nginx.master.conf

include common/main.conf;


http {
    # Without this, cosocket-based code in worker
    # initialization cannot resolve leader.mesos.
    resolver 127.0.0.1:61053;

    include common/http.conf;

    client_max_body_size 1024M;

    # Name: Apache Mesos
    # Reference: https://mesos.apache.org/documentation/latest/endpoints/
    upstream mesos {
        server leader.mesos:5050;
    }

    # Name: Marathon
    # Reference: https://dcos.io/docs/1.9/usage/managing-services/rest-api/
    upstream marathon {
        server master.mesos:8080;
    }

    # Name: DC/OS History
    # Reference: https://github.com/dcos/dcos/tree/master/packages/dcos-history/extra#api
    upstream dcos_history_service {
        server leader.mesos:15055;
    }

    # Name: Mesos DNS
    # Reference: https://dcos.io/docs/1.9/usage/service-discovery/mesos-dns/http-interface/
    upstream mesos_dns {
        server master.mesos:8123;
    }

    # Name: Exhibitor (Zookeeper)
    # Reference: https://github.com/soabase/exhibitor/wiki/REST-Introduction
    upstream exhibitor {
        server 127.0.0.1:8181;
    }

    # Name: DC/OS Package Manager (Cosmos)
    # Reference: https://dcos.io/docs/1.9/usage/managing-services/package-api/
    upstream cosmos {
        server 127.0.0.1:7070;
    }

    # Name: DC/OS Authentication (OAuth)
    # Reference: https://dcos.io/docs/1.9/administration/id-and-access-mgt/iam-api/
    upstream auth {
        server 127.0.0.1:8101;
    }

    # Name: DC/OS Diagnostics (3DT)
    # Reference: https://dcos.io/docs/1.9/administration/monitoring/#system-health-http-api-endpoint
    upstream dddt {
        server 127.0.0.1:1050;
    }

    # Name: DC/OS Metrics
    # Reference: https://dcos.io/docs/1.9/administration/monitoring/metrics/metrics-api/
    upstream metrics {
        server unix:/run/dcos/dcos-metrics-master.sock;
    }

    # Name: Navstar
    upstream navstar {
        server 127.0.0.1:62080;
    }

    proxy_cache_path /tmp/nginx-mesos-cache levels=1:2 keys_zone=mesos:1m inactive=10m;

    lua_shared_dict cache 100m;
    lua_shared_dict shmlocks 100k;

    #init_worker_by_lua '
    #    local cache = require "master.cache"
    #    cache.periodically_refresh_cache()
    #';

    server {
        include common/server.conf;

        include /opt/mesosphere/etc/adminrouter-listen-open.conf;

        # Group: Root
        # Description: DC/OS GUI
        root /opt/mesosphere/active/dcos-ui/usr;

        # Group: Authentication
        # Description: Redirect to OpenID Connect server for user login
        location = /login {
            set_by_lua $oauth_client_id 'return os.getenv("OAUTH_CLIENT_ID")';
            set_by_lua $oauth_auth_redirector 'return os.getenv("OAUTH_AUTH_REDIRECTOR")';
            set_by_lua $cluster_id 'return util.get_stripped_first_line_from_file("/var/lib/dcos/cluster-id")';
            # existing query string parameters will be appended by nginx
            rewrite ^ $oauth_auth_redirector$uri?client=$oauth_client_id&cluster_id=$cluster_id redirect;
        }

        # Group: Authentication
        # Description: Access Control Service (unauthenticated)
        location /acs/api/v1/auth/ {
            include common/proxy-headers.conf;
            proxy_pass http://auth;
        }

        # Group: Authentication
        # Description: Access Control Service
        location /acs/api/v1 {
            # Enforce access restriction to Auth API.
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;
            proxy_pass http://auth;
            # Instruct user agent to not cache the response.
            # Ref: http://stackoverflow.com/a/2068407/145400
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma no-cache;
            add_header Expires 0;
        }

        # Group: Mesos
        # Description: Redirect to add trailing slash
        # Visibility: hidden
        location = /mesos {
            rewrite ^/mesos$ $scheme://$http_host/mesos/ permanent;
        }

        # Group: Mesos
        # Description: Apache Mesos
        location /mesos/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;
            proxy_pass http://mesos/;
        }

        # Group: Package
        # Description: Package Management
        location /package/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;

            proxy_pass http://cosmos/package/;

            # http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_request_buffering
            proxy_request_buffering off;
            proxy_http_version 1.1;
        }

        # Group: Capabilities
        # Description: List of capabilities supported by DC/OS
        location /capabilities {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;

            proxy_pass http://cosmos/capabilities;
            proxy_http_version 1.1;
        }

        # Group: Cosmos
        # Description: Start a DC/OS service from a DC/OS package
        location /cosmos/service/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;

            proxy_pass http://cosmos/service/;
            proxy_http_version 1.1;
        }

        # Group: Mesos
        # Cache: 5 seconds
        # Description: Cache of the Mesos master API
        location /cache/master/ {
            add_header X-Cache-Status $upstream_cache_status;
            proxy_pass http://mesos/master/;
            proxy_cache mesos;
            proxy_cache_bypass  $http_cache_control;
            proxy_cache_lock on;
            proxy_cache_valid 200 5s;
        }

        # Group: Exhibitor
        # Description: Redirect to add trailing slash
        # Visibility: hidden
        location = /exhibitor {
            rewrite ^/exhibitor$ $scheme://$http_host/exhibitor/ permanent;
        }

        # Group: Exhibitor
        # Description: Manage Zookeeper
        location /exhibitor/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;

            proxy_pass http://exhibitor/;
            proxy_redirect http://$http_host/ $scheme://$http_host/exhibitor/;
        }

        # Group: Navstar
        location /navstar/lashup/key {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;
            proxy_pass http://navstar/lashup/key;
        }

        # Group: Agent
        # Description: Redirect to add trailing slash
        # Visibility: hidden
        location ~ ^/(slave|agent)/(?<agentid>[0-9a-zA-Z-]+)$ {
            # Append slash and perform internal redirect.
            rewrite ^/(slave|agent)/(.*)$ /agent/$2/ last;
        }

        # Group: Agent
        # Description: API proxy to a specific agent node
        location ~ ^/(slave|agent)/(?<agentid>[0-9a-zA-Z-]+)(?<url>.+)$ {
            access_by_lua 'auth.validate_jwt_or_exit()';

            set $agentaddr '';
            set $agentport '';
            rewrite ^/(slave|agent)/[0-9a-zA-Z-]+/.*$ $url break;
            rewrite_by_lua_file conf/master/agent.lua;

            more_clear_input_headers Accept-Encoding;
            include common/proxy-headers.conf;
            # Non-streaming endpoints don't require HTTP/1.1 but will work as
            # expected with it enabled. Streaming endpoints require keepalive
            # functionality added in HTTP/1.1. As such, we enable HTTP/1.1 here
            # while maintaining backwards compatibility.
            include common/http-11.conf;
            # Disable buffering to support streaming endpoints
            include common/disable-request-response-buffering.conf;
            proxy_pass $agentaddr:$agentport;
        }

        # Group: Service
        # Description: Redirect to add trailing slash
        # Visibility: hidden
        location ~ ^/service/(?<serviceid>[0-9a-zA-Z-.]+)$ {
            # Append slash and 301-redirect.
            rewrite ^/service/(.*)$ /service/$1/ permanent;
        }

        # Group: Service
        # Description: Proxy to services running on DC/OS
        location ~ ^/service/(?<serviceid>[0-9a-zA-Z-.]+)/(?<url>.*) {
            set $serviceurl '';
            set $servicescheme '';

            access_by_lua 'auth.validate_jwt_or_exit()';

            more_clear_input_headers Accept-Encoding;
            rewrite ^/service/[0-9a-zA-Z-.]+/?.*$ /$url break;
            rewrite_by_lua_file conf/master/service.lua;

            include common/proxy-headers.conf;

            proxy_pass $serviceurl;
            proxy_redirect $servicescheme://$host/service/$serviceid/ /service/$serviceid/;
            proxy_redirect $servicescheme://$host/ /service/$serviceid/;
            proxy_redirect / /service/$serviceid/;

            # Disable buffering to allow real-time protocols
            proxy_buffering off;

            # Support web sockets and SPDY upgrades
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # Group: Metadata
        # Description: Public IP and Cluster ID
        # Backend: Admin Router
        location /metadata {
            access_by_lua 'auth.validate_jwt_or_exit()';
            content_by_lua_file conf/master/metadata.lua;
        }

        # TODO: split this into its own file
        # Group: Metadata
        # Description: DC/OS GUI configuration
        location /dcos-metadata/ui-config.json {
            include common/proxy-headers.conf;
            proxy_pass http://auth;
        }

        # Group: Metadata
        # Description: DC/OS version (unauthenticated)
        location /dcos-metadata/dcos-version.json {
            # Allow non-authed access for the UI.
            alias /opt/mesosphere/active/dcos-metadata/etc/dcos-version.json;
        }

        # Group: Metadata
        # Description: DC/OS metadata
        location /dcos-metadata/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            alias /opt/mesosphere/active/dcos-metadata/etc/;
        }

        # Group: Marathon
        # Description: Redirect to add trailing slash
        # Deprecated: Use `/service/marathon/`
        # Visibility: hidden
        location = /marathon {
            rewrite ^/marathon$ $scheme://$http_host/marathon/ permanent;
        }

        # Group: Marathon
        # Deprecated: Use `/service/marathon/`
        location /marathon/ {
            # Enforce access restriction. Auth-wise, treat /marathon*
            # equivalently to /service/marathon*.
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;
            proxy_pass http://marathon/;
        }

        # Group: Pkgpanda
        # Description: List the active Pkgpanda packages
        location /pkgpanda/active.buildinfo.full.json {
            access_by_lua 'auth.validate_jwt_or_exit()';
            add_header Cache-Control "no-cache";
            alias /opt/mesosphere/active.buildinfo.full.json;
        }

        # Group: History
        location /dcos-history-service/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            proxy_pass http://dcos_history_service/;
        }

        # Group: Mesos DNS
        # Description: Redirect to add trailing slash
        # Visibility: hidden
        location = /mesos_dns {
            rewrite ^/mesos_dns$ $scheme://$http_host/mesos_dns/ permanent;
        }

        # Group: Mesos DNS
        location /mesos_dns/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;
            proxy_pass http://mesos_dns/;

        }

        # Group: Pkgpanda
        # Description: DC/OS component package management
        location /pkgpanda/ {
            access_by_lua 'auth.validate_jwt_or_exit()';
            include common/proxy-headers.conf;

            proxy_pass http://pkgpanda/;
            proxy_redirect http://$http_host/ /pkgpanda/;
        }

        # Group: System
        # Description: Component service status
        location /system/health/v1 {
            access_by_lua 'auth.validate_jwt_or_exit()';

            include common/proxy-headers.conf;
            proxy_pass http://dddt;
        }

        # Group: System
        # Description: Node, component service, and container (task) logs
        location /system/v1/logs/v1/ {
            access_by_lua 'auth.validate_jwt_or_exit()';

            include common/http-11.conf;
            include common/proxy-headers.conf;
            proxy_pass http://log/;
        }

        # Group: System
        # Description: Node, container, and application metrics
        location /system/v1/metrics/ {
            access_by_lua 'auth.validate_jwt_or_exit()';

            include common/proxy-headers.conf;
            proxy_pass http://metrics/;
        }

        # Group: System
        # Description: System proxy to the master node with the Mesos leader
        location ~ ^/system/v1/leader/mesos(?<url>.*)$ {
            access_by_lua 'auth.validate_jwt_or_exit()';

            include common/http-11.conf;
            include common/proxy-headers.conf;
            proxy_pass http://leader.mesos/system/v1$url$is_args$query_string;
        }

        # Group: System
        # Description: System proxy to the master node with the Marathon leader
        location ~ ^/system/v1/leader/marathon(?<url>.*)$ {
            access_by_lua 'auth.validate_jwt_or_exit()';

            set $mleader_host '';
            rewrite_by_lua_file conf/master/marathon-leader.lua;

            include common/http-11.conf;
            include common/proxy-headers.conf;
            proxy_pass $mleader_host/system/v1$url$is_args$query_string;
        }

        # Group: System
        # Description: System proxy to a specific agent node
        location ~ ^/system/v1/agent/(?<agentid>[0-9a-zA-Z-]+)(?<type>(/logs/v1|/metrics/v0))(?<url>.*)$ {
            access_by_lua 'auth.validate_jwt_or_exit()';

            set $agentaddr '';
            rewrite_by_lua_file conf/master/agent.lua;
            rewrite ^/agent/[0-9a-zA-Z-]+(.*)$ $1 break;

            more_clear_input_headers Accept-Encoding;
            include common/http-11.conf;
            include common/proxy-headers.conf;
            proxy_pass $agentaddr:61001/system/v1$type$url$is_args$query_string;
        }
    }
}