Configuring NGINX Plus with PingAccess agent for PingIntelligence - PingIntelligence for APIs - 5.1

# tar -xvzf pi-api-nginx-plus-policy-5.0.tar

# sudo su

• Edit the nginx.conf file to load the PingIntelligence modules. Following is a snippet of nginx.conf file showing the loaded PingIntelligence module.

  user  nginx;
  worker_processes  auto;
  error_log  /var/log/nginx/error.log debug;
  pid        /var/run/nginx.pid;
  
  load_module modules/ngx_ase_integration_module.so;
  load_module modules/ngx_http_ase_integration_request_module.so;
  load_module modules/ngx_http_ase_integration_response_module.so;
  load_module modules/ngx_http_paa_module.so;
  
  
  events {
      worker_connections  1024;
  }
  

  Note: Make sure the modules are loaded in the order highlighted above.
• Configure ASE primary and secondary node IP address by replacing IP:PORT in the nginx.conf file as shown in the following snippet.

  http {
      
      upstream test.ase.pi {
         server IP:PORT  max_fails=1 max_conns=100 fail_timeout=10;
         server IP:PORT  max_fails=1 max_conns=100 fail_timeout=10 backup;
         keepalive 32;
  #      keepalive_timeout 3600s; # NOT allowed < 1.15.3
     }

• Configure the following ASE parameters in ngnix.conf file:

  Parameter	Description
  certificate	Certificate location of ASE
  ase_token	ASE Token for sideband authentication
  ase_host	Host header that should be send to ASE
  ase_ssl_host	SNI value to use for ASE

  #DO NOT EDIT BELOW VARIABLE
      set $correlationid $pid-$request_id-$server_addr-$remote_addr-$remote_port-$request_length-$connection;
      #Certificate location of ASE
      set $certificate /etc/ssl/nginx/test.ase.pi;
      #ASE Token for sideband authentication
      set $ase_token 76748f33353940efab31e9fbe15d930a;
      #Host header which should be send to ASE
      set $ase_host test.ase.pi;
      #SNI value to use for ASE
      set $ase_ssl_host test.ase.pi;

• To apply PingIntelligence policy globally, add ase_integration_request and ase_integration_response in the server section of nginx.conf as shown in the following snippet:

  server {
      listen              44444 ssl bind;
      server_name         localhost;
      ssl_certificate     /etc/nginx/ssl/cert.pem;
      ssl_certificate_key /etc/nginx/ssl/key.pem;
      ssl_protocols       TLSv1.2;
      ssl_ciphers         HIGH:!aNULL:!MD5;
      add_header Allow "GET, POST, HEAD" always;
      ase_integration_request;
  
      ase_integration_response;
  
    
          truncated nginx.conf file

• To apply PingIntelligence sideband policy for a specific API, configure location in nginx.conf as shown in the following snippet:

  location / {
         include /usr/local/nginx/conf/pi-pf.conf;
         ase_integration_request;
         proxy_pass http://localhost:8080/;
         ase_integration_response;
  }
  
  truncated nginx.conf file

  Note: When configuring the policy for individual APIs, comment-out ase_integration_request and ase_integration_response that are added to apply PingIntelligence policy globally.

# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

# /usr/local/nginx/sbin/nginx -s stop
# /usr/local/nginx/sbin/nginx