elementai

user nginx nginx;
worker_processes 1;

error_log /var/log/nginx/error_log info;

events {
        worker_connections  8192;
        use epoll;
}

http {
        include         /etc/nginx/mime.types;
        default_type    application/octet-stream;

        log_format main
                '$remote_addr - $remote_user [$time_local] '
                '"$request" $status $bytes_sent '
                '"$http_referer" "$http_user_agent" '
                '"$gzip_ratio"';

        client_header_timeout   10m;
        client_body_timeout     10m;
        send_timeout            10m;
        keepalive_timeout  65;


        connection_pool_size            256;
        client_header_buffer_size       1k;
        large_client_header_buffers     4 2k;
        request_pool_size               4k;

        gzip on;
        gzip_min_length 1100;
        gzip_buffers    4 8k;
        gzip_types      text/plain;

        output_buffers  1 32k;
        postpone_output 1460;

        sendfile        on;
        tcp_nopush      on;
        tcp_nodelay     on;

         ssl                     on;
         ssl_certificate         /var/lib/puppet/ssl/certs/puppet.corbina.net.pem;
         ssl_certificate_key     /var/lib/puppet/ssl/private_keys/puppet.corbina.net.pem;
         ssl_client_certificate  /var/lib/puppet/ssl/ca/ca_crt.pem;
         ssl_ciphers             SSLv2:-LOW:-EXPORT:RC4+RSA;
         ssl_session_cache       shared:SSL:8m;
         ssl_session_timeout     5m;


        upstream mongrel {
                server 85.21.78.126:3000;
                server 85.21.78.126:3001;
                server 85.21.78.126:3002;
        }

        upstream puppet-production {
                server 127.0.0.1:18140;
        }


        ignore_invalid_headers  on;

        index index.html;

        server {
                listen          80;
                ssl             off;
                server_name     puppet.corbina.net;

                access_log      /var/log/nginx/puppet.access_log main;
                error_log       /var/log/nginx/puppet.error_log info;

                root /var/www/localhost/htdocs;

                location / {
                        proxy_pass  http://mongrel;
                }
        }


         server {
                listen          8140;
                ssl on;
                ssl_verify_client       on;
                root /var/empty;

                access_log      /var/log/nginx/puppetmaster-production.ssl_access_log main;
                error_log       /var/log/nginx/puppetmaster-production.ssl_error_log info;

                location / {
                   proxy_pass          http://puppet-production;

                   proxy_redirect      off;
                   proxy_set_header    Host             $host;
                   proxy_set_header    X-Real-IP        $remote_addr;
                   proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;

                   proxy_set_header    X-Client-Verify  SUCCESS;
                   proxy_set_header    X-SSL-Subject    $ssl_client_s_dn;
                   proxy_set_header    X-SSL-Issuer     $ssl_client_i_dn;

                   proxy_read_timeout  65;
                }

         }

        server {
          listen                  8141;
          ssl on;
          ssl_verify_client       off;
          root                    /var/empty;
          access_log              on;
          rewrite_log             on;

          location / {
              proxy_pass  http://puppet-production;

              proxy_redirect     off;
              proxy_set_header   Host             $host;
              proxy_set_header   X-Real-IP        $remote_addr;
              proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;


              proxy_set_header   X-Client-Verify  FAILURE;
              proxy_set_header   X-SSL-Subject    $ssl_client_s_dn;
              proxy_set_header   X-SSL-Issuer     $ssl_client_i_dn;
              proxy_read_timeout 65;
          }
       }

}