

Prior to version 1.27.3, this parameter was available only as part of our
commercial subscription.

route=string

sets the server route name.

Prior to version 1.29.6,
this parameter was available only as part of our
commercial subscription.

drain

puts the server into the “draining” mode (1.13.6).
In this mode, only requests bound to the server
will be proxied to it.

Prior to version 1.13.6,
the parameter could be changed only with the
API module.

Prior to version 1.29.6,
the parameter was available only as part of our
commercial subscription.

Additionally,
the following parameters are available as part of our
commercial subscription:

slow_start=time

sets the time during which the server will recover its weight
from zero to a nominal value, when unhealthy server becomes
healthy,
or when the server becomes available after a period of time
it was considered unavailable.
Default value is zero, i.e. slow start is disabled.

The parameter cannot be used along with the
hash, ip_hash, and random
load balancing methods.

If there is only a single server in a group, max_fails,
fail_timeout and slow_start parameters
are ignored, and such a server will never be considered unavailable.

            Syntax:

            zone name [size];

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.9.0.

Defines the name and size of the shared
memory zone that keeps the group’s configuration and run-time state that are
shared between worker processes.
Several groups may share the same zone.
In this case, it is enough to specify the size only once.

Additionally,
as part of our commercial subscription,
such groups allow changing the group membership
or modifying the settings of a particular server
without the need of restarting nginx.
The configuration is accessible via the
API module (1.13.3).

Prior to version 1.13.3,
the configuration was accessible only via a special location
handled by
upstream_conf.

            Syntax:

            state file;

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.9.7.

Specifies a file that keeps the state
of the dynamically configurable group.

Examples:

state /var/lib/nginx/state/servers.conf; # path for Linux
state /var/db/nginx/state/servers.conf;  # path for FreeBSD

The state is currently limited to the list of servers with their parameters.
The file is read when parsing the configuration and is updated each time
the upstream configuration is
changed.
Changing the file content directly should be avoided.
The directive cannot be used
along with the server directive.

Changes made during
configuration reload
or binary upgrade
can be lost.

This directive is available as part of our
commercial subscription.

            Syntax:

            hash key [consistent];

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.7.2.

Specifies a load balancing method for a server group
where the client-server mapping is based on the hashed key value.
The key can contain text, variables, and their combinations.
Note that adding or removing a server from the group
may result in remapping most of the keys to different servers.
The method is compatible with the
Cache::Memcached
Perl library.

If the consistent parameter is specified,
the ketama
consistent hashing method will be used instead.
The method ensures that only a few keys
will be remapped to different servers
when a server is added to or removed from the group.
This helps to achieve a higher cache hit ratio for caching servers.
The method is compatible with the
Cache::Memcached::Fast
Perl library with the ketama_points parameter set to 160.

            Syntax:

            ip_hash;

            Default:

            —

            Context:

            upstream

Specifies that a group should use a load balancing method where requests
are distributed between servers based on client IP addresses.
The first three octets of the client IPv4 address, or the entire IPv6 address,
are used as a hashing key.
The method ensures that requests from the same client will always be
passed to the same server except when this server is unavailable.
In the latter case client requests will be passed to another server.
Most probably, it will always be the same server as well.

IPv6 addresses are supported starting from versions 1.3.2 and 1.2.2.

If one of the servers needs to be temporarily removed, it should
be marked with the down parameter in
order to preserve the current hashing of client IP addresses.

Example:

upstream backend {
    ip_hash;

    server backend1.example.com;
    server backend2.example.com;
    server backend3.example.com down;
    server backend4.example.com;
}

Until versions 1.3.1 and 1.2.2, it was not possible to specify a weight for
servers using the ip_hash load balancing method.

            Syntax:

            keepalive connections [local];

            Default:

keepalive 32 local;

            Context:

            upstream

This directive appeared in version 1.1.4.

Enables or disables caching of keepalive connections to upstream servers.
Since 1.29.7, by default the cache for connections is activated
and these connections are not
shared between different
locations.

The local parameter (1.29.7) disables sharing of
cached keepalive connections across different locations
even if the upstream server address matches.
If the local parameter is not specified,
any matching cached connection to the same upstream server
can be reused regardless of a location.

The connections parameter sets the maximum number of
idle keepalive connections to upstream servers that are preserved in
the cache of each worker process.
When this number is exceeded, the least recently used connections
are closed.
The zero value disables keepalive connections to upstream servers.

Since 1.29.7, keepalive connections are enabled by default, with a
default limit of 32 connections per each worker process.

It should be particularly noted that the keepalive directive
does not limit the total number of connections to upstream servers
that an nginx worker process can open.
The connections parameter should be set to a number small enough
to let upstream servers process new incoming connections as well.

Before 1.29.7, when using load balancing methods other than the default
round-robin method, it was necessary to activate them before
the keepalive directive.

Example configuration of memcached upstream with keepalive connections:

upstream memcached_backend {
    server 127.0.0.1:11211;
    server 10.0.0.2:11211;

    keepalive 32;
}

server {
    ...

    location /memcached/ {
        set $memcached_key $uri;
        memcached_pass memcached_backend;
    }

}

For HTTP, the proxy_http_version
directive should be “1.1” (by default since 1.29.7)
or set to “2”
and the “Connection” header field should be cleared.
This example is for versions prior to 1.29.7:

upstream http_backend {
    server 127.0.0.1:8080;

    keepalive 16;
}

server {
    ...

    location /http/ {
        proxy_pass http://http_backend;
        # proxy_http_version 1.1; # before version 1.29.7
        # proxy_set_header Connection ""; # before version 1.29.7
        ...
    }
}

Alternatively, HTTP/1.0 persistent connections can be used by passing the
“Connection: Keep-Alive” header field to an upstream server,
though this method is not recommended.

For FastCGI servers, it is required to set
fastcgi_keep_conn
for keepalive connections to work:

upstream fastcgi_backend {
    server 127.0.0.1:9000;

    keepalive 8;
}

server {
    ...

    location /fastcgi/ {
        fastcgi_pass fastcgi_backend;
        fastcgi_keep_conn on;
        ...
    }
}

SCGI and uwsgi protocols do not have a notion of keepalive connections.

            Syntax:

            keepalive_requests number;

            Default:

keepalive_requests 1000;

            Context:

            upstream

This directive appeared in version 1.15.3.

Sets the maximum number of requests that can be
served through one keepalive connection.
After the maximum number of requests is made, the connection is closed.

Closing connections periodically is necessary to free
per-connection memory allocations.
Therefore, using too high maximum number of requests
could result in excessive memory usage and not recommended.

Prior to version 1.19.10, the default value was 100.

            Syntax:

            keepalive_time time;

            Default:

keepalive_time 1h;

            Context:

            upstream

This directive appeared in version 1.19.10.

Limits the maximum time during which
requests can be processed through one keepalive connection.
After this time is reached, the connection is closed
following the subsequent request processing.

            Syntax:

            keepalive_timeout timeout;

            Default:

keepalive_timeout 60s;

            Context:

            upstream

This directive appeared in version 1.15.3.

Sets a timeout during which an idle keepalive
connection to an upstream server will stay open.

            Syntax:

            ntlm;

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.9.2.

Allows proxying requests with
NTLM
Authentication.
The upstream connection is bound to the client connection
once the client sends a request with the “Authorization”
header field value
starting with “Negotiate” or “NTLM”.
Further client requests will be proxied through the same upstream connection,
keeping the authentication context.

In order for NTLM authentication to work,
it is necessary to enable keepalive connections to upstream servers.
The proxy_http_version
directive should be “1.1” (by default since 1.29.7)
or set to “2”
and the “Connection” header field should be cleared.
This example is for versions prior to 1.29.7:

upstream http_backend {
    server 127.0.0.1:8080;

    ntlm;
}

server {
    ...

    location /http/ {
        proxy_pass http://http_backend;
        # proxy_http_version 1.1; # before version 1.29.7
        # proxy_set_header Connection ""; # before version 1.29.7
        ...
    }
}

When using load balancer methods other than the default
round-robin method, it is necessary to activate them before
the ntlm directive.

This directive is available as part of our
commercial subscription.

            Syntax:

            least_conn;

            Default:

            —

            Context:

            upstream

                    This directive appeared in versions 1.3.1 and 1.2.2.

Specifies that a group should use a load balancing method where a request
is passed to the server with the least number of active connections,
taking into account weights of servers.
If there are several such servers, they are tried in turn using a
weighted round-robin balancing method.

            Syntax:

            least_time
    header |
    last_byte
    [inflight];

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.7.10.

Specifies that a group should use a load balancing method where a request
is passed to the server with the least average response time and
least number of active connections, taking into account weights of servers.
If there are several such servers, they are tried in turn using a
weighted round-robin balancing method.

If the header parameter is specified,
time to receive the
response header is used.
If the last_byte parameter is specified,
time to receive the full response
is used.
If the inflight parameter is specified (1.11.6),
incomplete requests are also taken into account.

Prior to version 1.11.6, incomplete requests were taken into account by default.

Prior to version 1.31.0,
this directive was available only as part of our
commercial subscription.

            Syntax:

            queue
number
[timeout=time];

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.5.12.

If an upstream server cannot be selected immediately
while processing a request,
the request will be placed into the queue.
The directive specifies the maximum number of requests
that can be in the queue at the same time.
If the queue is filled up,
or the server to pass the request to cannot be selected within
the time period specified in the timeout parameter,
the 502 (Bad Gateway)
error will be returned to the client.

The default value of the timeout parameter is 60 seconds.

When using load balancer methods other than the default
round-robin method, it is necessary to activate them before
the queue directive.

This directive is available as part of our
commercial subscription.

            Syntax:

            random [two [method]];

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.15.1.

Specifies that a group should use a load balancing method where a request
is passed to a randomly selected server, taking into account weights
of servers.

The optional two parameter
instructs nginx to randomly select
two
servers and then choose a server
using the specified method.
The default method is least_conn
which passes a request to a server
with the least number of active connections.

The least_time method passes a request to a server
with the least average response time and least number of active connections.
If least_time=header is specified, the time to receive the
response header is used.
If least_time=last_byte is specified, the time to receive the
full response is used.

The least_time method is available as a part of our
commercial subscription.

            Syntax:

            resolver
    address ...
    [valid=time]
    [ipv4=on|off]
    [ipv6=on|off]
    [status_zone=zone];

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.27.3.

Configures name servers used to resolve names of upstream servers
into addresses, for example:

resolver 127.0.0.1 [::1]:5353;

The address can be specified as a domain name or IP address,
with an optional port.
If port is not specified, the port 53 is used.
Name servers are queried in a round-robin fashion.

By default, nginx will look up both IPv4 and IPv6 addresses while resolving.
If looking up of IPv4 or IPv6 addresses is not desired,
the ipv4=off (1.23.1) or
the ipv6=off parameter can be specified.

By default, nginx caches answers using the TTL value of a response.
An optional valid parameter allows overriding it:

resolver 127.0.0.1 [::1]:5353 valid=30s;

To prevent DNS spoofing, it is recommended
configuring DNS servers in a properly secured trusted local network.

The optional status_zone parameter (1.17.5)
enables
collection
of DNS server statistics of requests and responses
in the specified zone.
The parameter is available as part of our
commercial subscription.

Since version 1.17.5 and prior to version 1.27.3,
this directive was available only as part of our
commercial subscription.

            Syntax:

            resolver_timeout time;

            Default:

resolver_timeout 30s;

            Context:

            upstream

This directive appeared in version 1.27.3.

Sets a timeout for name resolution, for example:

resolver_timeout 5s;

Since version 1.17.5 and prior to version 1.27.3,
this directive was available only as part of our
commercial subscription.

            Syntax:

            sticky
    cookie name
    [expires=time]
    [domain=domain]
    [httponly]
    [samesite=strict|lax|none|$variable]
    [secure]
    [path=path];
sticky
    route $variable ...;
sticky
    learn
    create=$variable
    lookup=$variable
    zone=name:size
    [timeout=time]
    [header]
    [sync];

            Default:

            —

            Context:

            upstream

This directive appeared in version 1.5.7.

Enables session affinity, which causes requests from the same client to be
passed to the same server in a group of servers.
Three methods are available:

cookie

When the cookie method is used, information about the
designated server is passed in an HTTP cookie generated by nginx:

upstream backend {
    server backend1.example.com;
    server backend2.example.com;

    sticky cookie srv_id expires=1h domain=.example.com path=/;
}

A request that comes from a client not yet bound to a particular server
is passed to the server selected by the configured balancing method.
Further requests with this cookie will be passed to the designated server.
If the designated server cannot process a request, the new server is
selected as if the client has not been bound yet.

As a load balancing method always tries to evenly distribute the load
considering already bound requests,
the server with a higher number of active bound requests
has less possibility of getting new unbound requests.

The first parameter sets the name of the cookie to be set or inspected.
The cookie value is
a hexadecimal representation of the MD5 hash of the IP address and port,
or of the UNIX-domain socket path.
However, if the “route” parameter of the
server directive is specified, the cookie value will be
the value of the “route” parameter:

upstream backend {
    server backend1.example.com route=a;
    server backend2.example.com route=b;

    sticky cookie srv_id expires=1h domain=.example.com path=/;
}

In this case, the value of the “srv_id” cookie will be
either a or b.

Additional parameters may be as follows:

expires=time

Sets the time for which a browser should keep the cookie.
The special value max will cause the cookie to expire on
“31 Dec 2037 23:55:55 GMT”.
If the parameter is not specified, it will cause the cookie to expire at
the end of a browser session.

domain=domain

Defines the domain for which the cookie is set.
Parameter value can contain variables (1.11.5).

httponly

Adds the HttpOnly attribute to the cookie (1.7.11).

samesite=strict |
lax | none | $variable

Adds the SameSite (1.19.4) attribute to the cookie
with one of the following values:
Strict,
Lax,
None, or
using variables (1.23.3).
In the latter case, if the variable value is empty,
the SameSite attribute will not be added to the cookie,
if the value is resolved to
Strict,
Lax, or
None,
the corresponding value will be assigned,
otherwise the Strict value will be assigned.

secure

Adds the Secure attribute to the cookie (1.7.11).

path=path

Defines the path for which the cookie is set.

If any parameters are omitted, the corresponding cookie fields are not set.

route

When the route method is used, proxied server assigns
client a route on receipt of the first request.
All subsequent requests from this client will carry routing information
in a cookie or URI.
This information is compared with the “route” parameter
of the server directive to identify the server to which the
request should be proxied.
If the “route” parameter is not specified, the route name
will be a hexadecimal representation of the MD5 hash of the IP address and port,
or of the UNIX-domain socket path.
If the designated server cannot process a request, the new server is
selected by the configured balancing method as if there is no routing
information in the request.

The parameters of the route method specify variables that
may contain routing information.
The first non-empty variable is used to find the matching server.

Example:

map $cookie_jsessionid $route_cookie {
    ~.+\.(?P<route>\w+)$ $route;
}

map $request_uri $route_uri {
    ~jsessionid=.+\.(?P<route>\w+)$ $route;
}

upstream backend {
    server backend1.example.com route=a;
    server backend2.example.com route=b;

    sticky route $route_cookie $route_uri;
}

Here, the route is taken from the “JSESSIONID” cookie
if present in a request.
Otherwise, the route from the URI is used.

learn

When the learn method (1.7.1) is used, nginx
analyzes upstream server responses and learns server-initiated sessions
usually passed in an HTTP cookie.

upstream backend {
   server backend1.example.com:8080;
   server backend2.example.com:8081;

   sticky learn
          create=$upstream_cookie_examplecookie
          lookup=$cookie_examplecookie
          zone=client_sessions:1m;
}

In the example, the upstream server creates a session by setting the
cookie “EXAMPLECOOKIE” in the response.
Further requests with this cookie will be passed to the same server.
If the server cannot process the request, the new server is
selected as if the client has not been bound yet.

The parameters create and lookup
specify variables that indicate how new sessions are created and existing
sessions are searched, respectively.
Both parameters may be specified more than once, in which case the first
non-empty variable is used.

Sessions are stored in a shared memory zone, whose name and
size are configured by the zone parameter.
One megabyte zone can store about 4000 sessions on the 64-bit platform.
The sessions that are not accessed during the time specified by the
timeout parameter get removed from the zone.
By default, timeout is set to 10 minutes.

The header parameter (1.13.1) allows creating a session
right after receiving response headers from the upstream server.

The sync parameter (1.13.8) enables
synchronization
of the shared memory zone.
The parameter is available as part of our
commercial subscription.

Prior to version 1.29.6,
this directive was available only as part of our
commercial subscription.

Embedded Variables

The ngx_http_upstream_module module
supports the following embedded variables:

$upstream_addr

keeps the IP address and port,
or the path to the UNIX-domain socket of the upstream server.
If several servers were contacted during request processing,
their addresses are separated by commas, e.g.
“192.168.1.1:80, 192.168.1.2:80, unix:/tmp/sock”.
If an internal redirect from one server group to another happens,
initiated by
“X-Accel-Redirect” or
error_page,
then the server addresses from different groups are separated by colons, e.g.
“192.168.1.1:80, 192.168.1.2:80, unix:/tmp/sock : 192.168.10.1:80, 192.168.10.2:80”.
If a server cannot be selected,
the variable keeps the name of the server group.

$upstream_bytes_received

number of bytes received from an upstream server (1.11.4).
Values from several connections
are separated by commas and colons like addresses in the
$upstream_addr variable.

$upstream_bytes_sent

number of bytes sent to an upstream server (1.15.8).
Values from several connections
are separated by commas and colons like addresses in the
$upstream_addr variable.

$upstream_cache_status

keeps the status of accessing a response cache (0.8.3).
The status can be either “MISS”,
“BYPASS”, “EXPIRED”,
“STALE”, “UPDATING”,
“REVALIDATED”, or “HIT”.

$upstream_connect_time

keeps time spent on establishing a connection with the upstream server (1.9.1);
the time is kept in seconds with millisecond resolution.
In case of SSL, includes time spent on handshake.
Times of several connections
are separated by commas and colons like addresses in the
$upstream_addr variable.

$upstream_cookie_name

cookie with the specified name sent by the upstream server
in the “Set-Cookie” response header field (1.7.1).
Only the cookies from the response of the last server are saved.

$upstream_header_time

keeps time
spent on receiving the response header from the upstream server (1.7.10);
the time is kept in seconds with millisecond resolution.
Times of several responses
are separated by commas and colons like addresses in the
$upstream_addr variable.

$upstream_http_name

keep server response header fields.
For example, the “Server” response header field
is available through the $upstream_http_server variable.
The rules of converting header field names to variable names are the same
as for the variables that start with the
“$http_” prefix.
Only the header fields from the response of the last server are saved.

$upstream_last_addr

keeps the IP address or the path to the UNIX-domain socket
of the last selected upstream server (1.29.3).

This variable is available as part of our
commercial subscription.

$upstream_last_server_name

keeps the name of last selected upstream server (1.25.3);
allows passing it
through SNI:

proxy_ssl_server_name on;
proxy_ssl_name        $upstream_last_server_name;

This variable is available as part of our
commercial subscription.

$upstream_queue_time

keeps time the request spent in the upstream queue
(1.13.9);
the time is kept in seconds with millisecond resolution.
Times of several responses
are separated by commas and colons like addresses in the
$upstream_addr variable.

$upstream_response_length

keeps the length of the response obtained from the upstream server (0.7.27);
the length is kept in bytes.
Lengths of several responses
are separated by commas and colons like addresses in the
$upstream_addr variable.

$upstream_response_time

keeps time spent on receiving the response from the upstream server;
the time is kept in seconds with millisecond resolution.
Times of several responses
are separated by commas and colons like addresses in the
$upstream_addr variable.

$upstream_status

keeps status code of the response obtained from the upstream server.
Status codes of several responses
are separated by commas and colons like addresses in the
$upstream_addr variable.
If a server cannot be selected,
the variable keeps the 502 (Bad Gateway) status code.

$upstream_trailer_name

keeps fields from the end of the response
obtained from the upstream server (1.13.10).


<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>Module ngx_http_userid_module</title><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="stylesheet" href="../../../css/style_en.css">

Planning your ingress-nginx migration? Start here:
kubernetes.nginx.org.

<input class="side-menu" type="checkbox" id="side-menu">

english

русский

news

about

download

security

documentation

faq

books

community

enterprise

community forum (new)

x.com

blog

njs

ingress controller

gateway fabric

Module ngx_http_userid_module

Example Configuration
Directives
     userid
     userid_domain
     userid_expires
     userid_flags
     userid_mark
     userid_name
     userid_p3p
     userid_path
     userid_service
Embedded Variables

The ngx_http_userid_module module sets cookies
suitable for client identification.
Received and set cookies can be logged using the embedded variables
$uid_got and
$uid_set.
This module is compatible with the
mod_uid
module for Apache.

Example Configuration

userid         on;
userid_name    uid;
userid_domain  example.com;
userid_path    /;
userid_expires 365d;
userid_p3p     'policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"';

Directives

            Syntax:

            userid
    on |
    v1 |
    log |
    off;

            Default:

userid off;

            Context:

            http, server, location

Enables or disables setting cookies and logging the received cookies:

on

enables the setting of version 2 cookies
and logging of the received cookies;

v1

enables the setting of version 1 cookies
and logging of the received cookies;

log

disables the setting of cookies,
but enables logging of the received cookies;

off

disables the setting of cookies and logging of the received cookies.

            Syntax:

            userid_domain name | none;

            Default:

userid_domain none;

            Context:

            http, server, location

Defines a domain for which the cookie is set.
The none parameter disables setting of a domain for the
cookie.

            Syntax:

            userid_expires time | max |
    off;

            Default:

userid_expires off;

            Context:

            http, server, location

Sets a time during which a browser should keep the cookie.
The parameter max will cause the cookie to expire on
“31 Dec 2037 23:55:55 GMT”.
The parameter off will cause the cookie to expire at
the end of a browser session.

            Syntax:

            userid_flags
    off |
    flag ...;

            Default:

userid_flags off;

            Context:

            http, server, location

This directive appeared in version 1.19.3.

If the parameter is not off,
defines one or more additional flags for the cookie:
secure,
httponly,
samesite=strict,
samesite=lax,
samesite=none.

            Syntax:

            userid_mark
    letter | digit |
    = |
    off;

            Default:

userid_mark off;

            Context:

            http, server, location

If the parameter is not off, enables the cookie marking
mechanism and sets the character used as a mark.
This mechanism is used to add or change
userid_p3p and/or a cookie expiration time while
preserving the client identifier.
A mark can be any letter of the English alphabet (case-sensitive),
digit, or the “=” character.

If the mark is set, it is compared with the first padding symbol
in the base64 representation of the client identifier passed in a cookie.
If they do not match, the cookie is resent with the specified mark,
expiration time, and “P3P” header.

            Syntax:

            userid_name name;

            Default:

userid_name uid;

            Context:

            http, server, location

Sets the cookie name.

            Syntax:

            userid_p3p string | none;

            Default:

userid_p3p none;

            Context:

            http, server, location

Sets a value for the “P3P” header field that will be
sent along with the cookie.
If the directive is set to the special value none,
the “P3P” header will not be sent in a response.

            Syntax:

            userid_path path;

            Default:

userid_path /;

            Context:

            http, server, location

Defines a path for which the cookie is set.

            Syntax:

            userid_service number;

            Default:

userid_service IP address of the server;

            Context:

            http, server, location

If identifiers are issued by multiple servers (services),
each service should be assigned its own number
to ensure that client identifiers are unique.
For version 1 cookies, the default value is zero.
For version 2 cookies, the default value is the number composed from the last
four octets of the server’s IP address.

Embedded Variables

The ngx_http_userid_module module
supports the following embedded variables:

$uid_got

The cookie name and received client identifier.

$uid_reset

If the variable is set to a non-empty string that is not “0”,
the client identifiers are reset.
The special value “log” additionally leads to the output of
messages about the reset identifiers to the
error_log.

$uid_set

The cookie name and sent client identifier.