Merge 45b68c2160 into a56dd7cc38

controllers/ext_nginx/.dockerignore

@@ -0,0 +1,2 @@
+core
+

controllers/ext_nginx/.gitignore

@@ -0,0 +1,2 @@
+rootfs/nginx-ingress-controller
+*/**/.coverprofile

controllers/ext_nginx/Changelog.md

@@ -0,0 +1,4 @@
+Changelog
+
+### 0.1 
+First version of ext_nginx backend. Working as a standalone service to manage nginx configuration file.

controllers/ext_nginx/Makefile

@@ -0,0 +1,53 @@
+# Use the 0.0 tag for testing, it shouldn't clobber any release builds
+TAG?=0.1
+GOOS?=linux
+#SED_I?=sed -i
+#GOHOSTOS ?= $(shell go env GOHOSTOS)
+
+REPO_INFO=$(shell git config --get remote.origin.url)
+
+ifndef COMMIT
+  COMMIT := git-$(shell git rev-parse --short HEAD)
+endif
+
+PKG=k8s.io/ingress/controllers/ext_nginx
+
+ARCH ?= $(shell go env GOARCH)
+GOARCH = ${ARCH}
+DUMB_ARCH = ${ARCH}
+
+ALL_ARCH = amd64 arm ppc64le
+
+TEMP_DIR := $(shell mktemp -d)
+
+
+clean:
+	rm -f rootfs/nginx-ingress-controller
+#	$(DOCKER) rmi -f $(MULTI_ARCH_IMG):$(TAG) || true
+
+build: clean
+	CGO_ENABLED=0 GOOS=${GOOS} GOARCH=${GOARCH} go build -a -installsuffix cgo \
+		-ldflags "-s -w -X ${PKG}/pkg/version.RELEASE=${TAG} -X ${PKG}/pkg/version.COMMIT=${COMMIT} -X ${PKG}/pkg/version.REPO=${REPO_INFO}" \
+		-o rootfs/nginx-ingress-controller ${PKG}/pkg/cmd/controller
+
+fmt:
+	@echo "+ $@"
+	@go list -f '{{if len .TestGoFiles}}"gofmt -s -l {{.Dir}}"{{end}}' $(shell go list ${PKG}/... | grep -v vendor) | xargs -L 1 sh -c
+
+lint:
+	@echo "+ $@"
+	@go list -f '{{if len .TestGoFiles}}"golint {{.Dir}}/..."{{end}}' $(shell go list ${PKG}/... | grep -v vendor) | xargs -L 1 sh -c
+
+test: fmt lint vet
+	@echo "+ $@"
+	@go test -v -race -tags "$(BUILDTAGS) cgo" $(shell go list ${PKG}/... | grep -v vendor)
+
+cover:
+	@echo "+ $@"
+	@go list -f '{{if len .TestGoFiles}}"go test -coverprofile={{.Dir}}/.coverprofile {{.ImportPath}}"{{end}}' $(shell go list ${PKG}/... | grep -v vendor) | xargs -L 1 sh -c
+	gover
+	goveralls -coverprofile=gover.coverprofile -service travis-ci -repotoken ${COVERALLS_TOKEN}
+
+vet:
+	@echo "+ $@"
+	@go vet $(shell go list ${PKG}/... | grep -v vendor)

controllers/ext_nginx/README.md

@@ -0,0 +1,23 @@
+# External Nginx Ingress Controller
+
+This is a nginx ingress controller that will run outside Kubernetes but still update nginx configuration files.
+
+It functions very much like https://github.com/kubernetes/ingress/tree/master/controllers/nginx but runs as a standalone process that just manages nginx.conf.
+
+## Why?
+
+The user case where you host your kubernetes cluster on-premise and don't want to have multiple layers of "load balancing" in front of your pods. You also really like nginx. 
+Using this ingress controller on your edge load balacing cluster, the configuration is kept up too date and you can still use nginx build-in functions for zero down time deployments of config and binaries that the normal "in-cluster" ingress controller don't support.
+
+This ingress controller is NOT to be used if you don't understand exaktly what you are doing.
+
+## Usage
+
+You use it very much like the original nginx ingress controller. See: https://github.com/kubernetes/ingress/tree/master/controllers/nginx for full details.  Except you should run it as a system service. 
+
+example:
+`export POD_NAME=default`
+`export POD_NAMESPACE=default`
+`./nginx-ingress-controller --default-backend-service=default/$K8_DEFAULTBACKEND --apiserver-host=https://$K8_API --kubeconfig ~/.kube/config`
+
+

controllers/ext_nginx/configuration.md

@@ -0,0 +1,550 @@
+## Contents
+* [Customizing NGINX](#customizing-nginx)
+* [Custom NGINX configuration](#custom-nginx-configuration)
+* [Custom NGINX template](#custom-nginx-template)
+* [Annotations](#annotations)
+* [Custom NGINX upstream checks](#custom-nginx-upstream-checks)
+* [Authentication](#authentication)
+* [Rewrite](#rewrite)
+* [Rate limiting](#rate-limiting)
+* [Secure backends](#secure-backends)
+* [Server-side HTTPS enforcement through redirect](#server-side-https-enforcement-through-redirect)
+* [Whitelist source range](#whitelist-source-range)
+* [Allowed parameters in configuration ConfigMap](#allowed-parameters-in-configuration-configmap)
+* [Default configuration options](#default-configuration-options)
+* [Websockets](#websockets)
+* [Optimizing TLS Time To First Byte (TTTFB)](#optimizing-tls-time-to-first-byte-tttfb)
+* [Retries in non-idempotent methods](#retries-in-non-idempotent-methods)
+* [Custom max body size](#custom-max-body-size)
+
+
+### Customizing NGINX
+
+There are 3 ways to customize NGINX:
+
+1. [ConfigMap](#allowed-parameters-in-configuration-configmap): create a stand alone ConfigMap, use this if you want a different global configuration.
+2. [annotations](#annotations): use this if you want a specific configuration for the site defined in the Ingress rule.
+3. custom template: when more specific settings are required, like [open_file_cache](http://nginx.org/en/docs/http/ngx_http_core_module.html#open_file_cache), custom [log_format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format), adjust [listen](http://nginx.org/en/docs/http/ngx_http_core_module.html#listen) options as `rcvbuf` or when is not possible to change an through the ConfigMap.
+
+
+#### Custom NGINX configuration
+
+It is possible to customize the defaults in NGINX using a ConfigMap.
+
+Please check the [custom configuration](../../examples/customization/custom-configuration/nginx/README.md) example.
+
+#### Annotations
+
+The following annotations are supported:
+
+|Name                 |type|
+|---------------------------|------|
+|[ingress.kubernetes.io/add-base-url](#rewrite)|true or false|
+|[ingress.kubernetes.io/app-root](#rewrite)|string|
+|[ingress.kubernetes.io/affinity](#session-affinity)|cookie|
+|[ingress.kubernetes.io/auth-realm](#authentication)|string|
+|[ingress.kubernetes.io/auth-secret](#authentication)|string|
+|[ingress.kubernetes.io/auth-type](#authentication)|basic or digest|
+|[ingress.kubernetes.io/auth-url](#external-authentication)|string|
+|[ingress.kubernetes.io/auth-tls-secret](#certificate-authentication)|string|
+|[ingress.kubernetes.io/auth-tls-verify-depth](#certificate-authentication)|number|
+|[ingress.kubernetes.io/configuration-snippet](#configuration-snippet)|string|
+|[ingress.kubernetes.io/enable-cors](#enable-cors)|true or false|
+|[ingress.kubernetes.io/force-ssl-redirect](#server-side-https-enforcement-through-redirect)|true or false|
+|[ingress.kubernetes.io/limit-connections](#rate-limiting)|number|
+|[ingress.kubernetes.io/limit-rps](#rate-limiting)|number|
+|[ingress.kubernetes.io/ssl-passthrough](#ssl-passthrough)|true or false|
+|[ingress.kubernetes.io/proxy-body-size](#custom-max-body-size)|string|
+|[ingress.kubernetes.io/rewrite-target](#rewrite)|URI|
+|[ingress.kubernetes.io/secure-backends](#secure-backends)|true or false|
+|[ingress.kubernetes.io/service-upstream](#service-upstream)|true or false|
+|[ingress.kubernetes.io/session-cookie-name](#cookie-affinity)|string|
+|[ingress.kubernetes.io/session-cookie-hash](#cookie-affinity)|string|
+|[ingress.kubernetes.io/ssl-redirect](#server-side-https-enforcement-through-redirect)|true or false|
+|[ingress.kubernetes.io/upstream-max-fails](#custom-nginx-upstream-checks)|number|
+|[ingress.kubernetes.io/upstream-fail-timeout](#custom-nginx-upstream-checks)|number|
+|[ingress.kubernetes.io/whitelist-source-range](#whitelist-source-range)|CIDR|
+
+
+
+#### Custom NGINX template
+
+The NGINX template is located in the file `/etc/nginx/template/nginx.tmpl`. Mounting a volume is possible to use a custom version.
+Use the [custom-template](../../examples/customization/custom-template/README.md) example as a guide.
+
+**Please note the template is tied to the Go code. Do not change names in the variable `$cfg`.**
+
+For more information about the template syntax please check the [Go template package](https://golang.org/pkg/text/template/).
+In addition to the built-in functions provided by the Go package the following functions are also available:
+
+  - empty: returns true if the specified parameter (string) is empty
+  - contains: [strings.Contains](https://golang.org/pkg/strings/#Contains)
+  - hasPrefix: [strings.HasPrefix](https://golang.org/pkg/strings/#HasPrefix)
+  - hasSuffix: [strings.HasSuffix](https://golang.org/pkg/strings/#HasSuffix)
+  - toUpper: [strings.ToUpper](https://golang.org/pkg/strings/#ToUpper)
+  - toLower: [strings.ToLower](https://golang.org/pkg/strings/#ToLower)
+  - buildLocation: helper to build the NGINX Location section in each server
+  - buildProxyPass: builds the reverse proxy configuration
+  - buildRateLimitZones: helper to build all the required rate limit zones
+  - buildRateLimit:  helper to build a limit zone inside a location if contains a rate limit annotation
+
+
+### Custom NGINX upstream checks
+
+NGINX exposes some flags in the [upstream configuration](http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) that enable the configuration of each server in the upstream. The Ingress controller allows custom `max_fails` and `fail_timeout` parameters in a global context using `upstream-max-fails` and `upstream-fail-timeout` in the NGINX ConfigMap or in a particular Ingress rule. `upstream-max-fails` defaults to 0. This means NGINX will respect the container's `readinessProbe` if it is defined. If there is no probe and no values for `upstream-max-fails` NGINX will continue to send traffic to the container.
+
+**With the default configuration NGINX will not health check your backends. Whenever the endpoints controller notices a readiness probe failure, that pod's IP will be removed from the list of endpoints. This will trigger the NGINX controller to also remove it from the upstreams.**
+
+To use custom values in an Ingress rule define these annotations:
+
+`ingress.kubernetes.io/upstream-max-fails`: number of unsuccessful attempts to communicate with the server that should occur in the duration set by the `upstream-fail-timeout` parameter to consider the server unavailable.
+
+`ingress.kubernetes.io/upstream-fail-timeout`: time in seconds during which the specified number of unsuccessful attempts to communicate with the server should occur to consider the server unavailable. This is also the period of time the server will be considered unavailable.
+
+In NGINX, backend server pools are called "[upstreams](http://nginx.org/en/docs/http/ngx_http_upstream_module.html)". Each upstream contains the endpoints for a service. An upstream is created for each service that has Ingress rules defined.
+
+**Important:** All Ingress rules using the same service will use the same upstream. Only one of the Ingress rules should define annotations to configure the upstream servers.
+
+Please check the [custom upstream check](../../examples/customization/custom-upstream-check/README.md) example.
+
+
+### Authentication
+
+Is possible to add authentication adding additional annotations in the Ingress rule. The source of the authentication is a secret that contains usernames and passwords inside the the key `auth`.
+
+The annotations are:
+
+```
+ingress.kubernetes.io/auth-type: [basic|digest]
+```
+
+Indicates the [HTTP Authentication Type: Basic or Digest Access Authentication](https://tools.ietf.org/html/rfc2617).
+
+```
+ingress.kubernetes.io/auth-secret: secretName
+```
+
+The name of the secret that contains the usernames and passwords with access to the `path`s defined in the Ingress Rule.
+The secret must be created in the same namespace as the Ingress rule.
+
+```
+ingress.kubernetes.io/auth-realm: "realm string"
+```
+
+Please check the [auth](/examples/auth/basic/nginx/README.md) example.
+
+### Certificate Authentication
+
+It's possible to enable Certificate based authentication using additional annotations in Ingress Rule.
+
+The annotations are:
+
+```
+ingress.kubernetes.io/auth-tls-secret: secretName
+```
+
+The name of the secret that contains the full Certificate Authority chain that is enabled to authenticate against this ingress. It's composed of namespace/secretName
+
+```
+ingress.kubernetes.io/auth-tls-verify-depth
+```
+
+The validation depth between the provided client certificate and the Certification Authority chain.
+
+Please check the [tls-auth](/examples/auth/client-certs/nginx/README.md) example.
+
+### Configuration snippet
+
+Using this annotion you can add additional configuration to the NGINX location. For example:
+
+```
+ingress.kubernetes.io/configuration-snippet: |
+  more_set_headers "Request-Id: $request_id";
+```
+
+### Enable CORS
+
+To enable Cross-Origin Resource Sharing (CORS) in an Ingress rule add the annotation `ingress.kubernetes.io/enable-cors: "true"`. This will add a section in the server location enabling this functionality.
+For more information please check https://enable-cors.org/server_nginx.html
+
+### External Authentication
+
+To use an existing service that provides authentication the Ingress rule can be annotated with `ingress.kubernetes.io/auth-url` to indicate the URL where the HTTP request should be sent.
+Additionally it is possible to set `ingress.kubernetes.io/auth-method` to specify the HTTP method to use (GET or POST) and `ingress.kubernetes.io/auth-send-body` to true or false (default).
+
+```
+ingress.kubernetes.io/auth-url: "URL to the authentication service"
+```
+
+Please check the [external-auth](/examples/auth/external-auth/nginx/README.md) example.
+
+
+### Rewrite
+
+In some scenarios the exposed URL in the backend service differs from the specified path in the Ingress rule. Without a rewrite any request will return 404.
+Set the annotation `ingress.kubernetes.io/rewrite-target` to the path expected by the service.
+
+If the application contains relative links it is possible to add an additional annotation `ingress.kubernetes.io/add-base-url` that will prepend a [`base` tag](https://developer.mozilla.org/en/docs/Web/HTML/Element/base) in the header of the returned HTML from the backend.
+
+If the Application Root is exposed in a different path and needs to be redirected, set the annotation `ingress.kubernetes.io/app-root` to redirect requests for `/`.
+
+Please check the [rewrite](/examples/rewrite/nginx/README.md) example.
+
+
+### Rate limiting
+
+The annotations `ingress.kubernetes.io/limit-connections` and `ingress.kubernetes.io/limit-rps` define a limit on the connections that can be opened by a single client IP address. This can be used to mitigate [DDoS Attacks](https://www.nginx.com/blog/mitigating-ddos-attacks-with-nginx-and-nginx-plus).
+
+`ingress.kubernetes.io/limit-connections`: number of concurrent connections allowed from a single IP address.
+
+`ingress.kubernetes.io/limit-rps`: number of connections that may be accepted from a given IP each second.
+
+If you specify both annotations in a single Ingress rule, `limit-rps` takes precedence.
+
+
+### SSL Passthrough
+
+The annotation `ingress.kubernetes.io/ssl-passthrough` allows to configure TLS termination in the pod and not in NGINX.
+This is possible thanks to the [ngx_stream_ssl_preread_module](https://nginx.org/en/docs/stream/ngx_stream_ssl_preread_module.html) that enables the extraction of the server name information requested through SNI from the ClientHello message at the preread phase.
+
+**Important:** using the annotation `ingress.kubernetes.io/ssl-passthrough` invalidates all the other available annotations. This is because SSL Passthrough works in L4 (TCP).
+
+
+### Secure backends
+
+By default NGINX uses `http` to reach the services. Adding the annotation `ingress.kubernetes.io/secure-backends: "true"` in the Ingress rule changes the protocol to `https`.
+
+### Service Upstream
+
+By default the NGINX ingress controller uses a list of all endpoints (Pod IP/port) in the NGINX upstream configuration. This annotation disables that behavior and instead uses a single upstream in NGINX, the service's Cluster IP and port. This can be desirable for things like zero-downtime deployments as it reduces the need to reload NGINX configuration when Pods come up and down. See issue [#257](https://github.com/kubernetes/ingress/issues/257).
+
+
+#### Known Issues
+
+If the `service-upstream` annotation is specified the following things should be taken into consideration:
+
+* Sticky Sessions will not work as only round-robin load balancing is supported. 
+* The `proxy_next_upstream` directive will not have any effect meaning on error the request will not be dispatched to another upstream.
+
+### Server-side HTTPS enforcement through redirect
+
+By default the controller redirects (301) to `HTTPS` if TLS is enabled for that ingress. If you want to disable that behaviour globally, you can use `ssl-redirect: "false"` in the NGINX config map.
+
+To configure this feature for specific ingress resources, you can use the `ingress.kubernetes.io/ssl-redirect: "false"` annotation in the particular resource.
+
+When using SSL offloading outside of cluster (e.g. AWS ELB) it may be usefull to enforce a redirect to `HTTPS` even when there is not TLS cert available. This can be achieved by using the `ingress.kubernetes.io/force-ssl-redirect: "true"` annotation in the particular resource.
+
+
+### Whitelist source range
+
+You can specify the allowed client IP source ranges through the `ingress.kubernetes.io/whitelist-source-range` annotation. The value is a comma separated list of [CIDRs](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing), e.g.  `10.0.0.0/24,172.10.0.1`.
+
+To configure this setting globally for all Ingress rules, the `whitelist-source-range` value may be set in the NGINX ConfigMap.
+
+*Note:* Adding an annotation to an Ingress rule overrides any global restriction.
+
+Please check the [whitelist](/examples/affinity/cookie/nginx/README.md) example.
+
+
+### Session Affinity
+
+The annotation `ingress.kubernetes.io/affinity` enables and sets the affinity type in all Upstreams of an Ingress. This way, a request will always be directed to the same upstream server.
+
+The only affinity type available for NGINX is `cookie`.
+
+
+#### Cookie affinity
+If you use the ``cookie`` type you can also specify the name of the cookie that will be used to route the requests with the annotation `ingress.kubernetes.io/session-cookie-name`. The default is to create a cookie named 'route'.
+
+In case of NGINX the annotation `ingress.kubernetes.io/session-cookie-hash` defines which algorithm will be used to 'hash' the used upstream. Default value is `md5` and possible values are `md5`, `sha1` and `index`.
+The `index` option  is not hashed, an in-memory index is used instead, it's quicker and the overhead is shorter Warning: the matching against upstream servers list is inconsistent. So, at reload, if upstreams servers has changed, index values are not guaranted to correspond to the same server as before! USE IT WITH CAUTION and only if you need to!
+
+In NGINX this feature is implemented by the third party module [nginx-sticky-module-ng](https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng). The workflow used to define which upstream server will be used is explained [here](https://bitbucket.org/nginx-goodies/nginx-sticky-module-ng/raw/08a395c66e425540982c00482f55034e1fee67b6/docs/sticky.pdf)
+
+
+
+### **Allowed parameters in configuration ConfigMap**
+
+**proxy-body-size:** Sets the maximum allowed size of the client request body. See NGINX [client_max_body_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size).
+
+
+**custom-http-errors:** Enables which HTTP codes should be passed for processing with the [error_page directive](http://nginx.org/en/docs/http/ngx_http_core_module.html#error_page).
+Setting at least one code also enables [proxy_intercept_errors](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_intercept_errors) which are required to process error_page.
+
+Example usage: `custom-http-errors: 404,415`
+
+
+**disable-access-log:** Disables the Access Log from the entire Ingress Controller. This is 'false' by default.
+
+
+**disable-ipv6:** Disable listening on IPV6. This is 'false' by default.
+
+
+**enable-dynamic-tls-records:** Enables dynamically sized TLS records to improve time-to-first-byte. Enabled by default. See [CloudFlare's blog](https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency) for more information.
+
+
+**enable-underscores-in-headers:** Enables underscores in header names. This is disabled by default.
+
+**enable-vts-status:** Allows the replacement of the default status page with a third party module named [nginx-module-vts](https://github.com/vozlt/nginx-module-vts).
+
+
+**error-log-level:** Configures the logging level of errors. Log levels above are listed in the order of increasing severity.
+http://nginx.org/en/docs/ngx_core_module.html#error_log
+
+
+**gzip-types:** Sets the MIME types in addition to "text/html" to compress. The special value "\*" matches any MIME type.
+Responses with the "text/html" type are always compressed if `use-gzip` is enabled.
+
+
+**hsts:** Enables or disables the header HSTS in servers running SSL.
+HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header) that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP. It provides protection against protocol downgrade attacks and cookie theft.
+https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+https://blog.qualys.com/securitylabs/2016/03/28/the-importance-of-a-proper-http-strict-transport-security-implementation-on-your-web-server
+
+
+**hsts-include-subdomains:** Enables or disables the use of HSTS in all the subdomains of the servername.
+
+
+**hsts-max-age:** Sets the time, in seconds, that the browser should remember that this site is only to be accessed using HTTPS.
+
+**hsts-preload:** Enables or disables the preload attribute in the HSTS feature (if is enabled)
+
+**ignore-invalid-headers:** set if header fields with invalid names should be ignored. This is 'true' by default.
+
+**keep-alive:** Sets the time during which a keep-alive client connection will stay open on the server side.
+The zero value disables keep-alive client connections.
+http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
+
+**load-balance:** Sets the algorithm to use for load balancing. The value can either be round_robin to
+use the default round robin load balancer, least_conn to use the least connected method, or
+ip_hash to use a hash of the server for routing. The default is least_conn.
+http://nginx.org/en/docs/http/load_balancing.html.
+
+**log-format-upstream:** Sets the nginx [log format](http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format).
+
+Example for json output:
+
+```
+log-format-upstream: '{ "time": "$time_iso8601", "remote_addr": "$proxy_protocol_addr",
+    "x-forward-for": "$proxy_add_x_forwarded_for", "request_id": "$request_id", "remote_user":
+    "$remote_user", "bytes_sent": $bytes_sent, "request_time": $request_time, "status":
+    $status, "vhost": "$host", "request_proto": "$server_protocol", "path": "$uri",
+    "request_query": "$args", "request_length": $request_length, "duration": $request_time,
+    "method": "$request_method", "http_referrer": "$http_referer", "http_user_agent":
+    "$http_user_agent" }' 
+  ```
+
+**log-format-stream:** Sets the nginx [stream format](https://nginx.org/en/docs/stream/ngx_stream_log_module.html#log_format)
+.
+
+    
+**max-worker-connections:** Sets the maximum number of simultaneous connections that can be opened by each [worker process](http://nginx.org/en/docs/ngx_core_module.html#worker_connections).
+
+
+**proxy-buffer-size:** Sets the size of the buffer used for [reading the first part of the response](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size) received from the proxied server. This part usually contains a small response header.
+
+
+**proxy-connect-timeout:** Sets the timeout for [establishing a connection with a proxied server](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout). It should be noted that this timeout cannot usually exceed 75 seconds.
+
+
+**proxy-cookie-domain:** Sets a text that [should be changed in the domain attribute](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_domain) of the “Set-Cookie” header fields of a proxied server response.
+
+
+**proxy-cookie-path:** Sets a text that [should be changed in the path attribute](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_path) of the “Set-Cookie” header fields of a proxied server response.
+ 
+
+**proxy-read-timeout:** Sets the timeout in seconds for [reading a response from the proxied server](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout). The timeout is set only between two successive read operations, not for the transmission of the whole response.
+
+
+**proxy-send-timeout:** Sets the timeout in seconds for [transmitting a request to the proxied server](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout). The timeout is set only between two successive write operations, not for the transmission of the whole request.
+
+
+**proxy-next-upstream:** Specifies in [which cases](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream) a request should be passed to the next server.
+
+
+**retry-non-idempotent:** Since 1.9.13 NGINX will not retry non-idempotent requests (POST, LOCK, PATCH) in case of an error in the upstream server.
+
+The previous behavior can be restored using the value "true".
+
+
+**server-name-hash-bucket-size:** Sets the size of the bucket for the server names hash tables.
+http://nginx.org/en/docs/hash.html
+http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size
+
+
+**server-name-hash-max-size:** Sets the maximum size of the [server names hash tables](http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size) used in server names, map directive’s values, MIME types, names of request header strings, etc.
+http://nginx.org/en/docs/hash.html
+
+**proxy-headers-hash-bucket-size:** Sets the size of the bucket for the proxy headers hash tables.
+http://nginx.org/en/docs/hash.html
+https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_bucket_size
+
+**proxy-headers-hash-max-size:** Sets the maximum size of the proxy headers hash tables.
+http://nginx.org/en/docs/hash.html
+https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_max_size
+
+**server-tokens:** Send NGINX Server header in responses and display NGINX version in error pages. Enabled by default.
+
+
+**map-hash-bucket-size:** Sets the bucket size for the [map variables hash tables](http://nginx.org/en/docs/http/ngx_http_map_module.html#map_hash_bucket_size). The details of setting up hash tables are provided in a separate [document](http://nginx.org/en/docs/hash.html).
+
+
+**ssl-buffer-size:** Sets the size of the [SSL buffer](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size) used for sending data.
+The default of 4k helps NGINX to improve TLS Time To First Byte (TTTFB).
+https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
+
+
+**ssl-ciphers:** Sets the [ciphers](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers) list to enable. The ciphers are specified in the format understood by the OpenSSL library.
+
+The default cipher list is:
+ `ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA`.
+
+The ordering of a ciphersuite is very important because it decides which algorithms are going to be selected in priority.
+The recommendation above prioritizes algorithms that provide perfect [forward secrecy](https://wiki.mozilla.org/Security/Server_Side_TLS#Forward_Secrecy).
+
+Please check the [Mozilla SSL Configuration Generator](https://mozilla.github.io/server-side-tls/ssl-config-generator/).
+
+
+**ssl-dh-param:** Sets the name of the secret that contains Diffie-Hellman key to help with "Perfect Forward Secrecy".
+https://www.openssl.org/docs/manmaster/apps/dhparam.html
+https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam
+http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
+
+
+**ssl-protocols:** Sets the [SSL protocols](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols) to use.
+The default is: `TLSv1 TLSv1.1 TLSv1.2`.
+
+TLSv1 is enabled to allow old clients like:
+- [IE 8-10 / Win 7](https://www.ssllabs.com/ssltest/viewClient.html?name=IE&version=8-10&platform=Win%207&key=113)
+- [Java 7u25](https://www.ssllabs.com/ssltest/viewClient.html?name=Java&version=7u25&key=26)
+
+If you don't need to support these clients please remove `TLSv1` to improve security.
+
+Please check the result of the configuration using `https://ssllabs.com/ssltest/analyze.html` or `https://testssl.sh`.
+
+
+**ssl-redirect:** Sets the global value of redirects (301) to HTTPS if the server has a TLS certificate (defined in an Ingress rule)
+Default is "true".
+
+
+**ssl-session-cache:** Enables or disables the use of shared [SSL cache](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache) among worker processes.
+
+
+**ssl-session-cache-size:** Sets the size of the [SSL shared session cache](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache) between all worker processes.
+
+
+**ssl-session-tickets:** Enables or disables session resumption through [TLS session tickets](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets).
+
+
+**ssl-session-timeout:** Sets the time during which a client may [reuse the session](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout) parameters stored in a cache.
+
+
+**upstream-max-fails:** Sets the number of unsuccessful attempts to communicate with the [server](http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) that should happen in the duration set by the `fail_timeout` parameter to consider the server unavailable.
+
+
+**upstream-fail-timeout:** Sets the time during which the specified number of unsuccessful attempts to communicate with the [server](http://nginx.org/en/docs/http/ngx_http_upstream_module.html#upstream) should happen to consider the server unavailable.
+
+
+**use-gzip:** Enables or disables compression of HTTP responses using the ["gzip" module](http://nginx.org/en/docs/http/ngx_http_gzip_module.html)
+The default mime type list to compress is: `application/atom+xml application/javascript aplication/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component`.
+
+
+**use-http2:** Enables or disables [HTTP/2](http://nginx.org/en/docs/http/ngx_http_v2_module.html) support in secure connections.
+
+
+**use-proxy-protocol:** Enables or disables the [PROXY protocol](https://www.nginx.com/resources/admin-guide/proxy-protocol/) to receive client connection (real IP address) information passed through proxy servers and load balancers such as HAProxy and Amazon Elastic Load Balancer (ELB).
+
+
+**whitelist-source-range:** Sets the default whitelisted IPs for each `server` block. This can be overwritten by an annotation on an Ingress rule. See [ngx_http_access_module](http://nginx.org/en/docs/http/ngx_http_access_module.html).
+
+
+**worker-processes:** Sets the number of [worker processes](http://nginx.org/en/docs/ngx_core_module.html#worker_processes). The default of "auto" means number of available CPU cores.
+
+
+**limit-conn-zone-variable:** Sets parameters for a shared memory zone that will keep states for various keys of [limit_conn_zone](http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone). The default of "$binary_remote_addr" variable’s size is always 4 bytes for IPv4 addresses or 16 bytes for IPv6 addresses.
+
+
+### Default configuration options
+
+The following table shows the options, the default value and a description.
+
+|name                 |default|
+|---------------------------|------|
+|body-size|1m|
+|custom-http-errors|" "|
+|enable-dynamic-tls-records|"true"|
+|enable-sticky-sessions|"false"|
+|enable-underscores-in-headers|"false"|
+|enable-vts-status|"false"|
+|error-log-level|notice|
+|gzip-types|see use-gzip description above|
+|hsts|"true"|
+|hsts-include-subdomains|"true"|
+|hsts-max-age|"15724800"|
+|hsts-preload|"false"|
+|ignore-invalid-headers|"true"|
+|keep-alive|"75"| 
+|log-format-stream|[$time_local] $protocol $status $bytes_sent $bytes_received $session_time|
+|log-format-upstream|[$the_real_ip] - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status|
+|map-hash-bucket-size|"64"|
+|max-worker-connections|"16384"|
+|proxy-body-size|same as body-size|
+|proxy-buffer-size|"4k"|
+|proxy-connect-timeout|"5"|
+|proxy-cookie-domain|"off"|
+|proxy-cookie-path|"off"|
+|proxy-read-timeout|"60"|
+|proxy-real-ip-cidr|0.0.0.0/0|
+|proxy-send-timeout|"60"|
+|retry-non-idempotent|"false"|
+|server-name-hash-bucket-size|"64"|
+|server-name-hash-max-size|"512"|
+|server-tokens|"true"|
+|ssl-buffer-size|4k|
+|ssl-ciphers||
+|ssl-dh-param|value from openssl|
+|ssl-protocols|TLSv1 TLSv1.1 TLSv1.2|
+|ssl-session-cache|"true"|
+|ssl-session-cache-size|10m|
+|ssl-session-tickets|"true"|
+|ssl-session-timeout|10m|
+|use-gzip|"true"|
+|use-http2|"true"|
+|upstream-keepalive-connections|"0" (disabled)|
+|variables-hash-bucket-size|64|
+|variables-hash-max-size|2048|
+|vts-status-zone-size|10m|
+|whitelist-source-range|permit all|
+|worker-processes|number of CPUs|
+|limit-conn-zone-variable|$binary_remote_addr|
+
+
+### Websockets
+
+Support for websockets is provided by NGINX out of the box. No special configuration required.
+
+The only requirement to avoid the close of connections is the increase of the values of `proxy-read-timeout` and `proxy-send-timeout`. The default value of this settings is `60 seconds`.
+A more adequate value to support websockets is a value higher than one hour (`3600`).
+
+
+### Optimizing TLS Time To First Byte (TTTFB)
+
+NGINX provides the configuration option [ssl_buffer_size](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size) to allow the optimization of the TLS record size. This improves the [Time To First Byte](https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/) (TTTFB). The default value in the Ingress controller is `4k` (NGINX default is `16k`).
+
+
+### Retries in non-idempotent methods
+
+Since 1.9.13 NGINX will not retry non-idempotent requests (POST, LOCK, PATCH) in case of an error.
+The previous behavior can be restored using `retry-non-idempotent=true` in the configuration ConfigMap.
+
+
+### Custom max body size
+For NGINX, 413 error will be returned to the client when the size in a request exceeds the maximum allowed size of the client request body. This size can be configured by the parameter [`client_max_body_size`](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size).
+
+To configure this setting globally for all Ingress rules, the `proxy-body-size` value may be set in the NGINX ConfigMap.
+
+To use custom values in an Ingress rule define these annotation:
+
+```
+ingress.kubernetes.io/proxy-body-size: 8m
+```

controllers/ext_nginx/pkg/cmd/controller/main.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/golang/glog"
+	"k8s.io/ingress/core/pkg/ingress/controller"
+)
+
+func main() {
+	// start a new nginx controller
+	ngx := newExtNGINXController()
+	// create a custom Ingress controller using NGINX as backend
+	ic := controller.NewIngressController(ngx)
+	go handleSigterm(ic)
+	// start the controller
+	ic.Start()
+	// wait
+	glog.Infof("shutting down Ingress controller...")
+}
+
+func handleSigterm(ic *controller.GenericController) {
+	signalChan := make(chan os.Signal, 1)
+	signal.Notify(signalChan, syscall.SIGTERM)
+	<-signalChan
+	glog.Infof("Received SIGTERM, shutting down")
+
+	exitCode := 0
+	if err := ic.Stop(); err != nil {
+		glog.Infof("Error during shutdown %v", err)
+		exitCode = 1
+	}
+
+	glog.Infof("Exiting with %v", exitCode)
+	os.Exit(exitCode)
+}

controllers/ext_nginx/pkg/cmd/controller/nginx.go

@@ -0,0 +1,458 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"github.com/golang/glog"
+	"github.com/spf13/pflag"
+
+	api_v1 "k8s.io/client-go/pkg/api/v1"
+
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+	ngx_template "k8s.io/ingress/controllers/nginx/pkg/template"
+	"k8s.io/ingress/controllers/nginx/pkg/version"
+	"k8s.io/ingress/core/pkg/ingress"
+	"k8s.io/ingress/core/pkg/ingress/defaults"
+	//"k8s.io/ingress/core/pkg/net/dns"
+	"k8s.io/ingress/core/pkg/net/ssl"
+)
+
+var (
+	tmplPath        = "/etc/nginx/template/nginx.tmpl"
+	cfgPath         = "/etc/nginx/nginx.conf"
+	binary          = "/usr/sbin/nginx"
+	defIngressClass = "nginx"
+)
+
+// newExtExtNGINXController creates a new NGINX Ingress controller.
+// If the environment variable NGINX_BINARY exists it will be used
+// as source for nginx commands
+func newExtNGINXController() ingress.Controller {
+	ngx := os.Getenv("NGINX_BINARY")
+	if ngx == "" {
+		ngx = binary
+	}
+
+	/*	h, err := dns.GetSystemNameServers()
+		if err != nil {
+			glog.Warningf("unexpected error reading system nameservers: %v", err)
+		}
+	*/
+	n := &ExtNGINXController{
+		binary:        ngx,
+		configmap:     &api_v1.ConfigMap{},
+		isIPV6Enabled: isIPv6Enabled(),
+		//		resolver:      h,
+	}
+
+	var onChange func()
+	onChange = func() {
+		template, err := ngx_template.NewTemplate(tmplPath, onChange)
+		if err != nil {
+			// this error is different from the rest because it must be clear why nginx is not working
+			glog.Errorf(`
+-------------------------------------------------------------------------------
+Error loading new template : %v
+-------------------------------------------------------------------------------
+`, err)
+			return
+		}
+
+		n.t.Close()
+		n.t = template
+		glog.Info("new NGINX template loaded")
+	}
+
+	ngxTpl, err := ngx_template.NewTemplate(tmplPath, onChange)
+	if err != nil {
+		glog.Fatalf("invalid NGINX template: %v", err)
+	}
+
+	n.t = ngxTpl
+
+	return ingress.Controller(n)
+}
+
+type server struct {
+	Hostname string
+	IP       string
+	Port     int
+}
+
+// ExtNGINXController ...
+type ExtNGINXController struct {
+	t *ngx_template.Template
+
+	configmap *api_v1.ConfigMap
+
+	storeLister ingress.StoreLister
+
+	binary   string
+	resolver []net.IP
+
+	cmdArgs []string
+
+	// returns true if IPV6 is enabled in the pod
+	isIPV6Enabled bool
+}
+
+// Start a dummy function since we don't manage nginx start and stop in a external environment.
+func (n *ExtNGINXController) Start() {
+	glog.Info("starting External NGINX Controller")
+
+}
+
+// BackendDefaults returns the nginx defaults
+func (n ExtNGINXController) BackendDefaults() defaults.Backend {
+	if n.configmap == nil {
+		d := config.NewDefault()
+		return d.Backend
+	}
+
+	return ngx_template.ReadConfig(n.configmap.Data).Backend
+}
+
+// printDiff returns the difference between the running configuration
+// and the new one
+func (n ExtNGINXController) printDiff(data []byte) {
+	in, err := os.Open(cfgPath)
+	if err != nil {
+		return
+	}
+	src, err := ioutil.ReadAll(in)
+	in.Close()
+	if err != nil {
+		return
+	}
+
+	if !bytes.Equal(src, data) {
+		tmpfile, err := ioutil.TempFile("", "nginx-cfg-diff")
+		if err != nil {
+			glog.Errorf("error creating temporal file: %s", err)
+			return
+		}
+		defer tmpfile.Close()
+		err = ioutil.WriteFile(tmpfile.Name(), data, 0644)
+		if err != nil {
+			return
+		}
+
+		diffOutput, err := diff(src, data)
+		if err != nil {
+			glog.Errorf("error computing diff: %s", err)
+			return
+		}
+
+		if glog.V(2) {
+			glog.Infof("NGINX configuration diff\n")
+			glog.Infof("%v", string(diffOutput))
+		}
+		os.Remove(tmpfile.Name())
+	}
+}
+
+// Info return build information
+func (n ExtNGINXController) Info() *ingress.BackendInfo {
+	return &ingress.BackendInfo{
+		Name:       "ExtNGINX",
+		Release:    version.RELEASE,
+		Build:      version.COMMIT,
+		Repository: version.REPO,
+	}
+}
+
+// ConfigureFlags allow to configure more flags before the parsing of
+// command line arguments
+func (n *ExtNGINXController) ConfigureFlags(flags *pflag.FlagSet) {
+}
+
+// OverrideFlags customize NGINX controller flags
+func (n *ExtNGINXController) OverrideFlags(flags *pflag.FlagSet) {
+}
+
+// DefaultIngressClass just return the default ingress class
+func (n ExtNGINXController) DefaultIngressClass() string {
+	return defIngressClass
+}
+
+// testTemplate checks if the NGINX configuration inside the byte array is valid
+// running the command "nginx -t" using a temporal file.
+func (n ExtNGINXController) testTemplate(cfg []byte) error {
+	if len(cfg) == 0 {
+		return fmt.Errorf("invalid nginx configuration (empty)")
+	}
+	tmpfile, err := ioutil.TempFile("", "nginx-cfg")
+	if err != nil {
+		return err
+	}
+	defer tmpfile.Close()
+	err = ioutil.WriteFile(tmpfile.Name(), cfg, 0644)
+	if err != nil {
+		return err
+	}
+	out, err := exec.Command(n.binary, "-t", "-c", tmpfile.Name()).CombinedOutput()
+	if err != nil {
+		// this error is different from the rest because it must be clear why nginx is not working
+		oe := fmt.Sprintf(`
+-------------------------------------------------------------------------------
+Error: %v
+%v
+-------------------------------------------------------------------------------
+`, err, string(out))
+		return errors.New(oe)
+	}
+
+	os.Remove(tmpfile.Name())
+	return nil
+}
+
+// SetConfig sets the configured configmap
+func (n *ExtNGINXController) SetConfig(cmap *api_v1.ConfigMap) {
+	n.configmap = cmap
+
+	if cmap == nil {
+		return
+	}
+}
+
+// SetListers sets the configured store listers in the generic ingress controller
+func (n *ExtNGINXController) SetListers(lister ingress.StoreLister) {
+	n.storeLister = lister
+}
+
+// OnUpdate is called by syncQueue in https://github.com/aledbf/ingress-controller/blob/master/pkg/ingress/controller/controller.go#L82
+// periodically to keep the configuration in sync.
+//
+// convert configmap to custom configuration object (different in each implementation)
+// write the custom template (the complexity depends on the implementation)
+// write the configuration file
+// returning nill implies the backend will be reloaded.
+// if an error is returned means requeue the update
+func (n *ExtNGINXController) OnUpdate(ingressCfg ingress.Configuration) error {
+	var longestName int
+	var serverNameBytes int
+	for _, srv := range ingressCfg.Servers {
+		if longestName < len(srv.Hostname) {
+			longestName = len(srv.Hostname)
+		}
+		serverNameBytes += len(srv.Hostname)
+	}
+
+	cfg := ngx_template.ReadConfig(n.configmap.Data)
+	cfg.Resolver = n.resolver
+
+	servers := []*server{}
+	for _, pb := range ingressCfg.PassthroughBackends {
+		svc := pb.Service
+		if svc == nil {
+			glog.Warningf("missing service for PassthroughBackends %v", pb.Backend)
+			continue
+		}
+		port, err := strconv.Atoi(pb.Port.String())
+		if err != nil {
+			for _, sp := range svc.Spec.Ports {
+				if sp.Name == pb.Port.String() {
+					port = int(sp.Port)
+					break
+				}
+			}
+		} else {
+			for _, sp := range svc.Spec.Ports {
+				if sp.Port == int32(port) {
+					port = int(sp.Port)
+					break
+				}
+			}
+		}
+
+		//TODO: Allow PassthroughBackends to specify they support proxy-protocol
+		servers = append(servers, &server{
+			Hostname: pb.Hostname,
+			IP:       svc.Spec.ClusterIP,
+			Port:     port,
+		})
+	}
+
+	// NGINX cannot resize the has tables used to store server names.
+	// For this reason we check if the defined size defined is correct
+	// for the FQDN defined in the ingress rules adjusting the value
+	// if is required.
+	// https://trac.nginx.org/nginx/ticket/352
+	// https://trac.nginx.org/nginx/ticket/631
+	nameHashBucketSize := nginxHashBucketSize(longestName)
+	if cfg.ServerNameHashBucketSize == 0 {
+		glog.V(3).Infof("adjusting ServerNameHashBucketSize variable to %v", nameHashBucketSize)
+		cfg.ServerNameHashBucketSize = nameHashBucketSize
+	}
+	serverNameHashMaxSize := nextPowerOf2(serverNameBytes)
+	if cfg.ServerNameHashMaxSize < serverNameHashMaxSize {
+		glog.V(3).Infof("adjusting ServerNameHashMaxSize variable to %v", serverNameHashMaxSize)
+		cfg.ServerNameHashMaxSize = serverNameHashMaxSize
+	}
+
+	// the limit of open files is per worker process
+	// and we leave some room to avoid consuming all the FDs available
+	wp, err := strconv.Atoi(cfg.WorkerProcesses)
+	glog.V(3).Infof("number of worker processes: %v", wp)
+	if err != nil {
+		wp = 1
+	}
+	maxOpenFiles := (sysctlFSFileMax() / wp) - 1024
+	glog.V(3).Infof("maximum number of open file descriptors : %v", sysctlFSFileMax())
+	if maxOpenFiles < 1024 {
+		// this means the value of RLIMIT_NOFILE is too low.
+		maxOpenFiles = 1024
+	}
+
+	setHeaders := map[string]string{}
+	if cfg.ProxySetHeaders != "" {
+		cmap, exists, err := n.storeLister.ConfigMap.GetByKey(cfg.ProxySetHeaders)
+		if err != nil {
+			glog.Warningf("unexpected error reading configmap %v: %v", cfg.ProxySetHeaders, err)
+		}
+
+		if exists {
+			setHeaders = cmap.(*api_v1.ConfigMap).Data
+		}
+	}
+
+	addHeaders := map[string]string{}
+	if cfg.AddHeaders != "" {
+		cmap, exists, err := n.storeLister.ConfigMap.GetByKey(cfg.AddHeaders)
+		if err != nil {
+			glog.Warningf("unexpected error reading configmap %v: %v", cfg.AddHeaders, err)
+		}
+
+		if exists {
+			addHeaders = cmap.(*api_v1.ConfigMap).Data
+		}
+	}
+
+	sslDHParam := ""
+	if cfg.SSLDHParam != "" {
+		secretName := cfg.SSLDHParam
+		s, exists, err := n.storeLister.Secret.GetByKey(secretName)
+		if err != nil {
+			glog.Warningf("unexpected error reading secret %v: %v", secretName, err)
+		}
+
+		if exists {
+			secret := s.(*api_v1.Secret)
+			nsSecName := strings.Replace(secretName, "/", "-", -1)
+
+			dh, ok := secret.Data["dhparam.pem"]
+			if ok {
+				pemFileName, err := ssl.AddOrUpdateDHParam(nsSecName, dh)
+				if err != nil {
+					glog.Warningf("unexpected error adding or updating dhparam %v file: %v", nsSecName, err)
+				} else {
+					sslDHParam = pemFileName
+				}
+			}
+		}
+	}
+
+	cfg.SSLDHParam = sslDHParam
+
+	content, err := n.t.Write(config.TemplateConfig{
+		ProxySetHeaders:     setHeaders,
+		AddHeaders:          addHeaders,
+		MaxOpenFiles:        maxOpenFiles,
+		BacklogSize:         sysctlSomaxconn(),
+		Backends:            ingressCfg.Backends,
+		PassthroughBackends: ingressCfg.PassthroughBackends,
+		Servers:             ingressCfg.Servers,
+		TCPBackends:         ingressCfg.TCPEndpoints,
+		UDPBackends:         ingressCfg.UDPEndpoints,
+		CustomErrors:        len(cfg.CustomHTTPErrors) > 0,
+		Cfg:                 cfg,
+		IsIPV6Enabled:       n.isIPV6Enabled && !cfg.DisableIpv6,
+	})
+
+	if err != nil {
+		return err
+	}
+
+	err = n.testTemplate(content)
+	if err != nil {
+		return err
+	}
+
+	n.printDiff(content)
+
+	err = ioutil.WriteFile(cfgPath, content, 0644)
+	if err != nil {
+		return err
+	}
+
+	o, err := exec.Command(n.binary, "-s", "reload", "-c", cfgPath).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("%v\n%v", err, string(o))
+	}
+
+	return nil
+}
+
+// nginxHashBucketSize computes the correct nginx hash_bucket_size for a hash with the given longest key
+func nginxHashBucketSize(longestString int) int {
+	// See https://github.com/kubernetes/ingress/issues/623 for an explanation
+	wordSize := 8 // Assume 64 bit CPU
+	n := longestString + 2
+	aligned := (n + wordSize - 1) & ^(wordSize - 1)
+	rawSize := wordSize + wordSize + aligned
+	return nextPowerOf2(rawSize)
+}
+
+// Name returns the healthcheck name
+func (n ExtNGINXController) Name() string {
+	return "Ingress Controller"
+}
+
+// Check returns nil because we are not running in a pod.
+func (n ExtNGINXController) Check(_ *http.Request) error {
+	return nil
+}
+
+// http://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
+// https://play.golang.org/p/TVSyCcdxUh
+func nextPowerOf2(v int) int {
+	v--
+	v |= v >> 1
+	v |= v >> 2
+	v |= v >> 4
+	v |= v >> 8
+	v |= v >> 16
+	v++
+
+	return v
+}
+
+func isIPv6Enabled() bool {
+	cmd := exec.Command("test", "-f", "/proc/net/if_inet6")
+	return cmd.Run() == nil
+}

controllers/ext_nginx/pkg/cmd/controller/nginx_test.go

@@ -0,0 +1,59 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import "testing"
+
+func TestNginxHashBucketSize(t *testing.T) {
+	tests := []struct {
+		n        int
+		expected int
+	}{
+		{0, 32},
+		{1, 32},
+		{2, 32},
+		{3, 32},
+		// ...
+		{13, 32},
+		{14, 32},
+		{15, 64},
+		{16, 64},
+		// ...
+		{45, 64},
+		{46, 64},
+		{47, 128},
+		{48, 128},
+		// ...
+		// ...
+		{109, 128},
+		{110, 128},
+		{111, 256},
+		{112, 256},
+		// ...
+		{237, 256},
+		{238, 256},
+		{239, 512},
+		{240, 512},
+	}
+
+	for _, test := range tests {
+		actual := nginxHashBucketSize(test.n)
+		if actual != test.expected {
+			t.Errorf("Test nginxHashBucketSize(%d): expected %d but returned %d", test.n, test.expected, actual)
+		}
+	}
+}

controllers/ext_nginx/pkg/cmd/controller/utils.go

@@ -0,0 +1,76 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"io/ioutil"
+	"os"
+	"os/exec"
+	"syscall"
+
+	"k8s.io/kubernetes/pkg/util/sysctl"
+
+	"github.com/golang/glog"
+)
+
+// sysctlSomaxconn returns the value of net.core.somaxconn, i.e.
+// maximum number of connections that can be queued for acceptance
+// http://nginx.org/en/docs/http/ngx_http_core_module.html#listen
+func sysctlSomaxconn() int {
+	maxConns, err := sysctl.New().GetSysctl("net/core/somaxconn")
+	if err != nil || maxConns < 512 {
+		glog.V(3).Infof("system net.core.somaxconn=%v (using system default)", maxConns)
+		return 511
+	}
+
+	return maxConns
+}
+
+// sysctlFSFileMax returns the value of fs.file-max, i.e.
+// maximum number of open file descriptors
+func sysctlFSFileMax() int {
+	var rLimit syscall.Rlimit
+	err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, &rLimit)
+	if err != nil {
+		glog.Errorf("unexpected error reading system maximum number of open file descriptors (RLIMIT_NOFILE): %v", err)
+		// returning 0 means don't render the value
+		return 0
+	}
+	return int(rLimit.Max)
+}
+
+func diff(b1, b2 []byte) ([]byte, error) {
+	f1, err := ioutil.TempFile("", "a")
+	if err != nil {
+		return nil, err
+	}
+	defer f1.Close()
+	defer os.Remove(f1.Name())
+
+	f2, err := ioutil.TempFile("", "b")
+	if err != nil {
+		return nil, err
+	}
+	defer f2.Close()
+	defer os.Remove(f2.Name())
+
+	f1.Write(b1)
+	f2.Write(b2)
+
+	out, _ := exec.Command("diff", "-u", f1.Name(), f2.Name()).CombinedOutput()
+	return out, nil
+}

controllers/ext_nginx/pkg/cmd/controller/utils_test.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import "testing"
+
+func TestDiff(t *testing.T) {
+	tests := []struct {
+		a     []byte
+		b     []byte
+		empty bool
+	}{
+		{[]byte(""), []byte(""), true},
+		{[]byte("a"), []byte("a"), true},
+		{[]byte("a"), []byte("b"), false},
+	}
+
+	for _, test := range tests {
+		b, err := diff(test.a, test.b)
+		if err != nil {
+			t.Fatalf("unexpected error returned: %v", err)
+		}
+		if len(b) == 0 && !test.empty {
+			t.Fatalf("expected empty but returned %s", b)
+		}
+	}
+}

controllers/ext_nginx/pkg/config/config.go

@@ -0,0 +1,422 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"runtime"
+	"strconv"
+
+	"github.com/golang/glog"
+
+	"k8s.io/ingress/core/pkg/ingress"
+	"k8s.io/ingress/core/pkg/ingress/defaults"
+)
+
+const (
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+	// Sets the maximum allowed size of the client request body
+	bodySize = "1m"
+
+	// http://nginx.org/en/docs/ngx_core_module.html#error_log
+	// Configures logging level [debug | info | notice | warn | error | crit | alert | emerg]
+	// Log levels above are listed in the order of increasing severity
+	errorLevel = "notice"
+
+	// HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header)
+	// that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.
+	// https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+	// max-age is the time, in seconds, that the browser should remember that this site is only to be accessed using HTTPS.
+	hstsMaxAge = "15724800"
+
+	gzipTypes = "application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/plain text/x-component"
+
+	logFormatUpstream = `%v - [$the_real_ip] - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status`
+
+	logFormatStream = `[$time_local] $protocol $status $bytes_sent $bytes_received $session_time`
+
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
+	// Sets the size of the buffer used for sending data.
+	// 4k helps NGINX to improve TLS Time To First Byte (TTTFB)
+	// https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
+	sslBufferSize = "4k"
+
+	// Enabled ciphers list to enabled. The ciphers are specified in the format understood by the OpenSSL library
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
+	sslCiphers = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
+
+	// SSL enabled protocols to use
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+	sslProtocols = "TLSv1 TLSv1.1 TLSv1.2"
+
+	// Time during which a client may reuse the session parameters stored in a cache.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout
+	sslSessionTimeout = "10m"
+
+	// Size of the SSL shared cache between all worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	sslSessionCacheSize = "10m"
+
+	// Default setting for load balancer algorithm
+	defaultLoadBalancerAlgorithm = "least_conn"
+
+	// Parameters for a shared memory zone that will keep states for various keys.
+	// http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html#limit_conn_zone
+	defaultLimitConnZoneVariable = "$binary_remote_addr"
+)
+
+// Configuration represents the content of nginx.conf file
+type Configuration struct {
+	defaults.Backend `json:",squash"`
+
+	// Sets the name of the configmap that contains the headers to pass to the client
+	AddHeaders string `json:"add-headers,omitempty"`
+
+	// AllowBackendServerHeader enables the return of the header Server from the backend
+	// instead of the generic nginx string.
+	// http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header
+	// By default this is disabled
+	AllowBackendServerHeader bool `json:"allow-backend-server-header"`
+
+	// EnableDynamicTLSRecords enables dynamic TLS record sizes
+	// https://blog.cloudflare.com/optimizing-tls-over-tcp-to-reduce-latency
+	// By default this is enabled
+	EnableDynamicTLSRecords bool `json:"enable-dynamic-tls-records"`
+
+	// ClientHeaderBufferSize allows to configure a custom buffer
+	// size for reading client request header
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_header_buffer_size
+	ClientHeaderBufferSize string `json:"client-header-buffer-size"`
+
+	// Sets buffer size for reading client request body
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size
+	ClientBodyBufferSize string `json:"client-body-buffer-size,omitempty"`
+
+	// DisableAccessLog disables the Access Log globally from NGINX ingress controller
+	//http://nginx.org/en/docs/http/ngx_http_log_module.html
+	DisableAccessLog bool `json:"disable-access-log,omitempty"`
+
+	// DisableIpv6 disable listening on ipv6 address
+	DisableIpv6 bool `json:"disable-ipv6,omitempty"`
+
+	// EnableUnderscoresInHeaders enables underscores in header names
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers
+	// By default this is disabled
+	EnableUnderscoresInHeaders bool `json:"enable-underscores-in-headers"`
+
+	// IgnoreInvalidHeaders set if header fields with invalid names should be ignored
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#ignore_invalid_headers
+	// By default this is enabled
+	IgnoreInvalidHeaders bool `json:"ignore-invalid-headers"`
+
+	// EnableVtsStatus allows the replacement of the default status page with a third party module named
+	// nginx-module-vts - https://github.com/vozlt/nginx-module-vts
+	// By default this is disabled
+	EnableVtsStatus bool `json:"enable-vts-status,omitempty"`
+
+	VtsStatusZoneSize string `json:"vts-status-zone-size,omitempty"`
+
+	// RetryNonIdempotent since 1.9.13 NGINX will not retry non-idempotent requests (POST, LOCK, PATCH)
+	// in case of an error. The previous behavior can be restored using the value true
+	RetryNonIdempotent bool `json:"retry-non-idempotent"`
+
+	// http://nginx.org/en/docs/ngx_core_module.html#error_log
+	// Configures logging level [debug | info | notice | warn | error | crit | alert | emerg]
+	// Log levels above are listed in the order of increasing severity
+	ErrorLogLevel string `json:"error-log-level,omitempty"`
+
+	// https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_field_size
+	// HTTP2MaxFieldSize Limits the maximum size of an HPACK-compressed request header field
+	HTTP2MaxFieldSize string `json:"http2-max-field-size,omitempty"`
+
+	// https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_header_size
+	// HTTP2MaxHeaderSize Limits the maximum size of the entire request header list after HPACK decompression
+	HTTP2MaxHeaderSize string `json:"http2-max-header-size,omitempty"`
+
+	// Enables or disables the header HSTS in servers running SSL
+	HSTS bool `json:"hsts,omitempty"`
+
+	// Enables or disables the use of HSTS in all the subdomains of the servername
+	// Default: true
+	HSTSIncludeSubdomains bool `json:"hsts-include-subdomains,omitempty"`
+
+	// HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature (HTTP header)
+	// that tell browsers that it should only be communicated with using HTTPS, instead of using HTTP.
+	// https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
+	// max-age is the time, in seconds, that the browser should remember that this site is only to be
+	// accessed using HTTPS.
+	HSTSMaxAge string `json:"hsts-max-age,omitempty"`
+
+	// Enables or disables the preload attribute in HSTS feature
+	HSTSPreload bool `json:"hsts-preload,omitempty"`
+
+	// Time during which a keep-alive client connection will stay open on the server side.
+	// The zero value disables keep-alive client connections
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout
+	KeepAlive int `json:"keep-alive,omitempty"`
+
+	// Sets the maximum number of requests that can be served through one keep-alive connection.
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests
+	KeepAliveRequests int `json:"keep-alive-requests,omitempty"`
+
+	// LargeClientHeaderBuffers Sets the maximum number and size of buffers used for reading
+	// large client request header.
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
+	// Default: 4 8k
+	LargeClientHeaderBuffers string `json:"large-client-header-buffers"`
+
+	// Enable json escaping
+	// http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format
+	LogFormatEscapeJSON bool `json:"log-format-escape-json,omitempty"`
+
+	// Customize upstream log_format
+	// http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format
+	LogFormatUpstream string `json:"log-format-upstream,omitempty"`
+
+	// Customize stream log_format
+	// http://nginx.org/en/docs/http/ngx_http_log_module.html#log_format
+	LogFormatStream string `json:"log-format-stream,omitempty"`
+
+	// Maximum number of simultaneous connections that can be opened by each worker process
+	// http://nginx.org/en/docs/ngx_core_module.html#worker_connections
+	MaxWorkerConnections int `json:"max-worker-connections,omitempty"`
+
+	// Sets the bucket size for the map variables hash tables.
+	// Default value depends on the processor’s cache line size.
+	// http://nginx.org/en/docs/http/ngx_http_map_module.html#map_hash_bucket_size
+	MapHashBucketSize int `json:"map-hash-bucket-size,omitempty"`
+
+	// If UseProxyProtocol is enabled ProxyRealIPCIDR defines the default the IP/network address
+	// of your external load balancer
+	ProxyRealIPCIDR []string `json:"proxy-real-ip-cidr,omitempty"`
+
+	// Sets the name of the configmap that contains the headers to pass to the backend
+	ProxySetHeaders string `json:"proxy-set-headers,omitempty"`
+
+	// Maximum size of the server names hash tables used in server names, map directive’s values,
+	// MIME types, names of request header strings, etcd.
+	// http://nginx.org/en/docs/hash.html
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_max_size
+	ServerNameHashMaxSize int `json:"server-name-hash-max-size,omitempty"`
+
+	// Size of the bucket for the server names hash tables
+	// http://nginx.org/en/docs/hash.html
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#server_names_hash_bucket_size
+	ServerNameHashBucketSize int `json:"server-name-hash-bucket-size,omitempty"`
+
+	// Size of the bucket for the proxy headers hash tables
+	// http://nginx.org/en/docs/hash.html
+	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_max_size
+	ProxyHeadersHashMaxSize int `json:"proxy-headers-hash-max-size,omitempty"`
+
+	// Maximum size of the bucket for the proxy headers hash tables
+	// http://nginx.org/en/docs/hash.html
+	// https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_headers_hash_bucket_size
+	ProxyHeadersHashBucketSize int `json:"proxy-headers-hash-bucket-size,omitempty"`
+
+	// Enables or disables emitting nginx version in error messages and in the “Server” response header field.
+	// http://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens
+	// Default: true
+	ShowServerTokens bool `json:"server-tokens"`
+
+	// Enabled ciphers list to enabled. The ciphers are specified in the format understood by
+	// the OpenSSL library
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers
+	SSLCiphers string `json:"ssl-ciphers,omitempty"`
+
+	// Specifies a curve for ECDHE ciphers.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve
+	SSLECDHCurve string `json:"ssl-ecdh-curve,omitempty"`
+
+	// The secret that contains Diffie-Hellman key to help with "Perfect Forward Secrecy"
+	// https://www.openssl.org/docs/manmaster/apps/dhparam.html
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#DHE_handshake_and_dhparam
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
+	SSLDHParam string `json:"ssl-dh-param,omitempty"`
+
+	// SSL enabled protocols to use
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
+	SSLProtocols string `json:"ssl-protocols,omitempty"`
+
+	// Enables or disables the use of shared SSL cache among worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	SSLSessionCache bool `json:"ssl-session-cache,omitempty"`
+
+	// Size of the SSL shared cache between all worker processes.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
+	SSLSessionCacheSize string `json:"ssl-session-cache-size,omitempty"`
+
+	// Enables or disables session resumption through TLS session tickets.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
+	SSLSessionTickets bool `json:"ssl-session-tickets,omitempty"`
+
+	// Time during which a client may reuse the session parameters stored in a cache.
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_timeout
+	SSLSessionTimeout string `json:"ssl-session-timeout,omitempty"`
+
+	// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
+	// Sets the size of the buffer used for sending data.
+	// 4k helps NGINX to improve TLS Time To First Byte (TTTFB)
+	// https://www.igvita.com/2013/12/16/optimizing-nginx-tls-time-to-first-byte/
+	SSLBufferSize string `json:"ssl-buffer-size,omitempty"`
+
+	// Enables or disables the use of the PROXY protocol to receive client connection
+	// (real IP address) information passed through proxy servers and load balancers
+	// such as HAproxy and Amazon Elastic Load Balancer (ELB).
+	// https://www.nginx.com/resources/admin-guide/proxy-protocol/
+	UseProxyProtocol bool `json:"use-proxy-protocol,omitempty"`
+
+	// Enables or disables the use of the nginx module that compresses responses using the "gzip" method
+	// http://nginx.org/en/docs/http/ngx_http_gzip_module.html
+	UseGzip bool `json:"use-gzip,omitempty"`
+
+	// Enables or disables the HTTP/2 support in secure connections
+	// http://nginx.org/en/docs/http/ngx_http_v2_module.html
+	// Default: true
+	UseHTTP2 bool `json:"use-http2,omitempty"`
+
+	// MIME types in addition to "text/html" to compress. The special value “*” matches any MIME type.
+	// Responses with the “text/html” type are always compressed if UseGzip is enabled
+	GzipTypes string `json:"gzip-types,omitempty"`
+
+	// Defines the number of worker processes. By default auto means number of available CPU cores
+	// http://nginx.org/en/docs/ngx_core_module.html#worker_processes
+	WorkerProcesses string `json:"worker-processes,omitempty"`
+
+	// Defines the load balancing algorithm to use. The deault is round-robin
+	LoadBalanceAlgorithm string `json:"load-balance,omitempty"`
+
+	// Sets the bucket size for the variables hash table.
+	// http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_bucket_size
+	VariablesHashBucketSize int `json:"variables-hash-bucket-size,omitempty"`
+
+	// Sets the maximum size of the variables hash table.
+	// http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_max_size
+	VariablesHashMaxSize int `json:"variables-hash-max-size,omitempty"`
+
+	// Activates the cache for connections to upstream servers.
+	// The connections parameter sets the maximum number of idle keepalive connections to
+	// upstream servers that are preserved in the cache of each worker process. When this
+	// number is exceeded, the least recently used connections are closed.
+	// http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive
+	// Default: 0 (disabled)
+	UpstreamKeepaliveConnections int `json:"upstream-keepalive-connections,omitempty"`
+
+	// Sets the maximum size of the variables hash table.
+	// http://nginx.org/en/docs/http/ngx_http_map_module.html#variables_hash_max_size
+	LimitConnZoneVariable string `json:"limit-conn-zone-variable,omitempty"`
+}
+
+// NewDefault returns the default nginx configuration
+func NewDefault() Configuration {
+	defIPCIDR := make([]string, 0)
+	defIPCIDR = append(defIPCIDR, "0.0.0.0/0")
+	cfg := Configuration{
+		AllowBackendServerHeader:   false,
+		ClientHeaderBufferSize:     "1k",
+		ClientBodyBufferSize:       "8k",
+		EnableDynamicTLSRecords:    true,
+		EnableUnderscoresInHeaders: false,
+		ErrorLogLevel:              errorLevel,
+		HTTP2MaxFieldSize:          "4k",
+		HTTP2MaxHeaderSize:         "16k",
+		HSTS:                       true,
+		HSTSIncludeSubdomains:      true,
+		HSTSMaxAge:                 hstsMaxAge,
+		HSTSPreload:                false,
+		IgnoreInvalidHeaders:       true,
+		GzipTypes:                  gzipTypes,
+		KeepAlive:                  75,
+		KeepAliveRequests:          100,
+		LargeClientHeaderBuffers:   "4 8k",
+		LogFormatEscapeJSON:        false,
+		LogFormatStream:            logFormatStream,
+		LogFormatUpstream:          logFormatUpstream,
+		MaxWorkerConnections:       16384,
+		MapHashBucketSize:          64,
+		ProxyRealIPCIDR:            defIPCIDR,
+		ServerNameHashMaxSize:      1024,
+		ProxyHeadersHashMaxSize:    512,
+		ProxyHeadersHashBucketSize: 64,
+		ShowServerTokens:           true,
+		SSLBufferSize:              sslBufferSize,
+		SSLCiphers:                 sslCiphers,
+		SSLECDHCurve:               "secp384r1",
+		SSLProtocols:               sslProtocols,
+		SSLSessionCache:            true,
+		SSLSessionCacheSize:        sslSessionCacheSize,
+		SSLSessionTickets:          true,
+		SSLSessionTimeout:          sslSessionTimeout,
+		UseGzip:                    true,
+		WorkerProcesses:            strconv.Itoa(runtime.NumCPU()),
+		LoadBalanceAlgorithm:       defaultLoadBalancerAlgorithm,
+		VtsStatusZoneSize:          "10m",
+		VariablesHashBucketSize:    64,
+		VariablesHashMaxSize:       2048,
+		UseHTTP2:                   true,
+		Backend: defaults.Backend{
+			ProxyBodySize:        bodySize,
+			ProxyConnectTimeout:  5,
+			ProxyReadTimeout:     60,
+			ProxySendTimeout:     60,
+			ProxyBufferSize:      "4k",
+			ProxyCookieDomain:    "off",
+			ProxyCookiePath:      "off",
+			ProxyNextUpstream:    "error timeout invalid_header http_502 http_503 http_504",
+			SSLRedirect:          true,
+			CustomHTTPErrors:     []int{},
+			WhitelistSourceRange: []string{},
+			SkipAccessLogURLs:    []string{},
+		},
+		UpstreamKeepaliveConnections: 0,
+		LimitConnZoneVariable:        defaultLimitConnZoneVariable,
+	}
+
+	if glog.V(5) {
+		cfg.ErrorLogLevel = "debug"
+	}
+
+	return cfg
+}
+
+// BuildLogFormatUpstream format the log_format upstream using
+// proxy_protocol_addr as remote client address if UseProxyProtocol
+// is enabled.
+func (cfg Configuration) BuildLogFormatUpstream() string {
+	if cfg.LogFormatUpstream == logFormatUpstream {
+		return fmt.Sprintf(cfg.LogFormatUpstream, "$the_real_ip")
+	}
+
+	return cfg.LogFormatUpstream
+}
+
+// TemplateConfig contains the nginx configuration to render the file nginx.conf
+type TemplateConfig struct {
+	ProxySetHeaders     map[string]string
+	AddHeaders          map[string]string
+	MaxOpenFiles        int
+	BacklogSize         int
+	Backends            []*ingress.Backend
+	PassthroughBackends []*ingress.SSLPassthroughBackend
+	Servers             []*ingress.Server
+	TCPBackends         []ingress.L4Service
+	UDPBackends         []ingress.L4Service
+	CustomErrors        bool
+	//	HealthzURI          string
+	Cfg           Configuration
+	IsIPV6Enabled bool
+}

controllers/ext_nginx/pkg/config/config_test.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"fmt"
+	"testing"
+)
+
+func TestBuildLogFormatUpstream(t *testing.T) {
+
+	testCases := []struct {
+		useProxyProtocol bool // use proxy protocol
+		curLogFormat     string
+		expected         string
+	}{
+		{true, logFormatUpstream, fmt.Sprintf(logFormatUpstream, "$the_real_ip")},
+		{false, logFormatUpstream, fmt.Sprintf(logFormatUpstream, "$the_real_ip")},
+		{true, "my-log-format", "my-log-format"},
+		{false, "john-log-format", "john-log-format"},
+	}
+
+	for _, testCase := range testCases {
+		cfg := NewDefault()
+		cfg.UseProxyProtocol = testCase.useProxyProtocol
+		cfg.LogFormatUpstream = testCase.curLogFormat
+		result := cfg.BuildLogFormatUpstream()
+		if result != testCase.expected {
+			t.Errorf(" expected %v but return %v", testCase.expected, result)
+		}
+	}
+}

controllers/ext_nginx/pkg/template/configmap.go

@@ -0,0 +1,113 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/golang/glog"
+	"github.com/mitchellh/mapstructure"
+
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+)
+
+const (
+	customHTTPErrors     = "custom-http-errors"
+	skipAccessLogUrls    = "skip-access-log-urls"
+	whitelistSourceRange = "whitelist-source-range"
+	proxyRealIPCIDR      = "proxy-real-ip-cidr"
+)
+
+// ReadConfig obtains the configuration defined by the user merged with the defaults.
+func ReadConfig(src map[string]string) config.Configuration {
+	conf := map[string]string{}
+	if src != nil {
+		// we need to copy the configmap data because the content is altered
+		for k, v := range src {
+			conf[k] = v
+		}
+	}
+
+	errors := make([]int, 0)
+	skipUrls := make([]string, 0)
+	whitelist := make([]string, 0)
+	proxylist := make([]string, 0)
+
+	if val, ok := conf[customHTTPErrors]; ok {
+		delete(conf, customHTTPErrors)
+		for _, i := range strings.Split(val, ",") {
+			j, err := strconv.Atoi(i)
+			if err != nil {
+				glog.Warningf("%v is not a valid http code: %v", i, err)
+			} else {
+				errors = append(errors, j)
+			}
+		}
+	}
+	if val, ok := conf[skipAccessLogUrls]; ok {
+		delete(conf, skipAccessLogUrls)
+		skipUrls = strings.Split(val, ",")
+	}
+	if val, ok := conf[whitelistSourceRange]; ok {
+		delete(conf, whitelistSourceRange)
+		whitelist = append(whitelist, strings.Split(val, ",")...)
+	}
+	if val, ok := conf[proxyRealIPCIDR]; ok {
+		delete(conf, proxyRealIPCIDR)
+		proxylist = append(proxylist, strings.Split(val, ",")...)
+	} else {
+		proxylist = append(proxylist, "0.0.0.0/0")
+	}
+
+	to := config.NewDefault()
+	to.CustomHTTPErrors = filterErrors(errors)
+	to.SkipAccessLogURLs = skipUrls
+	to.WhitelistSourceRange = whitelist
+	to.ProxyRealIPCIDR = proxylist
+
+	config := &mapstructure.DecoderConfig{
+		Metadata:         nil,
+		WeaklyTypedInput: true,
+		Result:           &to,
+		TagName:          "json",
+	}
+
+	decoder, err := mapstructure.NewDecoder(config)
+	if err != nil {
+		glog.Warningf("unexpected error merging defaults: %v", err)
+	}
+	err = decoder.Decode(conf)
+	if err != nil {
+		glog.Warningf("unexpected error merging defaults: %v", err)
+	}
+
+	return to
+}
+
+func filterErrors(codes []int) []int {
+	var fa []int
+	for _, code := range codes {
+		if code > 299 && code < 600 {
+			fa = append(fa, code)
+		} else {
+			glog.Warningf("error code %v is not valid for custom error pages", code)
+		}
+	}
+
+	return fa
+}

controllers/ext_nginx/pkg/template/configmap_test.go

@@ -0,0 +1,86 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"testing"
+
+	"github.com/kylelemons/godebug/pretty"
+
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+)
+
+func TestFilterErrors(t *testing.T) {
+	e := filterErrors([]int{200, 300, 345, 500, 555, 999})
+	if len(e) != 4 {
+		t.Errorf("expected 4 elements but %v returned", len(e))
+	}
+}
+
+func TestMergeConfigMapToStruct(t *testing.T) {
+	conf := map[string]string{
+		"custom-http-errors":         "300,400,demo",
+		"proxy-read-timeout":         "1",
+		"proxy-send-timeout":         "2",
+		"skip-access-log-urls":       "/log,/demo,/test",
+		"use-proxy-protocol":         "true",
+		"disable-access-log":         "true",
+		"use-gzip":                   "true",
+		"enable-dynamic-tls-records": "false",
+		"gzip-types":                 "text/html",
+		"proxy-real-ip-cidr":         "1.1.1.1/8,2.2.2.2/24",
+	}
+	def := config.NewDefault()
+	def.CustomHTTPErrors = []int{300, 400}
+	def.DisableAccessLog = true
+	def.SkipAccessLogURLs = []string{"/log", "/demo", "/test"}
+	def.ProxyReadTimeout = 1
+	def.ProxySendTimeout = 2
+	def.EnableDynamicTLSRecords = false
+	def.UseProxyProtocol = true
+	def.GzipTypes = "text/html"
+	def.ProxyRealIPCIDR = []string{"1.1.1.1/8", "2.2.2.2/24"}
+
+	to := ReadConfig(conf)
+	if diff := pretty.Compare(to, def); diff != "" {
+		t.Errorf("unexpected diff: (-got +want)\n%s", diff)
+	}
+
+	def = config.NewDefault()
+	to = ReadConfig(map[string]string{})
+	if diff := pretty.Compare(to, def); diff != "" {
+		t.Errorf("unexpected diff: (-got +want)\n%s", diff)
+	}
+
+	def = config.NewDefault()
+	def.WhitelistSourceRange = []string{"1.1.1.1/32"}
+	to = ReadConfig(map[string]string{
+		"whitelist-source-range": "1.1.1.1/32",
+	})
+
+	if diff := pretty.Compare(to, def); diff != "" {
+		t.Errorf("unexpected diff: (-got +want)\n%s", diff)
+	}
+}
+
+func TestDefaultLoadBalance(t *testing.T) {
+	conf := map[string]string{}
+	to := ReadConfig(conf)
+	if to.LoadBalanceAlgorithm != "least_conn" {
+		t.Errorf("default load balance algorithm wrong")
+	}
+}

controllers/ext_nginx/pkg/template/template.go

@@ -0,0 +1,473 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"strings"
+	text_template "text/template"
+
+	"k8s.io/apimachinery/pkg/util/sets"
+
+	"github.com/golang/glog"
+
+	"github.com/pborman/uuid"
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+	"k8s.io/ingress/core/pkg/ingress"
+	ing_net "k8s.io/ingress/core/pkg/net"
+	"k8s.io/ingress/core/pkg/watch"
+)
+
+const (
+	slash         = "/"
+	defBufferSize = 65535
+)
+
+// Template ...
+type Template struct {
+	tmpl      *text_template.Template
+	fw        watch.FileWatcher
+	s         int
+	tmplBuf   *bytes.Buffer
+	outCmdBuf *bytes.Buffer
+}
+
+//NewTemplate returns a new Template instance or an
+//error if the specified template file contains errors
+func NewTemplate(file string, onChange func()) (*Template, error) {
+	tmpl, err := text_template.New("nginx.tmpl").Funcs(funcMap).ParseFiles(file)
+	if err != nil {
+		return nil, err
+	}
+	fw, err := watch.NewFileWatcher(file, onChange)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Template{
+		tmpl:      tmpl,
+		fw:        fw,
+		s:         defBufferSize,
+		tmplBuf:   bytes.NewBuffer(make([]byte, 0, defBufferSize)),
+		outCmdBuf: bytes.NewBuffer(make([]byte, 0, defBufferSize)),
+	}, nil
+}
+
+// Close removes the file watcher
+func (t *Template) Close() {
+	t.fw.Close()
+}
+
+// Write populates a buffer using a template with NGINX configuration
+// and the servers and upstreams created by Ingress rules
+func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) {
+	defer t.tmplBuf.Reset()
+	defer t.outCmdBuf.Reset()
+
+	defer func() {
+		if t.s < t.tmplBuf.Cap() {
+			glog.V(2).Infof("adjusting template buffer size from %v to %v", t.s, t.tmplBuf.Cap())
+			t.s = t.tmplBuf.Cap()
+			t.tmplBuf = bytes.NewBuffer(make([]byte, 0, t.tmplBuf.Cap()))
+			t.outCmdBuf = bytes.NewBuffer(make([]byte, 0, t.outCmdBuf.Cap()))
+		}
+	}()
+
+	if glog.V(3) {
+		b, err := json.Marshal(conf)
+		if err != nil {
+			glog.Errorf("unexpected error: %v", err)
+		}
+		glog.Infof("NGINX configuration: %v", string(b))
+	}
+
+	err := t.tmpl.Execute(t.tmplBuf, conf)
+	if err != nil {
+		return nil, err
+	}
+
+	// squeezes multiple adjacent empty lines to be single
+	// spaced this is to avoid the use of regular expressions
+	cmd := exec.Command("/ingress-controller/clean-nginx-conf.sh")
+	cmd.Stdin = t.tmplBuf
+	cmd.Stdout = t.outCmdBuf
+	if err := cmd.Run(); err != nil {
+		glog.Warningf("unexpected error cleaning template: %v", err)
+		return t.tmplBuf.Bytes(), nil
+	}
+
+	return t.outCmdBuf.Bytes(), nil
+}
+
+var (
+	funcMap = text_template.FuncMap{
+		"empty": func(input interface{}) bool {
+			check, ok := input.(string)
+			if ok {
+				return len(check) == 0
+			}
+			return true
+		},
+		"buildLocation":            buildLocation,
+		"buildAuthLocation":        buildAuthLocation,
+		"buildAuthResponseHeaders": buildAuthResponseHeaders,
+		"buildProxyPass":           buildProxyPass,
+		"buildRateLimitZones":      buildRateLimitZones,
+		"buildRateLimit":           buildRateLimit,
+		"buildResolvers":           buildResolvers,
+		"buildUpstreamName":        buildUpstreamName,
+		"isLocationAllowed":        isLocationAllowed,
+		"buildLogFormatUpstream":   buildLogFormatUpstream,
+		"buildDenyVariable":        buildDenyVariable,
+		"getenv":                   os.Getenv,
+		"contains":                 strings.Contains,
+		"hasPrefix":                strings.HasPrefix,
+		"hasSuffix":                strings.HasSuffix,
+		"toUpper":                  strings.ToUpper,
+		"toLower":                  strings.ToLower,
+		"formatIP":                 formatIP,
+		"buildNextUpstream":        buildNextUpstream,
+	}
+)
+
+// fomatIP will wrap IPv6 addresses in [] and return IPv4 addresses
+// without modification. If the input cannot be parsed as an IP address
+// it is returned without modification.
+func formatIP(input string) string {
+	ip := net.ParseIP(input)
+	if ip == nil {
+		return input
+	}
+	if v4 := ip.To4(); v4 != nil {
+		return input
+	}
+	return fmt.Sprintf("[%s]", input)
+}
+
+// buildResolvers returns the resolvers reading the /etc/resolv.conf file
+func buildResolvers(a interface{}) string {
+	// NGINX need IPV6 addresses to be surrounded by brakets
+	nss := a.([]net.IP)
+	if len(nss) == 0 {
+		return ""
+	}
+
+	r := []string{"resolver"}
+	for _, ns := range nss {
+		if ing_net.IsIPV6(ns) {
+			r = append(r, fmt.Sprintf("[%v]", ns))
+		} else {
+			r = append(r, fmt.Sprintf("%v", ns))
+		}
+	}
+	r = append(r, "valid=30s;")
+
+	return strings.Join(r, " ")
+}
+
+// buildLocation produces the location string, if the ingress has redirects
+// (specified through the ingress.kubernetes.io/rewrite-to annotation)
+func buildLocation(input interface{}) string {
+	location, ok := input.(*ingress.Location)
+	if !ok {
+		return slash
+	}
+
+	path := location.Path
+	if len(location.Redirect.Target) > 0 && location.Redirect.Target != path {
+		if path == slash {
+			return fmt.Sprintf("~* %s", path)
+		}
+		// baseuri regex will parse basename from the given location
+		baseuri := `(?<baseuri>.*)`
+		if !strings.HasSuffix(path, slash) {
+			// Not treat the slash after "location path" as a part of baseuri
+			baseuri = fmt.Sprintf(`\/?%s`, baseuri)
+		}
+		return fmt.Sprintf(`~* ^%s%s`, path, baseuri)
+	}
+
+	return path
+}
+
+func buildAuthLocation(input interface{}) string {
+	location, ok := input.(*ingress.Location)
+	if !ok {
+		return ""
+	}
+
+	if location.ExternalAuth.URL == "" {
+		return ""
+	}
+
+	str := base64.URLEncoding.EncodeToString([]byte(location.Path))
+	// avoid locations containing the = char
+	str = strings.Replace(str, "=", "", -1)
+	return fmt.Sprintf("/_external-auth-%v", str)
+}
+
+func buildAuthResponseHeaders(input interface{}) []string {
+	location, ok := input.(*ingress.Location)
+	res := []string{}
+	if !ok {
+		return res
+	}
+
+	if len(location.ExternalAuth.ResponseHeaders) == 0 {
+		return res
+	}
+
+	for i, h := range location.ExternalAuth.ResponseHeaders {
+		hvar := strings.ToLower(h)
+		hvar = strings.NewReplacer("-", "_").Replace(hvar)
+		res = append(res, fmt.Sprintf("auth_request_set $authHeader%v $upstream_http_%v;", i, hvar))
+		res = append(res, fmt.Sprintf("proxy_set_header '%v' $authHeader%v;", h, i))
+	}
+	return res
+}
+
+func buildLogFormatUpstream(input interface{}) string {
+	cfg, ok := input.(config.Configuration)
+	if !ok {
+		glog.Errorf("error  an ingress.buildLogFormatUpstream type but %T was returned", input)
+	}
+
+	return cfg.BuildLogFormatUpstream()
+}
+
+// buildProxyPass produces the proxy pass string, if the ingress has redirects
+// (specified through the ingress.kubernetes.io/rewrite-to annotation)
+// If the annotation ingress.kubernetes.io/add-base-url:"true" is specified it will
+// add a base tag in the head of the response from the service
+func buildProxyPass(host string, b interface{}, loc interface{}) string {
+	backends := b.([]*ingress.Backend)
+	location, ok := loc.(*ingress.Location)
+	if !ok {
+		return ""
+	}
+
+	path := location.Path
+	proto := "http"
+
+	upstreamName := location.Backend
+	for _, backend := range backends {
+		if backend.Name == location.Backend {
+			if backend.Secure || backend.SSLPassthrough {
+				proto = "https"
+			}
+
+			if isSticky(host, location, backend.SessionAffinity.CookieSessionAffinity.Locations) {
+				upstreamName = fmt.Sprintf("sticky-%v", upstreamName)
+			}
+
+			break
+		}
+	}
+
+	// defProxyPass returns the default proxy_pass, just the name of the upstream
+	defProxyPass := fmt.Sprintf("proxy_pass %s://%s;", proto, upstreamName)
+	// if the path in the ingress rule is equals to the target: no special rewrite
+	if path == location.Redirect.Target {
+		return defProxyPass
+	}
+
+	if path != slash && !strings.HasSuffix(path, slash) {
+		path = fmt.Sprintf("%s/", path)
+	}
+
+	if len(location.Redirect.Target) > 0 {
+		abu := ""
+		if location.Redirect.AddBaseURL {
+			// path has a slash suffix, so that it can be connected with baseuri directly
+			bPath := fmt.Sprintf("%s%s", path, "$baseuri")
+			abu = fmt.Sprintf(`subs_filter '<head(.*)>' '<head$1><base href="$scheme://$http_host%v">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$http_host%v">' r;
+	`, bPath, bPath)
+		}
+
+		if location.Redirect.Target == slash {
+			// special case redirect to /
+			// ie /something to /
+			return fmt.Sprintf(`
+	rewrite %s(.*) /$1 break;
+	rewrite %s / break;
+	proxy_pass %s://%s;
+	%v`, path, location.Path, proto, location.Backend, abu)
+		}
+
+		return fmt.Sprintf(`
+	rewrite %s(.*) %s/$1 break;
+	proxy_pass %s://%s;
+	%v`, path, location.Redirect.Target, proto, location.Backend, abu)
+	}
+
+	// default proxy_pass
+	return defProxyPass
+}
+
+// buildRateLimitZones produces an array of limit_conn_zone in order to allow
+// rate limiting of request. Each Ingress rule could have up to two zones, one
+// for connection limit by IP address and other for limiting request per second
+func buildRateLimitZones(variable string, input interface{}) []string {
+	zones := sets.String{}
+
+	servers, ok := input.([]*ingress.Server)
+	if !ok {
+		return zones.List()
+	}
+
+	for _, server := range servers {
+		for _, loc := range server.Locations {
+
+			if loc.RateLimit.Connections.Limit > 0 {
+				zone := fmt.Sprintf("limit_conn_zone %v zone=%v:%vm;",
+					variable,
+					loc.RateLimit.Connections.Name,
+					loc.RateLimit.Connections.SharedSize)
+				if !zones.Has(zone) {
+					zones.Insert(zone)
+				}
+			}
+
+			if loc.RateLimit.RPS.Limit > 0 {
+				zone := fmt.Sprintf("limit_req_zone %v zone=%v:%vm rate=%vr/s;",
+					variable,
+					loc.RateLimit.RPS.Name,
+					loc.RateLimit.RPS.SharedSize,
+					loc.RateLimit.RPS.Limit)
+				if !zones.Has(zone) {
+					zones.Insert(zone)
+				}
+			}
+		}
+	}
+
+	return zones.List()
+}
+
+// buildRateLimit produces an array of limit_req to be used inside the Path of
+// Ingress rules. The order: connections by IP first and RPS next.
+func buildRateLimit(input interface{}) []string {
+	limits := []string{}
+
+	loc, ok := input.(*ingress.Location)
+	if !ok {
+		return limits
+	}
+
+	if loc.RateLimit.Connections.Limit > 0 {
+		limit := fmt.Sprintf("limit_conn %v %v;",
+			loc.RateLimit.Connections.Name, loc.RateLimit.Connections.Limit)
+		limits = append(limits, limit)
+	}
+
+	if loc.RateLimit.RPS.Limit > 0 {
+		limit := fmt.Sprintf("limit_req zone=%v burst=%v nodelay;",
+			loc.RateLimit.RPS.Name, loc.RateLimit.RPS.Burst)
+		limits = append(limits, limit)
+	}
+
+	return limits
+}
+
+func isLocationAllowed(input interface{}) bool {
+	loc, ok := input.(*ingress.Location)
+	if !ok {
+		glog.Errorf("expected an ingress.Location type but %T was returned", input)
+		return false
+	}
+
+	return loc.Denied == nil
+}
+
+var (
+	denyPathSlugMap = map[string]string{}
+)
+
+// buildDenyVariable returns a nginx variable for a location in a
+// server to be used in the whitelist check
+// This method uses a unique id generator library to reduce the
+// size of the string to be used as a variable in nginx to avoid
+// issue with the size of the variable bucket size directive
+func buildDenyVariable(a interface{}) string {
+	l := a.(string)
+
+	if _, ok := denyPathSlugMap[l]; !ok {
+		denyPathSlugMap[l] = uuid.New()
+	}
+
+	return fmt.Sprintf("$deny_%v", denyPathSlugMap[l])
+}
+
+func buildUpstreamName(host string, b interface{}, loc interface{}) string {
+	backends := b.([]*ingress.Backend)
+	location, ok := loc.(*ingress.Location)
+	if !ok {
+		return ""
+	}
+
+	upstreamName := location.Backend
+
+	for _, backend := range backends {
+		if backend.Name == location.Backend {
+			if backend.SessionAffinity.AffinityType == "cookie" &&
+				isSticky(host, location, backend.SessionAffinity.CookieSessionAffinity.Locations) {
+				upstreamName = fmt.Sprintf("sticky-%v", upstreamName)
+			}
+
+			break
+		}
+	}
+
+	return upstreamName
+}
+
+func isSticky(host string, loc *ingress.Location, stickyLocations map[string][]string) bool {
+	if _, ok := stickyLocations[host]; ok {
+		for _, sl := range stickyLocations[host] {
+			if sl == loc.Path {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+func buildNextUpstream(input interface{}) string {
+	nextUpstream, ok := input.(string)
+	if !ok {
+		glog.Errorf("expected an string type but %T was returned", input)
+	}
+
+	parts := strings.Split(nextUpstream, " ")
+
+	nextUpstreamCodes := make([]string, 0, len(parts))
+	for _, v := range parts {
+		if v != "" && v != "non_idempotent" {
+			nextUpstreamCodes = append(nextUpstreamCodes, v)
+		}
+	}
+
+	return strings.Join(nextUpstreamCodes, " ")
+}

controllers/ext_nginx/pkg/template/template_test.go

@@ -0,0 +1,227 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package template
+
+import (
+	"encoding/json"
+	"os"
+	"path"
+	"reflect"
+	"strings"
+	"testing"
+
+	"io/ioutil"
+
+	"k8s.io/ingress/controllers/nginx/pkg/config"
+	"k8s.io/ingress/core/pkg/ingress"
+	"k8s.io/ingress/core/pkg/ingress/annotations/authreq"
+	"k8s.io/ingress/core/pkg/ingress/annotations/rewrite"
+)
+
+var (
+	// TODO: add tests for secure endpoints
+	tmplFuncTestcases = map[string]struct {
+		Path       string
+		Target     string
+		Location   string
+		ProxyPass  string
+		AddBaseURL bool
+	}{
+		"invalid redirect / to /": {"/", "/", "/", "proxy_pass http://upstream-name;", false},
+		"redirect / to /jenkins": {"/", "/jenkins", "~* /",
+			`
+	rewrite /(.*) /jenkins/$1 break;
+	proxy_pass http://upstream-name;
+	`, false},
+		"redirect /something to /": {"/something", "/", `~* ^/something\/?(?<baseuri>.*)`, `
+	rewrite /something/(.*) /$1 break;
+	rewrite /something / break;
+	proxy_pass http://upstream-name;
+	`, false},
+		"redirect /end-with-slash/ to /not-root": {"/end-with-slash/", "/not-root", "~* ^/end-with-slash/(?<baseuri>.*)", `
+	rewrite /end-with-slash/(.*) /not-root/$1 break;
+	proxy_pass http://upstream-name;
+	`, false},
+		"redirect /something-complex to /not-root": {"/something-complex", "/not-root", `~* ^/something-complex\/?(?<baseuri>.*)`, `
+	rewrite /something-complex/(.*) /not-root/$1 break;
+	proxy_pass http://upstream-name;
+	`, false},
+		"redirect / to /jenkins and rewrite": {"/", "/jenkins", "~* /", `
+	rewrite /(.*) /jenkins/$1 break;
+	proxy_pass http://upstream-name;
+	subs_filter '<head(.*)>' '<head$1><base href="$scheme://$http_host/$baseuri">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$http_host/$baseuri">' r;
+	`, true},
+		"redirect /something to / and rewrite": {"/something", "/", `~* ^/something\/?(?<baseuri>.*)`, `
+	rewrite /something/(.*) /$1 break;
+	rewrite /something / break;
+	proxy_pass http://upstream-name;
+	subs_filter '<head(.*)>' '<head$1><base href="$scheme://$http_host/something/$baseuri">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$http_host/something/$baseuri">' r;
+	`, true},
+		"redirect /end-with-slash/ to /not-root and rewrite": {"/end-with-slash/", "/not-root", `~* ^/end-with-slash/(?<baseuri>.*)`, `
+	rewrite /end-with-slash/(.*) /not-root/$1 break;
+	proxy_pass http://upstream-name;
+	subs_filter '<head(.*)>' '<head$1><base href="$scheme://$http_host/end-with-slash/$baseuri">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$http_host/end-with-slash/$baseuri">' r;
+	`, true},
+		"redirect /something-complex to /not-root and rewrite": {"/something-complex", "/not-root", `~* ^/something-complex\/?(?<baseuri>.*)`, `
+	rewrite /something-complex/(.*) /not-root/$1 break;
+	proxy_pass http://upstream-name;
+	subs_filter '<head(.*)>' '<head$1><base href="$scheme://$http_host/something-complex/$baseuri">' r;
+	subs_filter '<HEAD(.*)>' '<HEAD$1><base href="$scheme://$http_host/something-complex/$baseuri">' r;
+	`, true},
+	}
+)
+
+func TestFormatIP(t *testing.T) {
+	cases := map[string]struct {
+		Input, Output string
+	}{
+		"ipv4-localhost": {"127.0.0.1", "127.0.0.1"},
+		"ipv4-internet":  {"8.8.8.8", "8.8.8.8"},
+		"ipv6-localhost": {"::1", "[::1]"},
+		"ipv6-internet":  {"2001:4860:4860::8888", "[2001:4860:4860::8888]"},
+		"invalid-ip":     {"nonsense", "nonsense"},
+		"empty-ip":       {"", ""},
+	}
+	for k, tc := range cases {
+		res := formatIP(tc.Input)
+		if res != tc.Output {
+			t.Errorf("%s: called formatIp('%s'); expected '%v' but returned '%v'", k, tc.Input, tc.Output, res)
+		}
+	}
+}
+
+func TestBuildLocation(t *testing.T) {
+	for k, tc := range tmplFuncTestcases {
+		loc := &ingress.Location{
+			Path:     tc.Path,
+			Redirect: rewrite.Redirect{Target: tc.Target, AddBaseURL: tc.AddBaseURL},
+		}
+
+		newLoc := buildLocation(loc)
+		if tc.Location != newLoc {
+			t.Errorf("%s: expected '%v' but returned %v", k, tc.Location, newLoc)
+		}
+	}
+}
+
+func TestBuildProxyPass(t *testing.T) {
+	for k, tc := range tmplFuncTestcases {
+		loc := &ingress.Location{
+			Path:     tc.Path,
+			Redirect: rewrite.Redirect{Target: tc.Target, AddBaseURL: tc.AddBaseURL},
+			Backend:  "upstream-name",
+		}
+
+		pp := buildProxyPass("", []*ingress.Backend{}, loc)
+		if !strings.EqualFold(tc.ProxyPass, pp) {
+			t.Errorf("%s: expected \n'%v'\nbut returned \n'%v'", k, tc.ProxyPass, pp)
+		}
+	}
+}
+
+func TestBuildAuthResponseHeaders(t *testing.T) {
+	loc := &ingress.Location{
+		ExternalAuth: authreq.External{ResponseHeaders: []string{"h1", "H-With-Caps-And-Dashes"}},
+	}
+	headers := buildAuthResponseHeaders(loc)
+	expected := []string{
+		"auth_request_set $authHeader0 $upstream_http_h1;",
+		"proxy_set_header 'h1' $authHeader0;",
+		"auth_request_set $authHeader1 $upstream_http_h_with_caps_and_dashes;",
+		"proxy_set_header 'H-With-Caps-And-Dashes' $authHeader1;",
+	}
+
+	if !reflect.DeepEqual(expected, headers) {
+		t.Errorf("Expected \n'%v'\nbut returned \n'%v'", expected, headers)
+	}
+}
+
+func TestTemplateWithData(t *testing.T) {
+	pwd, _ := os.Getwd()
+	f, err := os.Open(path.Join(pwd, "../../test/data/config.json"))
+	if err != nil {
+		t.Errorf("unexpected error reading json file: %v", err)
+	}
+	defer f.Close()
+	data, err := ioutil.ReadFile(f.Name())
+	if err != nil {
+		t.Error("unexpected error reading json file: ", err)
+	}
+	var dat config.TemplateConfig
+	if err := json.Unmarshal(data, &dat); err != nil {
+		t.Errorf("unexpected error unmarshalling json: %v", err)
+	}
+
+	tf, err := os.Open(path.Join(pwd, "../../rootfs/etc/nginx/template/nginx.tmpl"))
+	if err != nil {
+		t.Errorf("unexpected error reading json file: %v", err)
+	}
+	defer tf.Close()
+
+	ngxTpl, err := NewTemplate(tf.Name(), func() {})
+	if err != nil {
+		t.Errorf("invalid NGINX template: %v", err)
+	}
+
+	_, err = ngxTpl.Write(dat)
+	if err != nil {
+		t.Errorf("invalid NGINX template: %v", err)
+	}
+}
+
+func BenchmarkTemplateWithData(b *testing.B) {
+	pwd, _ := os.Getwd()
+	f, err := os.Open(path.Join(pwd, "../../test/data/config.json"))
+	if err != nil {
+		b.Errorf("unexpected error reading json file: %v", err)
+	}
+	defer f.Close()
+	data, err := ioutil.ReadFile(f.Name())
+	if err != nil {
+		b.Error("unexpected error reading json file: ", err)
+	}
+	var dat config.TemplateConfig
+	if err := json.Unmarshal(data, &dat); err != nil {
+		b.Errorf("unexpected error unmarshalling json: %v", err)
+	}
+
+	tf, err := os.Open(path.Join(pwd, "../../rootfs/etc/nginx/template/nginx.tmpl"))
+	if err != nil {
+		b.Errorf("unexpected error reading json file: %v", err)
+	}
+	defer tf.Close()
+
+	ngxTpl, err := NewTemplate(tf.Name(), func() {})
+	if err != nil {
+		b.Errorf("invalid NGINX template: %v", err)
+	}
+
+	for i := 0; i < b.N; i++ {
+		ngxTpl.Write(dat)
+	}
+}
+
+func TestBuildDenyVariable(t *testing.T) {
+	a := buildDenyVariable("host1.example.com_/.well-known/acme-challenge")
+	b := buildDenyVariable("host1.example.com_/.well-known/acme-challenge")
+	if !reflect.DeepEqual(a, b) {
+		t.Errorf("Expected '%v' but returned '%v'", a, b)
+	}
+}

controllers/ext_nginx/pkg/version/version.go

@@ -0,0 +1,26 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package version
+
+var (
+	// RELEASE returns the release version
+	RELEASE = "UNKNOWN"
+	// REPO returns the git repository URL
+	REPO = "UNKNOWN"
+	// COMMIT returns the short sha from git
+	COMMIT = "UNKNOWN"
+)

controllers/ext_nginx/rootfs/Dockerfile

@@ -0,0 +1,32 @@
+# Copyright 2015 The Kubernetes Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM BASEIMAGE
+
+CROSS_BUILD_COPY qemu-QEMUARCH-static /usr/bin/
+
+RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y \
+  diffutils \
+  --no-install-recommends \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN curl -sSL -o /tmp/dumb-init.deb http://ftp.us.debian.org/debian/pool/main/d/dumb-init/dumb-init_1.2.0-1_DUMB_ARCH.deb && \
+  dpkg -i /tmp/dumb-init.deb && \
+  rm /tmp/dumb-init.deb
+
+ENTRYPOINT ["/usr/bin/dumb-init", "-v"]
+
+COPY . /
+
+CMD ["/nginx-ingress-controller"]

controllers/ext_nginx/rootfs/etc/nginx/lua/error_page.lua

@@ -0,0 +1,67 @@
+http = require "resty.http"
+def_backend = "upstream-default-backend"
+
+local concat = table.concat
+local upstream = require "ngx.upstream"
+local get_servers = upstream.get_servers
+local get_upstreams = upstream.get_upstreams
+local random = math.random
+local us = get_upstreams()
+
+function openURL(original_headers, status)
+    local httpc = http.new()
+
+    original_headers["X-Code"] = status or "404"
+    original_headers["X-Format"] = original_headers["Accept"] or "text/html"
+
+    local random_backend = get_destination()
+    local res, err = httpc:request_uri(random_backend, {
+        path = "/",
+        method = "GET",
+        headers = original_headers,
+    })
+
+    if not res then
+        ngx.log(ngx.ERR, err)
+        ngx.exit(500)
+    end
+
+    for k,v in pairs(res.headers) do
+        ngx.header[k] = v
+    end
+
+    ngx.status = tonumber(status)
+    ngx.say(res.body)
+end
+
+function get_destination()
+    for _, u in ipairs(us) do
+        if u == def_backend then
+            local srvs, err = get_servers(u)
+            local us_table = {}
+            if not srvs then
+                return "http://127.0.0.1:8181"
+            else
+                for _, srv in ipairs(srvs) do
+                    us_table[srv["name"]] = srv["weight"]
+                end
+            end
+            local destination = random_weight(us_table)
+            return "http://"..destination
+        end
+    end
+end
+
+function random_weight(tbl)
+    local total = 0
+    for k, v in pairs(tbl) do
+        total = total + v
+    end
+    local offset = random(0, total - 1)
+    for k1, v1 in pairs(tbl) do
+        if offset < v1 then
+            return k1
+        end
+        offset = offset - v1
+    end
+end

controllers/ext_nginx/rootfs/etc/nginx/lua/trie.lua

@@ -0,0 +1,78 @@
+-- Simple trie for URLs
+
+local _M = {}
+
+local mt = {
+    __index = _M
+}
+
+-- http://lua-users.org/wiki/SplitJoin
+local strfind, tinsert, strsub = string.find, table.insert, string.sub
+function _M.strsplit(delimiter, text)
+    local list = {}
+    local pos = 1
+    while 1 do
+        local first, last = strfind(text, delimiter, pos)
+        if first then -- found?
+            tinsert(list, strsub(text, pos, first-1))
+            pos = last+1
+        else
+            tinsert(list, strsub(text, pos))
+            break
+        end
+    end
+    return list
+end
+
+local strsplit = _M.strsplit
+
+function _M.new()
+    local t = { }
+    return setmetatable(t, mt)
+end
+
+function _M.add(t, key, val)
+    local parts = {}
+    -- hack for just /
+    if key == "/" then
+        parts = { "" }
+    else
+        parts = strsplit("/", key)
+    end
+
+    local l = t
+    for i = 1, #parts do
+        local p = parts[i]
+        if not l[p] then
+            l[p] = {}
+        end
+        l =  l[p]
+    end
+    l.__value = val
+end
+
+function _M.get(t, key)
+    local parts = strsplit("/", key)
+
+    local l = t
+
+    -- this may be nil
+    local val = t.__value
+    for i = 1, #parts do
+        local p = parts[i]
+        if l[p] then
+            l = l[p]
+            local v = l.__value
+            if v then
+                val = v
+            end
+        else
+            break
+        end
+    end
+
+    -- may be nil
+    return val
+end
+
+return _M

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/.gitignore

@@ -0,0 +1,2 @@
+t/servroot/
+t/error.log

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/LICENSE

@@ -0,0 +1,23 @@
+Copyright (c) 2013, James Hurst
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+  Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+  Redistributions in binary form must reproduce the above copyright notice, this
+  list of conditions and the following disclaimer in the documentation and/or
+  other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/Makefile

@@ -0,0 +1,20 @@
+OPENRESTY_PREFIX=/usr/local/openresty
+
+PREFIX ?=          /usr/local
+LUA_INCLUDE_DIR ?= $(PREFIX)/include
+LUA_LIB_DIR ?=     $(PREFIX)/lib/lua/$(LUA_VERSION)
+INSTALL ?= install
+TEST_FILE ?= t
+
+.PHONY: all test install
+
+all: ;
+
+install: all
+	$(INSTALL) -d $(DESTDIR)/$(LUA_LIB_DIR)/resty
+	$(INSTALL) lib/resty/*.lua $(DESTDIR)/$(LUA_LIB_DIR)/resty/
+
+test: all
+	PATH=$(OPENRESTY_PREFIX)/nginx/sbin:$$PATH TEST_NGINX_NO_SHUFFLE=1 prove -I../test-nginx/lib -r $(TEST_FILE)
+	util/lua-releng
+

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/README.md

@@ -0,0 +1,424 @@
+# lua-resty-http
+
+Lua HTTP client cosocket driver for [OpenResty](http://openresty.org/) / [ngx_lua](https://github.com/openresty/lua-nginx-module).
+
+# Status
+
+Production ready.
+
+# Features
+
+* HTTP 1.0 and 1.1
+* SSL
+* Streaming interface to the response body, for predictable memory usage
+* Alternative simple interface for singleshot requests without manual connection step
+* Chunked and non-chunked transfer encodings
+* Keepalive
+* Pipelining
+* Trailers
+
+
+# API
+
+* [new](#name)
+* [connect](#connect)
+* [set_timeout](#set_timeout)
+* [ssl_handshake](#ssl_handshake)
+* [set_keepalive](#set_keepalive)
+* [get_reused_times](#get_reused_times)
+* [close](#close)
+* [request](#request)
+* [request_uri](#request_uri)
+* [request_pipeline](#request_pipeline)
+* [Response](#response)
+    * [body_reader](#resbody_reader)
+    * [read_body](#resread_body)
+    * [read_trailes](#resread_trailers)
+* [Proxy](#proxy)
+    * [proxy_request](#proxy_request)
+    * [proxy_response](#proxy_response)
+* [Utility](#utility)
+    * [parse_uri](#parse_uri)
+    * [get_client_body_reader](#get_client_body_reader)
+
+
+## Synopsis
+
+```` lua
+lua_package_path "/path/to/lua-resty-http/lib/?.lua;;";
+
+server {
+
+
+  location /simpleinterface {
+    resolver 8.8.8.8;  # use Google's open DNS server for an example
+
+    content_by_lua '
+
+      -- For simple singleshot requests, use the URI interface.
+      local http = require "resty.http"
+      local httpc = http.new()
+      local res, err = httpc:request_uri("http://example.com/helloworld", {
+        method = "POST",
+        body = "a=1&b=2",
+        headers = {
+          ["Content-Type"] = "application/x-www-form-urlencoded",
+        }
+      })
+
+      if not res then
+        ngx.say("failed to request: ", err)
+        return
+      end
+
+      -- In this simple form, there is no manual connection step, so the body is read
+      -- all in one go, including any trailers, and the connection closed or keptalive
+      -- for you.
+
+      ngx.status = res.status
+
+      for k,v in pairs(res.headers) do
+          --
+      end
+
+      ngx.say(res.body)
+    ';
+  }
+
+
+  location /genericinterface {
+    content_by_lua '
+
+      local http = require "resty.http"
+      local httpc = http.new()
+
+      -- The generic form gives us more control. We must connect manually.
+      httpc:set_timeout(500)
+      httpc:connect("127.0.0.1", 80)
+
+      -- And request using a path, rather than a full URI.
+      local res, err = httpc:request{
+          path = "/helloworld",
+          headers = {
+              ["Host"] = "example.com",
+          },
+      }
+
+      if not res then
+        ngx.say("failed to request: ", err)
+        return
+      end
+
+      -- Now we can use the body_reader iterator, to stream the body according to our desired chunk size.
+      local reader = res.body_reader
+
+      repeat
+        local chunk, err = reader(8192)
+        if err then
+          ngx.log(ngx.ERR, err)
+          break
+        end
+
+        if chunk then
+          -- process
+        end
+      until not chunk
+
+      local ok, err = httpc:set_keepalive()
+      if not ok then
+        ngx.say("failed to set keepalive: ", err)
+        return
+      end
+    ';
+  }
+}
+````
+
+# Connection
+
+## new
+
+`syntax: httpc = http.new()`
+
+Creates the http object. In case of failures, returns `nil` and a string describing the error.
+
+## connect
+
+`syntax: ok, err = httpc:connect(host, port, options_table?)`
+
+`syntax: ok, err = httpc:connect("unix:/path/to/unix.sock", options_table?)`
+
+Attempts to connect to the web server.
+
+Before actually resolving the host name and connecting to the remote backend, this method will always look up the connection pool for matched idle connections created by previous calls of this method.
+
+An optional Lua table can be specified as the last argument to this method to specify various connect options:
+
+* `pool`
+: Specifies a custom name for the connection pool being used. If omitted, then the connection pool name will be generated from the string template `<host>:<port>` or `<unix-socket-path>`.
+
+## set_timeout
+
+`syntax: httpc:set_timeout(time)`
+
+Sets the timeout (in ms) protection for subsequent operations, including the `connect` method.
+
+## ssl_handshake
+
+`syntax: session, err = httpc:ssl_handshake(session, host, verify)`
+
+Performs an SSL handshake on the TCP connection, only availble in ngx_lua > v0.9.11
+
+See docs for [ngx.socket.tcp](https://github.com/openresty/lua-nginx-module#ngxsockettcp) for details.
+
+## set_keepalive
+
+`syntax: ok, err = httpc:set_keepalive(max_idle_timeout, pool_size)`
+
+Attempts to puts the current connection into the ngx_lua cosocket connection pool.
+
+You can specify the max idle timeout (in ms) when the connection is in the pool and the maximal size of the pool every nginx worker process.
+
+Only call this method in the place you would have called the `close` method instead. Calling this method will immediately turn the current http object into the `closed` state. Any subsequent operations other than `connect()` on the current objet will return the `closed` error.
+
+Note that calling this instead of `close` is "safe" in that it will conditionally close depending on the type of request. Specifically, a `1.0` request without `Connection: Keep-Alive` will be closed, as will a `1.1` request with `Connection: Close`.
+
+In case of success, returns `1`. In case of errors, returns `nil, err`. In the case where the conneciton is conditionally closed as described above, returns `2` and the error string `connection must be closed`.
+
+## get_reused_times
+
+`syntax: times, err = httpc:get_reused_times()`
+
+This method returns the (successfully) reused times for the current connection. In case of error, it returns `nil` and a string describing the error.
+
+If the current connection does not come from the built-in connection pool, then this method always returns `0`, that is, the connection has never been reused (yet). If the connection comes from the connection pool, then the return value is always non-zero. So this method can also be used to determine if the current connection comes from the pool.
+
+## close
+
+`syntax: ok, err = http:close()`
+
+Closes the current connection and returns the status.
+
+In case of success, returns `1`. In case of errors, returns `nil` with a string describing the error.
+
+
+# Requesting
+
+## request
+
+`syntax: res, err = httpc:request(params)`
+
+Returns a `res` table or `nil` and an error message.
+
+The `params` table accepts the following fields:
+
+* `version` The HTTP version number, currently supporting 1.0 or 1.1.
+* `method` The HTTP method string.
+* `path` The path string.
+* `headers` A table of request headers.
+* `body` The request body as a string, or an iterator function (see [get_client_body_reader](#get_client_body_reader)).
+* `ssl_verify` Verify SSL cert matches hostname
+
+When the request is successful, `res` will contain the following fields:
+
+* `status` The status code.
+* `reason` The status reason phrase.
+* `headers` A table of headers. Multiple headers with the same field name will be presented as a table of values.
+* `has_body` A boolean flag indicating if there is a body to be read. 
+* `body_reader` An iterator function for reading the body in a streaming fashion.
+* `read_body` A method to read the entire body into a string.
+* `read_trailers` A method to merge any trailers underneath the headers, after reading the body.
+
+## request_uri
+
+`syntax: res, err = httpc:request_uri(uri, params)`
+
+The simple interface. Options supplied in the `params` table are the same as in the generic interface, and will override components found in the uri itself.
+
+In this mode, there is no need to connect manually first. The connection is made on your behalf, suiting cases where you simply need to grab a URI without too much hassle.
+
+Additionally there is no ability to stream the response body in this mode. If the request is successful, `res` will contain the following fields:
+
+* `status` The status code.
+* `headers` A table of headers.
+* `body` The response body as a string.
+
+
+## request_pipeline
+
+`syntax: responses, err = httpc:request_pipeline(params)`
+
+This method works as per the [request](#request) method above, but `params` is instead a table of param tables. Each request is sent in order, and `responses` is returned as a table of response handles. For example:
+
+```lua
+local responses = httpc:request_pipeline{
+  {
+    path = "/b",
+  },
+  {
+    path = "/c",
+  },
+  {
+    path = "/d",
+  }
+}
+
+for i,r in ipairs(responses) do
+  if r.status then
+    ngx.say(r.status)
+    ngx.say(r:read_body())
+  end
+end
+```
+
+Due to the nature of pipelining, no responses are actually read until you attempt to use the response fields (status / headers etc). And since the responses are read off in order, you must read the entire body (and any trailers if you have them), before attempting to read the next response.
+
+Note this doesn't preclude the use of the streaming response body reader. Responses can still be streamed, so long as the entire body is streamed before attempting to access the next response.
+
+Be sure to test at least one field (such as status) before trying to use the others, in case a socket read error has occurred.
+
+# Response
+
+## res.body_reader
+
+The `body_reader` iterator can be used to stream the response body in chunk sizes of your choosing, as follows:
+
+````lua
+local reader = res.body_reader
+
+repeat
+  local chunk, err = reader(8192)
+  if err then
+    ngx.log(ngx.ERR, err)
+    break
+  end
+
+  if chunk then
+    -- process
+  end
+until not chunk
+````
+
+If the reader is called with no arguments, the behaviour depends on the type of connection. If the response is encoded as chunked, then the iterator will return the chunks as they arrive. If not, it will simply return the entire body.
+
+Note that the size provided is actually a **maximum** size. So in the chunked transfer case, you may get chunks smaller than the size you ask, as a remainder of the actual HTTP chunks.
+
+## res:read_body
+
+`syntax: body, err = res:read_body()`
+
+Reads the entire body into a local string.
+
+
+## res:read_trailers
+
+`syntax: res:read_trailers()`
+
+This merges any trailers underneath the `res.headers` table itself. Must be called after reading the body.
+
+
+# Proxy
+
+There are two convenience methods for when one simply wishes to proxy the current request to the connected upstream, and safely send it downstream to the client, as a reverse proxy. A complete example:
+
+```lua
+local http = require "resty.http"
+local httpc = http.new()
+
+httpc:set_timeout(500)
+local ok, err = httpc:connect(HOST, PORT)
+
+if not ok then
+  ngx.log(ngx.ERR, err)
+  return
+end
+
+httpc:set_timeout(2000)
+httpc:proxy_response(httpc:proxy_request())
+httpc:set_keepalive()
+```
+
+
+## proxy_request
+
+`syntax: local res, err = httpc:proxy_request(request_body_chunk_size?)`
+
+Performs a request using the current client request arguments, effectively proxying to the connected upstream. The request body will be read in a streaming fashion, according to `request_body_chunk_size` (see [documentation on the client body reader](#get_client_body_reader) below).
+
+
+## proxy_response
+
+`syntax: httpc:proxy_response(res, chunksize?)`
+
+Sets the current response based on the given `res`. Ensures that hop-by-hop headers are not sent downstream, and will read the response according to `chunksize` (see [documentation on the body reader](#resbody_reader) above).
+
+
+# Utility
+
+## parse_uri
+
+`syntax: local scheme, host, port, path = unpack(httpc:parse_uri(uri))`
+
+This is a convenience function allowing one to more easily use the generic interface, when the input data is a URI. 
+
+
+## get_client_body_reader
+
+`syntax: reader, err = httpc:get_client_body_reader(chunksize?, sock?)`
+
+Returns an iterator function which can be used to read the downstream client request body in a streaming fashion. You may also specify an optional default chunksize (default is `65536`), or an already established socket in
+place of the client request.
+
+Example:
+
+```lua
+local req_reader = httpc:get_client_body_reader()
+
+repeat
+  local chunk, err = req_reader(8192)
+  if err then
+    ngx.log(ngx.ERR, err)
+    break
+  end
+
+  if chunk then
+    -- process
+  end
+until not chunk
+```
+
+This iterator can also be used as the value for the body field in request params, allowing one to stream the request body into a proxied upstream request.
+
+```lua
+local client_body_reader, err = httpc:get_client_body_reader()
+
+local res, err = httpc:request{
+   path = "/helloworld",
+   body = client_body_reader,
+}
+```
+
+If `sock` is specified, 
+
+# Author
+
+James Hurst <james@pintsized.co.uk>
+
+Originally started life based on https://github.com/bakins/lua-resty-http-simple. Cosocket docs and implementation borrowed from the other lua-resty-* cosocket modules.
+
+
+# Licence
+
+This module is licensed under the 2-clause BSD license.
+
+Copyright (c) 2013-2016, James Hurst <james@pintsized.co.uk>
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/lib/resty/http.lua

@@ -0,0 +1,850 @@
+local http_headers = require "resty.http_headers"
+
+local ngx_socket_tcp = ngx.socket.tcp
+local ngx_req = ngx.req
+local ngx_req_socket = ngx_req.socket
+local ngx_req_get_headers = ngx_req.get_headers
+local ngx_req_get_method = ngx_req.get_method
+local str_gmatch = string.gmatch
+local str_lower = string.lower
+local str_upper = string.upper
+local str_find = string.find
+local str_sub = string.sub
+local str_gsub = string.gsub
+local tbl_concat = table.concat
+local tbl_insert = table.insert
+local ngx_encode_args = ngx.encode_args
+local ngx_re_match = ngx.re.match
+local ngx_re_gsub = ngx.re.gsub
+local ngx_log = ngx.log
+local ngx_DEBUG = ngx.DEBUG
+local ngx_ERR = ngx.ERR
+local ngx_NOTICE = ngx.NOTICE
+local ngx_var = ngx.var
+local co_yield = coroutine.yield
+local co_create = coroutine.create
+local co_status = coroutine.status
+local co_resume = coroutine.resume
+
+
+-- http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html#sec13.5.1
+local HOP_BY_HOP_HEADERS = {
+    ["connection"]          = true,
+    ["keep-alive"]          = true,
+    ["proxy-authenticate"]  = true,
+    ["proxy-authorization"] = true,
+    ["te"]                  = true,
+    ["trailers"]            = true,
+    ["transfer-encoding"]   = true,
+    ["upgrade"]             = true,
+    ["content-length"]      = true, -- Not strictly hop-by-hop, but Nginx will deal
+                                    -- with this (may send chunked for example).
+}
+
+
+-- Reimplemented coroutine.wrap, returning "nil, err" if the coroutine cannot
+-- be resumed. This protects user code from inifite loops when doing things like
+-- repeat
+--   local chunk, err = res.body_reader()
+--   if chunk then -- <-- This could be a string msg in the core wrap function.
+--     ...
+--   end
+-- until not chunk
+local co_wrap = function(func)
+    local co = co_create(func)
+    if not co then
+        return nil, "could not create coroutine"
+    else
+        return function(...)
+            if co_status(co) == "suspended" then
+                return select(2, co_resume(co, ...))
+            else
+                return nil, "can't resume a " .. co_status(co) .. " coroutine"
+            end
+        end
+    end
+end
+
+
+local _M = {
+    _VERSION = '0.09',
+}
+_M._USER_AGENT = "lua-resty-http/" .. _M._VERSION .. " (Lua) ngx_lua/" .. ngx.config.ngx_lua_version
+
+local mt = { __index = _M }
+
+
+local HTTP = {
+    [1.0] = " HTTP/1.0\r\n",
+    [1.1] = " HTTP/1.1\r\n",
+}
+
+local DEFAULT_PARAMS = {
+    method = "GET",
+    path = "/",
+    version = 1.1,
+}
+
+
+function _M.new(self)
+    local sock, err = ngx_socket_tcp()
+    if not sock then
+        return nil, err
+    end
+    return setmetatable({ sock = sock, keepalive = true }, mt)
+end
+
+
+function _M.set_timeout(self, timeout)
+    local sock = self.sock
+    if not sock then
+        return nil, "not initialized"
+    end
+
+    return sock:settimeout(timeout)
+end
+
+
+function _M.ssl_handshake(self, ...)
+    local sock = self.sock
+    if not sock then
+        return nil, "not initialized"
+    end
+
+    self.ssl = true
+
+    return sock:sslhandshake(...)
+end
+
+
+function _M.connect(self, ...)
+    local sock = self.sock
+    if not sock then
+        return nil, "not initialized"
+    end
+
+    self.host = select(1, ...)
+    self.port = select(2, ...)
+
+    -- If port is not a number, this is likely a unix domain socket connection.
+    if type(self.port) ~= "number" then
+        self.port = nil
+    end
+
+    self.keepalive = true
+
+    return sock:connect(...)
+end
+
+
+function _M.set_keepalive(self, ...)
+    local sock = self.sock
+    if not sock then
+        return nil, "not initialized"
+    end
+
+    if self.keepalive == true then
+        return sock:setkeepalive(...)
+    else
+        -- The server said we must close the connection, so we cannot setkeepalive.
+        -- If close() succeeds we return 2 instead of 1, to differentiate between
+        -- a normal setkeepalive() failure and an intentional close().
+        local res, err = sock:close()
+        if res then
+            return 2, "connection must be closed"
+        else
+            return res, err
+        end
+    end
+end
+
+
+function _M.get_reused_times(self)
+    local sock = self.sock
+    if not sock then
+        return nil, "not initialized"
+    end
+
+    return sock:getreusedtimes()
+end
+
+
+function _M.close(self)
+    local sock = self.sock
+    if not sock then
+        return nil, "not initialized"
+    end
+
+    return sock:close()
+end
+
+
+local function _should_receive_body(method, code)
+    if method == "HEAD" then return nil end
+    if code == 204 or code == 304 then return nil end
+    if code >= 100 and code < 200 then return nil end
+    return true
+end
+
+
+function _M.parse_uri(self, uri)
+    local m, err = ngx_re_match(uri, [[^(http[s]?)://([^:/]+)(?::(\d+))?(.*)]],
+        "jo")
+
+    if not m then
+        if err then
+            return nil, "failed to match the uri: " .. uri .. ", " .. err
+        end
+
+        return nil, "bad uri: " .. uri
+    else
+        if m[3] then
+            m[3] = tonumber(m[3])
+        else
+            if m[1] == "https" then
+                m[3] = 443
+            else
+                m[3] = 80
+            end
+        end
+        if not m[4] or "" == m[4] then m[4] = "/" end
+        return m, nil
+    end
+end
+
+
+local function _format_request(params)
+    local version = params.version
+    local headers = params.headers or {}
+
+    local query = params.query or ""
+    if query then
+        if type(query) == "table" then
+            query = "?" .. ngx_encode_args(query)
+        end
+    end
+
+    -- Initialize request
+    local req = {
+        str_upper(params.method),
+        " ",
+        params.path,
+        query,
+        HTTP[version],
+        -- Pre-allocate slots for minimum headers and carriage return.
+        true,
+        true,
+        true,
+    }
+    local c = 6 -- req table index it's faster to do this inline vs table.insert
+
+    -- Append headers
+    for key, values in pairs(headers) do
+        if type(values) ~= "table" then
+            values = {values}
+        end
+
+        key = tostring(key)
+        for _, value in pairs(values) do
+            req[c] = key .. ": " .. tostring(value) .. "\r\n"
+            c = c + 1
+        end
+    end
+
+    -- Close headers
+    req[c] = "\r\n"
+
+    return tbl_concat(req)
+end
+
+
+local function _receive_status(sock)
+    local line, err = sock:receive("*l")
+    if not line then
+        return nil, nil, nil, err
+    end
+
+    return tonumber(str_sub(line, 10, 12)), tonumber(str_sub(line, 6, 8)), str_sub(line, 14)
+end
+
+
+
+local function _receive_headers(sock)
+    local headers = http_headers.new()
+
+    repeat
+        local line, err = sock:receive("*l")
+        if not line then
+            return nil, err
+        end
+
+        for key, val in str_gmatch(line, "([^:%s]+):%s*(.+)") do
+            if headers[key] then
+                if type(headers[key]) ~= "table" then
+                    headers[key] = { headers[key] }
+                end
+                tbl_insert(headers[key], tostring(val))
+            else
+                headers[key] = tostring(val)
+            end
+        end
+    until str_find(line, "^%s*$")
+
+    return headers, nil
+end
+
+
+local function _chunked_body_reader(sock, default_chunk_size)
+    return co_wrap(function(max_chunk_size)
+        local max_chunk_size = max_chunk_size or default_chunk_size
+        local remaining = 0
+        local length
+
+        repeat
+            -- If we still have data on this chunk
+            if max_chunk_size and remaining > 0 then
+
+                if remaining > max_chunk_size then
+                    -- Consume up to max_chunk_size
+                    length = max_chunk_size
+                    remaining = remaining - max_chunk_size
+                else
+                    -- Consume all remaining
+                    length = remaining
+                    remaining = 0
+                end
+            else -- This is a fresh chunk
+
+                -- Receive the chunk size
+                local str, err = sock:receive("*l")
+                if not str then
+                    co_yield(nil, err)
+                end
+
+                length = tonumber(str, 16)
+
+                if not length then
+                    co_yield(nil, "unable to read chunksize")
+                end
+
+                if max_chunk_size and length > max_chunk_size then
+                    -- Consume up to max_chunk_size
+                    remaining = length - max_chunk_size
+                    length = max_chunk_size
+                end
+            end
+
+            if length > 0 then
+                local str, err = sock:receive(length)
+                if not str then
+                    co_yield(nil, err)
+                end
+
+                max_chunk_size = co_yield(str) or default_chunk_size
+
+                -- If we're finished with this chunk, read the carriage return.
+                if remaining == 0 then
+                    sock:receive(2) -- read \r\n
+                end
+            else
+                -- Read the last (zero length) chunk's carriage return
+                sock:receive(2) -- read \r\n
+            end
+
+        until length == 0
+    end)
+end
+
+
+local function _body_reader(sock, content_length, default_chunk_size)
+    return co_wrap(function(max_chunk_size)
+        local max_chunk_size = max_chunk_size or default_chunk_size
+
+        if not content_length and max_chunk_size then
+            -- We have no length, but wish to stream.
+            -- HTTP 1.0 with no length will close connection, so read chunks to the end.
+            repeat
+                local str, err, partial = sock:receive(max_chunk_size)
+                if not str and err == "closed" then
+                    max_chunk_size = tonumber(co_yield(partial, err) or default_chunk_size)
+                end
+
+                max_chunk_size = tonumber(co_yield(str) or default_chunk_size)
+                if max_chunk_size and max_chunk_size < 0 then max_chunk_size = nil end
+
+                if not max_chunk_size then
+                    ngx_log(ngx_ERR, "Buffer size not specified, bailing")
+                    break
+                end
+            until not str
+
+        elseif not content_length then
+            -- We have no length but don't wish to stream.
+            -- HTTP 1.0 with no length will close connection, so read to the end.
+            co_yield(sock:receive("*a"))
+
+        elseif not max_chunk_size then
+            -- We have a length and potentially keep-alive, but want everything.
+            co_yield(sock:receive(content_length))
+
+        else
+            -- We have a length and potentially a keep-alive, and wish to stream
+            -- the response.
+            local received = 0
+            repeat
+                local length = max_chunk_size
+                if received + length > content_length then
+                    length = content_length - received
+                end
+
+                if length > 0 then
+                    local str, err = sock:receive(length)
+                    if not str then
+                        max_chunk_size = tonumber(co_yield(nil, err) or default_chunk_size)
+                    end
+                    received = received + length
+
+                    max_chunk_size = tonumber(co_yield(str) or default_chunk_size)
+                    if max_chunk_size and max_chunk_size < 0 then max_chunk_size = nil end
+
+                    if not max_chunk_size then
+                        ngx_log(ngx_ERR, "Buffer size not specified, bailing")
+                        break
+                    end
+                end
+
+            until length == 0
+        end
+    end)
+end
+
+
+local function _no_body_reader()
+    return nil
+end
+
+
+local function _read_body(res)
+    local reader = res.body_reader
+
+    if not reader then
+        -- Most likely HEAD or 304 etc.
+        return nil, "no body to be read"
+    end
+
+    local chunks = {}
+    local c = 1
+
+    local chunk, err
+    repeat
+        chunk, err = reader()
+
+        if err then
+            return nil, err, tbl_concat(chunks) -- Return any data so far.
+        end
+        if chunk then
+            chunks[c] = chunk
+            c = c + 1
+        end
+    until not chunk
+
+    return tbl_concat(chunks)
+end
+
+
+local function _trailer_reader(sock)
+    return co_wrap(function()
+        co_yield(_receive_headers(sock))
+    end)
+end
+
+
+local function _read_trailers(res)
+    local reader = res.trailer_reader
+    if not reader then
+        return nil, "no trailers"
+    end
+
+    local trailers = reader()
+    setmetatable(res.headers, { __index = trailers })
+end
+
+
+local function _send_body(sock, body)
+    if type(body) == 'function' then
+        repeat
+            local chunk, err, partial = body()
+
+            if chunk then
+                local ok,err = sock:send(chunk)
+
+                if not ok then
+                    return nil, err
+                end
+            elseif err ~= nil then
+                return nil, err, partial
+            end
+
+        until chunk == nil
+    elseif body ~= nil then
+        local bytes, err = sock:send(body)
+
+        if not bytes then
+            return nil, err
+        end
+    end
+    return true, nil
+end
+
+
+local function _handle_continue(sock, body)
+    local status, version, reason, err = _receive_status(sock)
+    if not status then
+        return nil, nil, err
+    end
+
+    -- Only send body if we receive a 100 Continue
+    if status == 100 then
+        local ok, err = sock:receive("*l") -- Read carriage return
+        if not ok then
+            return nil, nil, err
+        end
+        _send_body(sock, body)
+    end
+    return status, version, err
+end
+
+
+function _M.send_request(self, params)
+    -- Apply defaults
+    setmetatable(params, { __index = DEFAULT_PARAMS })
+
+    local sock = self.sock
+    local body = params.body
+    local headers = http_headers.new()
+
+    local params_headers = params.headers
+    if params_headers then
+        -- We assign one by one so that the metatable can handle case insensitivity
+        -- for us. You can blame the spec for this inefficiency.
+        for k,v in pairs(params_headers) do
+            headers[k] = v
+        end
+    end
+
+    -- Ensure minimal headers are set
+    if type(body) == 'string' and not headers["Content-Length"] then
+        headers["Content-Length"] = #body
+    end
+    if not headers["Host"] then
+        if (str_sub(self.host, 1, 5) == "unix:") then
+            return nil, "Unable to generate a useful Host header for a unix domain socket. Please provide one."
+        end
+        -- If we have a port (i.e. not connected to a unix domain socket), and this
+        -- port is non-standard, append it to the Host heaer.
+        if self.port then
+            if self.ssl and self.port ~= 443 then
+                headers["Host"] = self.host .. ":" .. self.port
+            elseif not self.ssl and self.port ~= 80 then
+                headers["Host"] = self.host .. ":" .. self.port
+            else
+                headers["Host"] = self.host
+            end
+        else
+            headers["Host"] = self.host
+        end
+    end
+    if not headers["User-Agent"] then
+        headers["User-Agent"] = _M._USER_AGENT
+    end
+    if params.version == 1.0 and not headers["Connection"] then
+        headers["Connection"] = "Keep-Alive"
+    end
+
+    params.headers = headers
+
+    -- Format and send request
+    local req = _format_request(params)
+    ngx_log(ngx_DEBUG, "\n", req)
+    local bytes, err = sock:send(req)
+
+    if not bytes then
+        return nil, err
+    end
+
+    -- Send the request body, unless we expect: continue, in which case
+    -- we handle this as part of reading the response.
+    if headers["Expect"] ~= "100-continue" then
+        local ok, err, partial = _send_body(sock, body)
+        if not ok then
+            return nil, err, partial
+        end
+    end
+
+    return true
+end
+
+
+function _M.read_response(self, params)
+    local sock = self.sock
+
+    local status, version, reason, err
+
+    -- If we expect: continue, we need to handle this, sending the body if allowed.
+    -- If we don't get 100 back, then status is the actual status.
+    if params.headers["Expect"] == "100-continue" then
+        local _status, _version, _err = _handle_continue(sock, params.body)
+        if not _status then
+            return nil, _err
+        elseif _status ~= 100 then
+            status, version, err = _status, _version, _err
+        end
+    end
+
+    -- Just read the status as normal.
+    if not status then
+        status, version, reason, err = _receive_status(sock)
+        if not status then
+            return nil, err
+        end
+    end
+
+
+    local res_headers, err = _receive_headers(sock)
+    if not res_headers then
+        return nil, err
+    end
+
+    -- keepalive is true by default. Determine if this is correct or not.
+    local ok, connection = pcall(str_lower, res_headers["Connection"])
+    if ok then
+        if  (version == 1.1 and connection == "close") or
+            (version == 1.0 and connection ~= "keep-alive") then
+            self.keepalive = false
+        end
+    else
+        -- no connection header
+        if version == 1.0 then
+            self.keepalive = false
+        end
+    end
+
+    local body_reader = _no_body_reader
+    local trailer_reader, err = nil, nil
+    local has_body = false
+
+    -- Receive the body_reader
+    if _should_receive_body(params.method, status) then
+        local ok, encoding = pcall(str_lower, res_headers["Transfer-Encoding"])
+        if ok and version == 1.1 and encoding == "chunked" then
+            body_reader, err = _chunked_body_reader(sock)
+            has_body = true
+        else
+
+            local ok, length = pcall(tonumber, res_headers["Content-Length"])
+            if ok then
+                body_reader, err = _body_reader(sock, length)
+                has_body = true
+            end
+        end
+    end
+
+    if res_headers["Trailer"] then
+        trailer_reader, err = _trailer_reader(sock)
+    end
+
+    if err then
+        return nil, err
+    else
+        return {
+            status = status,
+            reason = reason,
+            headers = res_headers,
+            has_body = has_body,
+            body_reader = body_reader,
+            read_body = _read_body,
+            trailer_reader = trailer_reader,
+            read_trailers = _read_trailers,
+        }
+    end
+end
+
+
+function _M.request(self, params)
+    local res, err = self:send_request(params)
+    if not res then
+        return res, err
+    else
+        return self:read_response(params)
+    end
+end
+
+
+function _M.request_pipeline(self, requests)
+    for i, params in ipairs(requests) do
+        if params.headers and params.headers["Expect"] == "100-continue" then
+            return nil, "Cannot pipeline request specifying Expect: 100-continue"
+        end
+
+        local res, err = self:send_request(params)
+        if not res then
+            return res, err
+        end
+    end
+
+    local responses = {}
+    for i, params in ipairs(requests) do
+        responses[i] = setmetatable({
+            params = params,
+            response_read = false,
+        }, {
+            -- Read each actual response lazily, at the point the user tries
+            -- to access any of the fields.
+            __index = function(t, k)
+                local res, err
+                if t.response_read == false then
+                    res, err = _M.read_response(self, t.params)
+                    t.response_read = true
+
+                    if not res then
+                        ngx_log(ngx_ERR, err)
+                    else
+                        for rk, rv in pairs(res) do
+                            t[rk] = rv
+                        end
+                    end
+                end
+                return rawget(t, k)
+            end,
+        })
+    end
+    return responses
+end
+
+
+function _M.request_uri(self, uri, params)
+    if not params then params = {} end
+
+    local parsed_uri, err = self:parse_uri(uri)
+    if not parsed_uri then
+        return nil, err
+    end
+
+    local scheme, host, port, path = unpack(parsed_uri)
+    if not params.path then params.path = path end
+
+    local c, err = self:connect(host, port)
+    if not c then
+        return nil, err
+    end
+
+    if scheme == "https" then
+        local verify = true
+        if params.ssl_verify == false then
+            verify = false
+        end
+        local ok, err = self:ssl_handshake(nil, host, verify)
+        if not ok then
+            return nil, err
+        end
+    end
+
+    local res, err = self:request(params)
+    if not res then
+        return nil, err
+    end
+
+    local body, err = res:read_body()
+    if not body then
+        return nil, err
+    end
+
+    res.body = body
+
+    local ok, err = self:set_keepalive()
+    if not ok then
+        ngx_log(ngx_ERR, err)
+    end
+
+    return res, nil
+end
+
+
+function _M.get_client_body_reader(self, chunksize, sock)
+    local chunksize = chunksize or 65536
+    if not sock then
+        local ok, err
+        ok, sock, err = pcall(ngx_req_socket)
+
+        if not ok then
+            return nil, sock -- pcall err
+        end
+
+        if not sock then
+            if err == "no body" then
+                return nil
+            else
+                return nil, err
+            end
+        end
+    end
+
+    local headers = ngx_req_get_headers()
+    local length = headers.content_length
+    local encoding = headers.transfer_encoding
+    if length then
+        return _body_reader(sock, tonumber(length), chunksize)
+    elseif encoding and str_lower(encoding) == 'chunked' then
+        -- Not yet supported by ngx_lua but should just work...
+        return _chunked_body_reader(sock, chunksize)
+    else
+       return nil
+    end
+end
+
+
+function _M.proxy_request(self, chunksize)
+    return self:request{
+        method = ngx_req_get_method(),
+        path = ngx_re_gsub(ngx_var.uri, "\\s", "%20", "jo") .. ngx_var.is_args .. (ngx_var.query_string or ""),
+        body = self:get_client_body_reader(chunksize),
+        headers = ngx_req_get_headers(),
+    }
+end
+
+
+function _M.proxy_response(self, response, chunksize)
+    if not response then
+        ngx_log(ngx_ERR, "no response provided")
+        return
+    end
+
+    ngx.status = response.status
+
+    -- Filter out hop-by-hop headeres
+    for k,v in pairs(response.headers) do
+        if not HOP_BY_HOP_HEADERS[str_lower(k)] then
+            ngx.header[k] = v
+        end
+    end
+
+    local reader = response.body_reader
+    repeat
+        local chunk, err = reader(chunksize)
+        if err then
+            ngx_log(ngx_ERR, err)
+            break
+        end
+
+        if chunk then
+            local res, err = ngx.print(chunk)
+            if not res then
+                ngx_log(ngx_ERR, err)
+                break
+            end
+        end
+    until not chunk
+end
+
+
+return _M

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/lib/resty/http_headers.lua

@@ -0,0 +1,62 @@
+local   rawget, rawset, setmetatable =
+        rawget, rawset, setmetatable
+
+local str_gsub = string.gsub
+local str_lower = string.lower
+
+
+local _M = {
+    _VERSION = '0.01',
+}
+
+
+-- Returns an empty headers table with internalised case normalisation.
+-- Supports the same cases as in ngx_lua:
+--
+-- headers.content_length
+-- headers["content-length"]
+-- headers["Content-Length"]
+function _M.new(self)
+    local mt = { 
+        normalised = {},
+    }
+
+
+    mt.__index = function(t, k)
+        local k_hyphened = str_gsub(k, "_", "-")
+        local matched = rawget(t, k)
+        if matched then
+            return matched
+        else
+            local k_normalised = str_lower(k_hyphened)
+            return rawget(t, mt.normalised[k_normalised])
+        end
+    end
+
+
+    -- First check the normalised table. If there's no match (first time) add an entry for
+    -- our current case in the normalised table. This is to preserve the human (prettier) case
+    -- instead of outputting lowercased header names.
+    --
+    -- If there's a match, we're being updated, just with a different case for the key. We use
+    -- the normalised table to give us the original key, and perorm a rawset().
+    mt.__newindex = function(t, k, v)
+        -- we support underscore syntax, so always hyphenate.
+        local k_hyphened = str_gsub(k, "_", "-")
+
+        -- lowercase hyphenated is "normalised"
+        local k_normalised = str_lower(k_hyphened)
+
+        if not mt.normalised[k_normalised] then
+            mt.normalised[k_normalised] = k_hyphened
+            rawset(t, k_hyphened, v)
+        else
+            rawset(t, mt.normalised[k_normalised], v)
+        end
+    end
+
+    return setmetatable({}, mt)
+end
+
+
+return _M

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/lua-resty-http-0.09-0.rockspec

@@ -0,0 +1,22 @@
+package = "lua-resty-http"
+version = "0.09-0"
+source = {
+   url = "git://github.com/pintsized/lua-resty-http",
+   tag = "v0.09"
+}
+description = {
+   summary = "Lua HTTP client cosocket driver for OpenResty / ngx_lua.",
+   homepage = "https://github.com/pintsized/lua-resty-http",
+   license = "2-clause BSD",
+   maintainer = "James Hurst <james@pintsized.co.uk>"
+}
+dependencies = {
+   "lua >= 5.1"
+}
+build = {
+   type = "builtin",
+   modules = {
+      ["resty.http"] = "lib/resty/http.lua",
+      ["resty.http_headers"] = "lib/resty/http_headers.lua"
+   }
+}

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/01-basic.t

@@ -0,0 +1,233 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4) + 1;
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Simple default get.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            ngx.status = res.status
+            ngx.print(res:read_body())
+            
+            httpc:close()
+        ';
+    }
+    location = /b {
+        echo "OK";
+    }
+--- request
+GET /a
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: HTTP 1.0
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                version = 1.0,
+                path = "/b"
+            }
+
+            ngx.status = res.status
+            ngx.print(res:read_body())
+            
+            httpc:close()
+        ';
+    }
+    location = /b {
+        echo "OK";
+    }
+--- request
+GET /a
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 3: Status code and reason phrase
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            ngx.status = res.status
+            ngx.say(res.reason)
+            ngx.print(res:read_body())
+            
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.status = 404
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+Not Found
+OK
+--- error_code: 404
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 4: Response headers
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            ngx.status = res.status
+            ngx.say(res.headers["X-Test"])
+            
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.header["X-Test"] = "x-value"
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+x-value
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 5: Query
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                query = {
+                    a = 1,
+                    b = 2,
+                },
+                path = "/b"
+            }
+
+            ngx.status = res.status
+
+            for k,v in pairs(res.headers) do
+                ngx.header[k] = v
+            end
+
+            ngx.print(res:read_body())
+            
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            for k,v in pairs(ngx.req.get_uri_args()) do
+                ngx.header["X-Header-" .. string.upper(k)] = v
+            end
+        ';
+    }
+--- request
+GET /a
+--- response_headers
+X-Header-A: 1
+X-Header-B: 2
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 7: HEAD has no body.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                method = "HEAD",
+                path = "/b"
+            }
+
+            local body = res:read_body()
+
+            if body then
+                ngx.print(body)
+            end
+            httpc:close()
+        ';
+    }
+    location = /b {
+        echo "OK";
+    }
+--- request
+GET /a
+--- response_body
+--- no_error_log
+[error]
+[warn]
+

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/02-chunked.t

@@ -0,0 +1,158 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Non chunked.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            local body = res:read_body()
+
+            ngx.say(#body)
+            httpc:close()
+        ';
+    }
+    location = /b {
+        chunked_transfer_encoding off;
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+32768
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: Chunked. The number of chunks received when no max size is given proves the response was in fact chunked.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            local chunks = {}
+            local c = 1
+            repeat
+                local chunk, err = res.body_reader()
+                if chunk then
+                    chunks[c] = chunk
+                    c = c + 1
+                end
+            until not chunk
+
+            local body = table.concat(chunks)
+
+            ngx.say(#body)
+            ngx.say(#chunks)
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+65536
+2
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 3: Chunked using read_body method.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            local body = res:read_body()
+
+            ngx.say(#body)
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+65536
+--- no_error_log
+[error]
+[warn]

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/03-requestbody.t

@@ -0,0 +1,185 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: POST form-urlencoded
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                body = "a=1&b=2&c=3",
+                path = "/b",
+                headers = {
+                    ["Content-Type"] = "application/x-www-form-urlencoded",
+                }
+            }
+
+            ngx.say(res:read_body())
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.req.read_body()
+            local args = ngx.req.get_post_args()
+            ngx.say("a: ", args.a)
+            ngx.say("b: ", args.b)
+            ngx.print("c: ", args.c)
+        ';
+    }
+--- request
+GET /a
+--- response_body
+a: 1
+b: 2
+c: 3
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: POST form-urlencoded 1.0
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                method = "POST",
+                body = "a=1&b=2&c=3",
+                path = "/b",
+                headers = {
+                    ["Content-Type"] = "application/x-www-form-urlencoded",
+                },
+                version = 1.0,
+            }
+
+            ngx.say(res:read_body())
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.req.read_body()
+            local args = ngx.req.get_post_args()
+            ngx.say(ngx.req.get_method())
+            ngx.say("a: ", args.a)
+            ngx.say("b: ", args.b)
+            ngx.print("c: ", args.c)
+        ';
+    }
+--- request
+GET /a
+--- response_body
+POST
+a: 1
+b: 2
+c: 3
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 3: 100 Continue does not end requset
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                body = "a=1&b=2&c=3",
+                path = "/b",
+                headers = {
+                    ["Expect"] = "100-continue",
+                    ["Content-Type"] = "application/x-www-form-urlencoded",
+                }
+            }
+            ngx.say(res.status)
+            ngx.say(res:read_body())
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.req.read_body()
+            local args = ngx.req.get_post_args()
+            ngx.say("a: ", args.a)
+            ngx.say("b: ", args.b)
+            ngx.print("c: ", args.c)
+        ';
+    }
+--- request
+GET /a
+--- response_body
+200
+a: 1
+b: 2
+c: 3
+--- no_error_log
+[error]
+[warn]
+
+=== TEST 4: Return non-100 status to user
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+                headers = {
+                    ["Expect"] = "100-continue",
+                    ["Content-Type"] = "application/x-www-form-urlencoded",
+                }
+            }
+            if not res then
+                ngx.say(err)
+            end
+            ngx.say(res.status)
+            ngx.say(res:read_body())
+            httpc:close()
+        ';
+    }
+    location = /b {
+        return 417 "Expectation Failed";
+    }
+--- request
+GET /a
+--- response_body
+417
+Expectation Failed
+--- no_error_log
+[error]
+[warn]
+

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/04-trailers.t

@@ -0,0 +1,151 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Trailers. Check Content-MD5 generated after the body is sent matches up.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                path = "/b",
+                headers = {
+                    ["TE"] = "trailers",
+                }
+            }
+
+            local body = res:read_body()
+            local hash = ngx.md5(body)
+            res:read_trailers()
+
+            if res.headers["Content-MD5"] == hash then
+                ngx.say("OK")
+            else
+                ngx.say(res.headers["Content-MD5"])
+            end
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            -- We use the raw socket to compose a response, since OpenResty
+            -- doesnt support trailers natively.
+
+            ngx.req.read_body()
+            local sock, err = ngx.req.socket(true)
+            if not sock then
+                ngx.say(err)
+            end
+
+            local res = {}
+            table.insert(res, "HTTP/1.1 200 OK")
+            table.insert(res, "Date: " .. ngx.http_time(ngx.time()))
+            table.insert(res, "Transfer-Encoding: chunked")
+            table.insert(res, "Trailer: Content-MD5")
+            table.insert(res, "")
+
+            local body = "Hello, World"
+
+            table.insert(res, string.format("%x", #body))
+            table.insert(res, body)
+            table.insert(res, "0")
+            table.insert(res, "")
+        
+            table.insert(res, "Content-MD5: " .. ngx.md5(body))
+
+            table.insert(res, "")
+            table.insert(res, "")
+            sock:send(table.concat(res, "\\r\\n"))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: Advertised trailer does not exist, handled gracefully.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local res, err = httpc:request{
+                path = "/b",
+                headers = {
+                    ["TE"] = "trailers",
+                }
+            }
+
+            local body = res:read_body()
+            local hash = ngx.md5(body)
+            res:read_trailers()
+
+            ngx.say("OK")
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            -- We use the raw socket to compose a response, since OpenResty
+            -- doesnt support trailers natively.
+
+            ngx.req.read_body()
+            local sock, err = ngx.req.socket(true)
+            if not sock then
+                ngx.say(err)
+            end
+
+            local res = {}
+            table.insert(res, "HTTP/1.1 200 OK")
+            table.insert(res, "Date: " .. ngx.http_time(ngx.time()))
+            table.insert(res, "Transfer-Encoding: chunked")
+            table.insert(res, "Trailer: Content-MD5")
+            table.insert(res, "")
+
+            local body = "Hello, World"
+
+            table.insert(res, string.format("%x", #body))
+            table.insert(res, body)
+            table.insert(res, "0")
+            
+            table.insert(res, "")
+            table.insert(res, "")
+            sock:send(table.concat(res, "\\r\\n"))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]
+
+

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/05-stream.t

@@ -0,0 +1,566 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4) - 1;
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Chunked streaming body reader returns the right content length.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+            }
+
+            local chunks = {}
+            repeat
+                local chunk = res.body_reader()
+                if chunk then
+                    table.insert(chunks, chunk)
+                end
+            until not chunk
+
+            local body = table.concat(chunks)
+            ngx.say(#body)
+            ngx.say(res.headers["Transfer-Encoding"])
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+32768
+chunked
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: Non-Chunked streaming body reader returns the right content length.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+            }
+
+            local chunks = {}
+            repeat
+                local chunk = res.body_reader()
+                if chunk then
+                    table.insert(chunks, chunk)
+                end
+            until not chunk
+
+            local body = table.concat(chunks)
+            ngx.say(#body)
+            ngx.say(res.headers["Transfer-Encoding"])
+            ngx.say(#chunks)
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        chunked_transfer_encoding off;
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+32768
+nil
+1
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2b: Non-Chunked streaming body reader, buffer size becomes nil
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+            }
+
+            local chunks = {}
+            local buffer_size = 16384
+            repeat
+                local chunk = res.body_reader(buffer_size)
+                if chunk then
+                    table.insert(chunks, chunk)
+                end
+
+                buffer_size = nil
+            until not chunk
+
+            local body = table.concat(chunks)
+            ngx.say(res.headers["Transfer-Encoding"])
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        chunked_transfer_encoding off;
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+nil
+--- error_log
+Buffer size not specified, bailing
+
+
+=== TEST 3: HTTP 1.0 body reader with no max size returns the right content length.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+                version = 1.0,
+            }
+
+            local chunks = {}
+            repeat
+                local chunk = res.body_reader()
+                if chunk then
+                    table.insert(chunks, chunk)
+                end
+            until not chunk
+
+            local body = table.concat(chunks)
+            ngx.say(#body)
+            ngx.say(res.headers["Transfer-Encoding"])
+            ngx.say(#chunks)
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        chunked_transfer_encoding off;
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+32768
+nil
+1
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 4: HTTP 1.0 body reader with max chunk size returns the right content length.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+                version = 1.0,
+            }
+
+            local chunks = {}
+            local size = 8192
+            repeat
+                local chunk = res.body_reader(size)
+                if chunk then
+                    table.insert(chunks, chunk)
+                end
+                size = size + size
+            until not chunk
+
+            local body = table.concat(chunks)
+            ngx.say(#body)
+            ngx.say(res.headers["Transfer-Encoding"])
+            ngx.say(#chunks)
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        chunked_transfer_encoding off;
+        content_by_lua '
+            local len = 32769
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+32769
+nil
+3
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 4b: HTTP 1.0 body reader with no content length, stream works as expected.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+                version = 1.0,
+            }
+
+            local chunks = {}
+            local size = 8192
+            repeat
+                local chunk = res.body_reader(size)
+                if chunk then
+                    table.insert(chunks, chunk)
+                end
+                size = size + size
+            until not chunk
+
+            local body = table.concat(chunks)
+            ngx.say(#body)
+            ngx.say(#chunks)
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.req.read_body()
+            local sock, err = ngx.req.socket(true)
+            if not sock then
+                ngx.say(err)
+            end
+
+            local res = {}
+            table.insert(res, "HTTP/1.0 200 OK")
+            table.insert(res, "Date: " .. ngx.http_time(ngx.time()))
+            table.insert(res, "")
+
+            local len = 32769
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            table.insert(res, table.concat(t))
+            sock:send(table.concat(res, "\\r\\n"))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+32769
+3
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 5: Chunked streaming body reader with max chunk size returns the right content length.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+            }
+
+            local chunks = {}
+            local size = 8192
+            repeat
+                local chunk = res.body_reader(size)
+                if chunk then
+                    table.insert(chunks, chunk)
+                end
+                size = size + size
+            until not chunk
+
+            local body = table.concat(chunks)
+            ngx.say(#body)
+            ngx.say(res.headers["Transfer-Encoding"])
+            ngx.say(#chunks)
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            local len = 32768
+            local t = {}
+            for i=1,len do
+                t[i] = 0
+            end
+            ngx.print(table.concat(t))
+        ';
+    }
+--- request
+GET /a
+--- response_body
+32768
+chunked
+3
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 6: Request reader correctly reads body
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        lua_need_request_body off;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local reader, err = httpc:get_client_body_reader(8192)
+
+            repeat
+                local chunk, err = reader()
+                if chunk then
+                    ngx.print(chunk)
+                end
+            until chunk == nil
+
+        ';
+    }
+
+--- request
+POST /a
+foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz
+--- response_body: foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz
+--- no_error_log
+[error]
+[warn]
+
+=== TEST 7: Request reader correctly reads body in chunks
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        lua_need_request_body off;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local reader, err = httpc:get_client_body_reader(64)
+
+            local chunks = 0
+            repeat
+                chunks = chunks +1
+                local chunk, err = reader()
+                if chunk then
+                    ngx.print(chunk)
+                end
+            until chunk == nil
+            ngx.say("\\n"..chunks)
+        ';
+    }
+
+--- request
+POST /a
+foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz
+--- response_body
+foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz
+3
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 8: Request reader passes into client
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        lua_need_request_body off;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local reader, err = httpc:get_client_body_reader(64)
+
+            local res, err = httpc:request{
+                method = POST,
+                path = "/b",
+                body = reader,
+                headers = ngx.req.get_headers(100, true),
+            }
+
+            local body = res:read_body()
+            ngx.say(body)
+            httpc:close()
+
+        ';
+    }
+
+    location = /b {
+        content_by_lua '
+            ngx.req.read_body()
+            local body, err = ngx.req.get_body_data()
+            ngx.print(body)
+        ';
+    }
+
+--- request
+POST /a
+foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz
+--- response_body
+foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 9: Body reader is a function returning nil when no body is present.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+                method = "HEAD",
+            }
+
+            repeat
+                local chunk = res.body_reader()
+            until not chunk
+
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.exit(200)
+        ';
+    }
+--- request
+GET /a
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 10: Issue a notice (but do not error) if trying to read the request body in a subrequest
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        echo_location /b;
+    }
+    location = /b {
+        lua_need_request_body off;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local reader, err = httpc:get_client_body_reader(8192)
+            if not reader then
+                ngx.log(ngx.NOTICE, err)
+                return
+            end
+
+            repeat
+                local chunk, err = reader()
+                if chunk then
+                    ngx.print(chunk)
+                end
+            until chunk == nil
+        ';
+    }
+
+--- request
+POST /a
+foobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbazfoobarbaz
+--- response_body: 
+--- no_error_log
+[error]
+[warn]
+--- error_log
+attempt to read the request body in a subrequest

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/06-simpleinterface.t

@@ -0,0 +1,145 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4) + 6;
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Simple URI interface
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            local res, err = httpc:request_uri("http://127.0.0.1:"..ngx.var.server_port.."/b?a=1&b=2")
+            
+            if not res then
+                ngx.log(ngx.ERR, err)
+            end
+            ngx.status = res.status
+
+            ngx.header["X-Header-A"] = res.headers["X-Header-A"]
+            ngx.header["X-Header-B"] = res.headers["X-Header-B"]
+
+            ngx.print(res.body)
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            for k,v in pairs(ngx.req.get_uri_args()) do
+                ngx.header["X-Header-" .. string.upper(k)] = v
+            end
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_headers
+X-Header-A: 1
+X-Header-B: 2
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: Simple URI interface HTTP 1.0
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            local res, err = httpc:request_uri(
+                "http://127.0.0.1:"..ngx.var.server_port.."/b?a=1&b=2", {
+                }
+            )
+            
+            ngx.status = res.status
+            
+            ngx.header["X-Header-A"] = res.headers["X-Header-A"]
+            ngx.header["X-Header-B"] = res.headers["X-Header-B"]
+
+            ngx.print(res.body)
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            for k,v in pairs(ngx.req.get_uri_args()) do
+                ngx.header["X-Header-" .. string.upper(k)] = v
+            end
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_headers
+X-Header-A: 1
+X-Header-B: 2
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 3 Simple URI interface, params override
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            local res, err = httpc:request_uri(
+                "http://127.0.0.1:"..ngx.var.server_port.."/b?a=1&b=2", {
+                    path = "/c",
+                    query = {
+                        a = 2,
+                        b = 3,
+                    },
+                }
+            )
+            
+            ngx.status = res.status
+            
+            ngx.header["X-Header-A"] = res.headers["X-Header-A"]
+            ngx.header["X-Header-B"] = res.headers["X-Header-B"]
+
+            ngx.print(res.body)
+        ';
+    }
+    location = /c {
+        content_by_lua '
+            for k,v in pairs(ngx.req.get_uri_args()) do
+                ngx.header["X-Header-" .. string.upper(k)] = v
+            end
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_headers
+X-Header-A: 2
+X-Header-B: 3
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/07-keepalive.t

@@ -0,0 +1,240 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1 Simple interface, Connection: Keep-alive. Test the connection is reused.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            local res, err = httpc:request_uri(
+                "http://127.0.0.1:"..ngx.var.server_port.."/b", {
+                }
+            )
+
+            ngx.say(res.headers["Connection"])
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+keep-alive
+1
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2 Simple interface, Connection: close, test we don't try to keepalive, but also that subsequent connections can keepalive.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            local res, err = httpc:request_uri(
+                "http://127.0.0.1:"..ngx.var.server_port.."/b", {
+                    version = 1.0,
+                    headers = {
+                        ["Connection"] = "close",
+                    },
+                }
+            )
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+            
+            httpc:set_keepalive()
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+0
+1
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 3 Generic interface, Connection: Keep-alive. Test the connection is reused.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            local body = res:read_body()
+
+            ngx.say(res.headers["Connection"])
+            ngx.say(httpc:set_keepalive())
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+keep-alive
+1
+1
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 4 Generic interface, Connection: Close. Test we don't try to keepalive, but also that subsequent connections can keepalive.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                version = 1.0,
+                headers = {
+                    ["Connection"] = "Close",
+                },
+                path = "/b"
+            }
+
+            local body = res:read_body()
+
+            ngx.say(res.headers["Connection"])
+            local r, e = httpc:set_keepalive()
+            ngx.say(r)
+            ngx.say(e)
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+
+            httpc:set_keepalive()
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+close
+2
+connection must be closed
+0
+1
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 5: Generic interface, HTTP 1.0, no connection header. Test we don't try to keepalive, but also that subsequent connections can keepalive.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", 12345)
+
+            local res, err = httpc:request{
+                version = 1.0,
+                path = "/b"
+            }
+
+            local body = res:read_body()
+            ngx.print(body)
+
+            ngx.say(res.headers["Connection"])
+
+            local r, e = httpc:set_keepalive()
+            ngx.say(r)
+            ngx.say(e)
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+
+            httpc:set_keepalive()
+
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            ngx.say(httpc:get_reused_times())
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- tcp_listen: 12345
+--- tcp_reply
+HTTP/1.0 200 OK
+Date: Fri, 08 Aug 2016 08:12:31 GMT
+Server: OpenResty
+
+OK
+--- response_body
+OK
+nil
+2
+connection must be closed
+0
+1
+--- no_error_log
+[error]
+[warn]

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/08-pipeline.t

@@ -0,0 +1,143 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1 Test that pipelined reqests can be read correctly.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            
+            local responses = httpc:request_pipeline{
+                {
+                    path = "/b",
+                },
+                {
+                    path = "/c",
+                },
+                {
+                    path = "/d",
+                }
+            }
+
+            for i,r in ipairs(responses) do
+                if r.status then
+                    ngx.say(r.status)
+                    ngx.say(r.headers["X-Res"])
+                    ngx.say(r:read_body())
+                end
+            end
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.status = 200
+            ngx.header["X-Res"] = "B"
+            ngx.print("B")
+        ';
+    }
+    location = /c {
+        content_by_lua '
+            ngx.status = 404
+            ngx.header["X-Res"] = "C"
+            ngx.print("C")
+        ';
+    }
+    location = /d {
+        content_by_lua '
+            ngx.status = 200
+            ngx.header["X-Res"] = "D"
+            ngx.print("D")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+200
+B
+B
+404
+C
+C
+200
+D
+D
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: Test we can handle timeouts on reading the pipelined requests.
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            httpc:set_timeout(1)
+            
+            local responses = httpc:request_pipeline{
+                {
+                    path = "/b",
+                },
+                {
+                    path = "/c",
+                },
+            }
+
+            for i,r in ipairs(responses) do
+                if r.status then
+                    ngx.say(r.status)
+                    ngx.say(r.headers["X-Res"])
+                    ngx.say(r:read_body())
+                end
+            end
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.status = 200
+            ngx.header["X-Res"] = "B"
+            ngx.print("B")
+        ';
+    }
+    location = /c {
+        content_by_lua '
+            ngx.status = 404
+            ngx.header["X-Res"] = "C"
+            ngx.sleep(1)
+            ngx.print("C")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+200
+B
+B
+--- no_error_log
+[warn]
+--- error_log eval
+[qr/timeout/]

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/09-ssl.t

@@ -0,0 +1,59 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: parse_uri returns port 443 for https URIs
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            local parsed = httpc:parse_uri("https://www.google.com/foobar")
+            ngx.say(parsed[3])
+        ';
+    }
+--- request
+GET /a
+--- response_body
+443
+--- no_error_log
+[error]
+[warn]
+
+=== TEST 2: parse_uri returns port 80 for http URIs
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            local parsed = httpc:parse_uri("http://www.google.com/foobar")
+            ngx.say(parsed[3])
+        ';
+    }
+--- request
+GET /a
+--- response_body
+80
+--- no_error_log
+[error]
+[warn]

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/10-clientbodyreader.t

@@ -0,0 +1,57 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Issue a notice (but do not error) if trying to read the request body in a subrequest
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        echo_location /b;
+    }
+    location = /b {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/c",
+                headers = {
+                    ["Content-Type"] = "application/x-www-form-urlencoded",
+                }
+            }
+            if not res then
+                ngx.say(err)
+            end
+            ngx.print(res:read_body())
+            httpc:close()
+        ';
+    }
+    location /c {
+        echo "OK";
+    }
+--- request
+GET /a
+--- response_body
+OK
+--- no_error_log
+[error]
+[warn]
+

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/11-proxy.t

@@ -0,0 +1,152 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 5);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Proxy GET request and response
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a_prx {
+        rewrite ^(.*)_prx$ $1 break;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            httpc:proxy_response(httpc:proxy_request())
+            httpc:set_keepalive()
+        ';
+    }
+    location = /a {
+        content_by_lua '
+            ngx.status = 200
+            ngx.header["X-Test"] = "foo"
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a_prx
+--- response_body
+OK
+--- response_headers
+X-Test: foo
+--- error_code: 200
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: Proxy POST request and response
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a_prx {
+        rewrite ^(.*)_prx$ $1 break;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            httpc:proxy_response(httpc:proxy_request())
+            httpc:set_keepalive()
+        ';
+    }
+    location = /a {
+        lua_need_request_body on;
+        content_by_lua '
+            ngx.status = 404
+            ngx.header["X-Test"] = "foo"
+            local args, err = ngx.req.get_post_args()
+            ngx.say(args["foo"])
+            ngx.say(args["hello"])
+        ';
+    }
+--- request
+POST /a_prx
+foo=bar&hello=world
+--- response_body
+bar
+world
+--- response_headers
+X-Test: foo
+--- error_code: 404
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 3: Proxy multiple headers
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a_prx {
+        rewrite ^(.*)_prx$ $1 break;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            httpc:proxy_response(httpc:proxy_request())
+            httpc:set_keepalive()
+        ';
+    }
+    location = /a {
+        content_by_lua '
+            ngx.status = 200
+            ngx.header["Set-Cookie"] = { "cookie1", "cookie2" }
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a_prx
+--- response_body
+OK
+--- raw_response_headers_like: .*Set-Cookie: cookie1\r\nSet-Cookie: cookie2\r\n
+--- error_code: 200
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 4: Proxy still works with spaces in URI
+--- http_config eval: $::HttpConfig
+--- config
+    location = "/a_ b_prx" {
+        rewrite ^(.*)_prx$ $1 break;
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+            httpc:proxy_response(httpc:proxy_request())
+            httpc:set_keepalive()
+        ';
+    }
+    location = "/a_ b" {
+        content_by_lua '
+            ngx.status = 200
+            ngx.header["X-Test"] = "foo"
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a_%20b_prx
+--- response_body
+OK
+--- response_headers
+X-Test: foo
+--- error_code: 200
+--- no_error_log
+[error]
+[warn]

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/12-case_insensitive_headers.t

@@ -0,0 +1,160 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 4);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Test header normalisation
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http_headers = require "resty.http_headers"
+
+            local headers = http_headers.new()
+
+            headers.x_a_header = "a"
+            headers["x-b-header"] = "b"
+            headers["X-C-Header"] = "c"
+            headers["X_d-HEAder"] = "d"
+
+            ngx.say(headers["X-A-Header"])
+            ngx.say(headers.x_b_header)
+            
+            for k,v in pairs(headers) do
+                ngx.say(k, ": ", v)
+            end
+        ';
+    }
+--- request
+GET /a
+--- response_body
+a
+b
+x-b-header: b
+x-a-header: a
+X-d-HEAder: d
+X-C-Header: c
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 2: Test headers can be accessed in all cases
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b"
+            }
+
+            ngx.status = res.status
+            ngx.say(res.headers["X-Foo-Header"])
+            ngx.say(res.headers["x-fOo-heaDeR"])
+            ngx.say(res.headers.x_foo_header)
+            
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.header["X-Foo-Header"] = "bar"
+            ngx.say("OK")
+        ';
+    }
+--- request
+GET /a
+--- response_body
+bar
+bar
+bar
+--- no_error_log
+[error]
+[warn]
+
+
+=== TEST 3: Test request headers are normalised
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            httpc:connect("127.0.0.1", ngx.var.server_port)
+
+            local res, err = httpc:request{
+                path = "/b",
+                headers = {
+                    ["uSeR-AgENT"] = "test_user_agent",
+                    x_foo = "bar",
+                },
+            }
+
+            ngx.status = res.status
+            ngx.print(res:read_body())
+            
+            httpc:close()
+        ';
+    }
+    location = /b {
+        content_by_lua '
+            ngx.say(ngx.req.get_headers()["User-Agent"])
+            ngx.say(ngx.req.get_headers()["X-Foo"])
+        ';
+    }
+--- request
+GET /a
+--- response_body
+test_user_agent
+bar
+--- no_error_log
+[error]
+
+
+=== TEST 4: Test that headers remain unique
+--- http_config eval: $::HttpConfig
+--- config
+    location = /a {
+        content_by_lua '
+            local http_headers = require "resty.http_headers"
+
+            local headers = http_headers.new()
+
+            headers["x-a-header"] = "a"
+            headers["X-A-HEAder"] = "b"
+
+            for k,v in pairs(headers) do
+            ngx.log(ngx.DEBUG, k, ": ", v)
+                ngx.header[k] = v
+            end
+        ';
+    }
+--- request
+GET /a
+--- response_headers
+x-a-header: b
+--- no_error_log
+[error]
+[warn]
+[warn]

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/13-default-path.t

@@ -0,0 +1,52 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 3);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: request_uri (check the default path)
+--- http_config eval: $::HttpConfig
+--- config
+    location /lua {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+            
+            local res, err = httpc:request_uri("http://127.0.0.1:"..ngx.var.server_port)
+
+            if res and 200 == res.status then
+                ngx.say("OK")
+            else
+                ngx.say("FAIL")
+            end
+        ';
+    }
+
+    location =/ {
+        content_by_lua '
+            ngx.print("OK")
+        ';
+    }
+--- request
+GET /lua
+--- response_body
+OK
+--- no_error_log
+[error]
+

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/14-host-header.t

@@ -0,0 +1,161 @@
+# vim:set ft= ts=4 sw=4 et:
+
+use Test::Nginx::Socket;
+use Cwd qw(cwd);
+
+plan tests => repeat_each() * (blocks() * 3);
+
+my $pwd = cwd();
+
+our $HttpConfig = qq{
+    lua_package_path "$pwd/lib/?.lua;;";
+    error_log logs/error.log debug;
+    resolver 8.8.8.8;
+};
+
+$ENV{TEST_NGINX_RESOLVER} = '8.8.8.8';
+$ENV{TEST_NGINX_PWD} ||= $pwd;
+
+sub read_file {
+    my $infile = shift;
+    open my $in, $infile
+        or die "cannot open $infile for reading: $!";
+    my $cert = do { local $/; <$in> };
+    close $in;
+    $cert;
+}
+
+our $TestCertificate = read_file("t/cert/test.crt");
+our $TestCertificateKey = read_file("t/cert/test.key");
+
+no_long_string();
+#no_diff();
+
+run_tests();
+
+__DATA__
+=== TEST 1: Default HTTP port is not added to Host header
+--- http_config eval: $::HttpConfig
+--- config
+    location /lua {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local res, err = httpc:request_uri("http://www.google.com")
+        ';
+    }
+--- request
+GET /lua
+--- no_error_log
+[error]
+--- error_log
+Host: www.google.com
+
+
+=== TEST 2: Default HTTPS port is not added to Host header
+--- http_config eval: $::HttpConfig
+--- config
+    location /lua {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local res, err = httpc:request_uri("https://www.google.com:443", { ssl_verify = false })
+        ';
+    }
+--- request
+GET /lua
+--- no_error_log
+[error]
+--- error_log
+Host: www.google.com
+
+
+=== TEST 3: Non-default HTTP port is added to Host header
+--- http_config
+    lua_package_path "$TEST_NGINX_PWD/lib/?.lua;;";
+    error_log logs/error.log debug;
+    resolver 8.8.8.8;
+    server {
+        listen *:8080;
+    }
+--- config
+    location /lua {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local res, err = httpc:request_uri("http://127.0.0.1:8080")
+        ';
+    }
+--- request
+GET /lua
+--- no_error_log
+[error]
+--- error_log
+Host: 127.0.0.1:8080
+
+
+=== TEST 4: Non-default HTTPS port is added to Host header
+--- http_config
+    lua_package_path "$TEST_NGINX_PWD/lib/?.lua;;";
+    error_log logs/error.log debug;
+    resolver 8.8.8.8;
+    server {
+        listen *:8080;
+        listen *:8081 ssl;
+        ssl_certificate ../html/test.crt;
+        ssl_certificate_key ../html/test.key;
+    }
+--- config
+    location /lua {
+        content_by_lua '
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local res, err = httpc:request_uri("https://127.0.0.1:8081", { ssl_verify = false })
+        ';
+    }
+--- user_files eval
+">>> test.key
+$::TestCertificateKey
+>>> test.crt
+$::TestCertificate"
+--- request
+GET /lua
+--- no_error_log
+[error]
+--- error_log
+Host: 127.0.0.1:8081
+
+
+=== TEST 5: No host header on a unix domain socket returns a useful error.
+--- http_config eval: $::HttpConfig
+--- config
+    location /a {
+        content_by_lua_block {
+            local http = require "resty.http"
+            local httpc = http.new()
+
+            local res, err = httpc:connect("unix:test.sock")
+            if not res then
+                ngx.log(ngx.ERR, err)
+            end
+
+            local res, err = httpc:request({ path = "/" })
+            if not res then
+                ngx.say(err)
+            else
+                ngx.say(res:read_body())
+            end
+        }
+    }
+--- tcp_listen: test.sock
+--- tcp_reply: OK
+--- request
+GET /a
+--- no_error_log
+[error]
+--- response_body
+Unable to generate a useful Host header for a unix domain socket. Please provide one.

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/cert/test.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIID8DCCAtigAwIBAgIJALL9eJPZ6neGMA0GCSqGSIb3DQEBBQUAMFgxCzAJBgNV
+BAYTAkdCMQ0wCwYDVQQIEwRUZXN0MQ0wCwYDVQQHEwRUZXN0MQ0wCwYDVQQKEwRU
+ZXN0MQ0wCwYDVQQLEwRUZXN0MQ0wCwYDVQQDEwR0ZXN0MB4XDTE1MTAyMTE2MjQ1
+NloXDTE1MTEyMDE2MjQ1NlowWDELMAkGA1UEBhMCR0IxDTALBgNVBAgTBFRlc3Qx
+DTALBgNVBAcTBFRlc3QxDTALBgNVBAoTBFRlc3QxDTALBgNVBAsTBFRlc3QxDTAL
+BgNVBAMTBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDz/AoE
+c+TPdm+Aqcchq8fLNWksFQZqbsCBGnq8rUG1b6MsVlAOkDUQGRlNPs9v0/+pzgX7
+IYXPCFcV7YONNsTUfvBYTq43mfOycmAdb3SX6kBygxdhYsDRZR+vCAIkjoRmRB20
+meh1motqM58spq3IcT8VADTRJl1OI48VTnxmXdCtmkOymU948DcauMoxm03eL/hU
+6eniNEujbnbB305noNG0W5c3h6iz9CvqUAD1kwyjick+f1atB2YYn1bymA+db6YN
+3iTo0v2raWmIc7D+qqpkNaCRxgMb2HN6X3/SfkijtNJidjqHMbs2ftlKJ5/lODPZ
+rCPQOcYK6TT8MIZ1AgMBAAGjgbwwgbkwHQYDVR0OBBYEFFUC1GrAhUp7IvJH5iyf
++fJQliEIMIGJBgNVHSMEgYEwf4AUVQLUasCFSnsi8kfmLJ/58lCWIQihXKRaMFgx
+CzAJBgNVBAYTAkdCMQ0wCwYDVQQIEwRUZXN0MQ0wCwYDVQQHEwRUZXN0MQ0wCwYD
+VQQKEwRUZXN0MQ0wCwYDVQQLEwRUZXN0MQ0wCwYDVQQDEwR0ZXN0ggkAsv14k9nq
+d4YwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAtaUQOr3Qn87KXmmP
+GbSvCLSl+bScE09VYZsYaB6iq0pGN9y+Vh4/HjBUUsFexopw1dY25MEEJXEVi1xV
+2krLYAsfKCM6c1QBVmdqfVuxUvxpXwr+CNRNAlzz6PhjkeY/Ds/j4sg7EqN8hMmT
+gu8GuogX7+ZCgrzRSMMclWej+W8D1xSIuCC+rqv4w9SZdtVb3XGpCyizpTNsQAuV
+ACXvq9KXkEEj+XNvKrNdWd4zG715RdMnVm+WM53d9PLp63P+4/kwhwHULYhXygQ3
+DzzVPaojBBdw3VaHbbPHnv73FtAzOb7ky6zJ01DlmEPxEahCFpklMkY9T2uCdpj9
+oOzaNA==
+-----END CERTIFICATE-----

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/t/cert/test.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA8/wKBHPkz3ZvgKnHIavHyzVpLBUGam7AgRp6vK1BtW+jLFZQ
+DpA1EBkZTT7Pb9P/qc4F+yGFzwhXFe2DjTbE1H7wWE6uN5nzsnJgHW90l+pAcoMX
+YWLA0WUfrwgCJI6EZkQdtJnodZqLajOfLKatyHE/FQA00SZdTiOPFU58Zl3QrZpD
+splPePA3GrjKMZtN3i/4VOnp4jRLo252wd9OZ6DRtFuXN4eos/Qr6lAA9ZMMo4nJ
+Pn9WrQdmGJ9W8pgPnW+mDd4k6NL9q2lpiHOw/qqqZDWgkcYDG9hzel9/0n5Io7TS
+YnY6hzG7Nn7ZSief5Tgz2awj0DnGCuk0/DCGdQIDAQABAoIBAGjKc7L94+SHRdTJ
+FtILacCJrCZW0W6dKulIajbnYzV+QWMlnzTiEyha31ciBw5My54u8rqt5z7Ioj60
+yK+6OkfaTXhgMsuGv/iAz29VE4q7/fow+7XEKHTHLhiLJAB3hb42u1t6TzFTs1Vl
+3pPa8wEIQsPOVuENzT1mYGoST7PW+LBIMr9ScMnRHfC0MNdV/ntQiXideOAd5PkA
+4O7fNgYZ8CTAZ8rOLYTMFF76/c/jLiqfeghqbIhqMykk36kd7Lud//FRykVsn1aJ
+REUva/SjVEth5kITot1hpMC4SIElWpha2YxiiZFoSXSaUbtHpymiUGV01cYtMWk0
+MZ5HN3ECgYEA/74U8DpwPxd4up9syKyNqOqrCrYnhEEC/tdU/W5wECi4y5kppjdd
+88lZzICVPzk2fezYXlCO9HiSHU1UfcEsY3u16qNCvylK7Qz1OqXV/Ncj59891Q5Z
+K0UBcbnrv+YD6muZuhlHEbyDPqYO091G9Gf/BbL5JIBDzg1qFO9Dh9cCgYEA9Drt
+O9PJ5Sjz3mXQVtVHpwyhOVnd7CUv8a1zkUQCK5uQeaiF5kal1FIo7pLOr3KAvG0C
+pXbm/TobwlfAfcERQN88aPN8Z/l1CB0oKV6ipBMD2/XLzDRtx8lpTeh/BB8jIhrz
++FDJY54HCzLfW0P5kT+Cyw51ofjziPnFdO/Z6pMCgYEAon17gEchGnUnWCwDSl2Y
+hELV+jBSW02TQag/b+bDfQDiqTnfpKR5JXRBghYQveL0JH5f200EB4C0FboUfPJH
+6c2ogDTLK/poiMU66tCDbeqj/adx+fTr4votOL0QdRUIV+GWAxAcf8BvA1cvBJ4L
+fy60ckKM2gxFCJ6tUC/VkHECgYBoMDNAUItSnXPbrmeAg5/7naGxy6qmsP6RBUPF
+9tNOMyEhJUlqAT2BJEOd8zcFFb3hpEd6uwyzfnSVJcZSX2iy2gj1ZNnvqTXJ7lZR
+v7N2dz4wOd1lEgC7OCsaN1LoOThNtl3Z0uz2+FVc66jpUEhJNGThpxt7q66JArS/
+vAqkzQKBgFkzqA6QpnH5KhOCoZcuLQ4MtvnNHOx1xSm2B0gKDVJzGkHexTmOJvwM
+ZhHXRl9txS4icejS+AGUXNBzCWEusfhDaZpZqS6zt6UxEjMsLj/Te7z++2KQn4t/
+aI77jClydW1pJvICtqm5v+sukVZvQTTJza9ujta6fj7u2s671np9
+-----END RSA PRIVATE KEY-----

controllers/ext_nginx/rootfs/etc/nginx/lua/vendor/lua-resty-http/util/lua-releng

@@ -0,0 +1,63 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+
+sub file_contains ($$);
+
+my $version;
+for my $file (map glob, qw{ *.lua lib/*.lua lib/*/*.lua lib/*/*/*.lua lib/*/*/*/*.lua lib/*/*/*/*/*.lua }) {
+    # Check the sanity of each .lua file
+    open my $in, $file or
+        die "ERROR: Can't open $file for reading: $!\n";
+    my $found_ver;
+    while (<$in>) {
+        my ($ver, $skipping);
+        if (/(?x) (?:_VERSION) \s* = .*? ([\d\.]*\d+) (.*? SKIP)?/) {
+            my $orig_ver = $ver = $1;
+            $found_ver = 1;
+            #        $skipping = $2;
+            $ver =~ s{^(\d+)\.(\d{3})(\d{3})$}{join '.', int($1), int($2), int($3)}e;
+            warn "$file: $orig_ver ($ver)\n";
+
+        } elsif (/(?x) (?:_VERSION) \s* = \s* ([a-zA-Z_]\S*)/) {
+            warn "$file: $1\n";
+            $found_ver = 1;
+            last;
+        }
+
+        if ($ver and $version and !$skipping) {
+            if ($version ne $ver) {
+                #    die "$file: $ver != $version\n";
+            }
+        } elsif ($ver and !$version) {
+            $version = $ver;
+        }
+    }
+    if (!$found_ver) {
+        warn "WARNING: No \"_VERSION\" or \"version\" field found in `$file`.\n";
+    }
+    close $in;
+
+    print "Checking use of Lua global variables in file $file ...\n";
+    system("luac -p -l $file | grep ETGLOBAL | grep -vE 'require|type|tostring|error|ngx|ndk|jit|setmetatable|getmetatable|string|table|io|os|print|tonumber|math|pcall|xpcall|unpack|pairs|ipairs|assert|module|package|coroutine|[gs]etfenv|next|select|rawset|rawget|debug'");
+    #file_contains($file, "attempt to write to undeclared variable");
+    system("grep -H -n -E --color '.{120}' $file");
+}
+
+sub file_contains ($$) {
+    my ($file, $regex) = @_;
+    open my $in, $file
+        or die "Cannot open $file fo reading: $!\n";
+    my $content = do { local $/; <$in> };
+    close $in;
+    #print "$content";
+    return scalar ($content =~ /$regex/);
+}
+
+if (-d 't') {
+    for my $file (map glob, qw{ t/*.t t/*/*.t t/*/*/*.t }) {
+        system(qq{grep -H -n --color -E '\\--- ?(ONLY|LAST)' $file});
+    }
+}
+

controllers/ext_nginx/rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,6 @@
+# A very simple nginx configuration file that forces nginx to start.
+pid /run/nginx.pid;
+
+events {}
+http {}
+daemon off;

controllers/ext_nginx/rootfs/etc/nginx/template/nginx.tmpl

@@ -0,0 +1,662 @@
+{{ $cfg := .Cfg }}
+{{ $IsIPV6Enabled := .IsIPV6Enabled }}
+{{ $healthzURI := .HealthzURI }}
+{{ $backends := .Backends }}
+{{ $proxyHeaders := .ProxySetHeaders }}
+{{ $addHeaders := .AddHeaders }}
+daemon off;
+
+worker_processes {{ $cfg.WorkerProcesses }};
+pid /run/nginx.pid;
+{{ if ne .MaxOpenFiles 0 }}
+worker_rlimit_nofile {{ .MaxOpenFiles }};
+{{ end}}
+
+events {
+    multi_accept        on;
+    worker_connections  {{ $cfg.MaxWorkerConnections }};
+    use                 epoll;
+}
+
+http {
+    {{/* we use the value of the header X-Forwarded-For to be able to use the geo_ip module */}}
+    {{ if $cfg.UseProxyProtocol }}
+    {{ range $trusted_ip := $cfg.ProxyRealIPCIDR }}
+    set_real_ip_from    {{ $trusted_ip }};
+    {{ end }}
+    real_ip_header      proxy_protocol;
+    {{ else }}
+    {{ range $trusted_ip := $cfg.ProxyRealIPCIDR }}
+    set_real_ip_from    {{ $trusted_ip }};
+    {{ end }}
+    real_ip_header      X-Forwarded-For;
+    {{ end }}
+
+    real_ip_recursive   on;
+
+    {{/* databases used to determine the country depending on the client IP address */}}
+    {{/* http://nginx.org/en/docs/http/ngx_http_geoip_module.html */}}
+    {{/* this is require to calculate traffic for individual country using GeoIP in the status page */}}
+    geoip_country       /etc/nginx/GeoIP.dat;
+    geoip_city          /etc/nginx/GeoLiteCity.dat;
+    geoip_proxy_recursive on;
+
+    {{ if $cfg.EnableVtsStatus }}
+    vhost_traffic_status_zone shared:vhost_traffic_status:{{ $cfg.VtsStatusZoneSize }};
+    vhost_traffic_status_filter_by_set_key $geoip_country_code country::*;
+    {{ end }}
+
+    # lua section to return proper error codes when custom pages are used
+    lua_package_path '.?.lua;/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/lua-resty-http/lib/?.lua;';
+    init_by_lua_block {
+        require("error_page")
+    }
+
+    sendfile            on;
+    aio                 threads;
+    tcp_nopush          on;
+    tcp_nodelay         on;
+
+    log_subrequest      on;
+
+    reset_timedout_connection on;
+
+    keepalive_timeout  {{ $cfg.KeepAlive }}s;
+    keepalive_requests {{ $cfg.KeepAliveRequests }};
+
+    client_header_buffer_size       {{ $cfg.ClientHeaderBufferSize }};
+    large_client_header_buffers     {{ $cfg.LargeClientHeaderBuffers }};
+    client_body_buffer_size         {{ $cfg.ClientBodyBufferSize }};
+
+    http2_max_field_size            {{ $cfg.HTTP2MaxFieldSize }};
+    http2_max_header_size           {{ $cfg.HTTP2MaxHeaderSize }};
+
+    types_hash_max_size             2048;
+    server_names_hash_max_size      {{ $cfg.ServerNameHashMaxSize }};
+    server_names_hash_bucket_size   {{ $cfg.ServerNameHashBucketSize }};
+    map_hash_bucket_size            {{ $cfg.MapHashBucketSize }};
+
+    proxy_headers_hash_max_size     {{ $cfg.ProxyHeadersHashMaxSize }};
+    proxy_headers_hash_bucket_size  {{ $cfg.ProxyHeadersHashBucketSize }};
+
+    variables_hash_bucket_size      {{ $cfg.VariablesHashBucketSize }};
+    variables_hash_max_size         {{ $cfg.VariablesHashMaxSize }};
+
+    underscores_in_headers          {{ if $cfg.EnableUnderscoresInHeaders }}on{{ else }}off{{ end }};
+    ignore_invalid_headers          {{ if $cfg.IgnoreInvalidHeaders }}on{{ else }}off{{ end }};
+
+    include /etc/nginx/mime.types;
+    default_type text/html;
+    {{ if $cfg.UseGzip }}
+    gzip on;
+    gzip_comp_level 5;
+    gzip_http_version 1.1;
+    gzip_min_length 256;
+    gzip_types {{ $cfg.GzipTypes }};
+    gzip_proxied any;
+    {{ end }}
+
+    # Custom headers for response
+    {{ range $k, $v := $addHeaders }}
+    add_header {{ $k }}            "{{ $v }}";
+    {{ end }}
+
+    server_tokens {{ if $cfg.ShowServerTokens }}on{{ else }}off{{ end }};
+
+    # disable warnings
+    uninitialized_variable_warn off;
+
+    log_format upstreaminfo {{ if $cfg.LogFormatEscapeJSON }}escape=json {{ end }}'{{ buildLogFormatUpstream $cfg }}';
+
+    {{/* map urls that should not appear in access.log */}}
+    {{/* http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log */}}
+    map $request_uri $loggable {
+        {{ range $reqUri := $cfg.SkipAccessLogURLs }}
+        {{ $reqUri }} 0;{{ end }}
+        default 1;
+    }
+
+    {{ if $cfg.DisableAccessLog }}
+    access_log off;
+    {{ else }}
+    access_log /var/log/nginx/access.log upstreaminfo if=$loggable;
+    {{ end }}
+    error_log  /var/log/nginx/error.log {{ $cfg.ErrorLogLevel }};
+
+    {{ buildResolvers $cfg.Resolver }}
+
+    {{/* Whenever nginx proxies a request without a "Connection" header, the "Connection" header is set to "close" */}}
+    {{/* when making the target request.  This means that you cannot simply use */}}
+    {{/* "proxy_set_header Connection $http_connection" for WebSocket support because in this case, the */}}
+    {{/* "Connection" header would be set to "" whenever the original request did not have a "Connection" header, */}}
+    {{/* which would mean no "Connection" header would be in the target request.  Since this would deviate from */}}
+    {{/* normal nginx behavior we have to use this approach. */}}
+    # Retain the default nginx handling of requests without a "Connection" header
+    map $http_upgrade $connection_upgrade {
+        default          upgrade;
+        ''               close;
+    }
+
+    # trust http_x_forwarded_proto headers correctly indicate ssl offloading
+    map $http_x_forwarded_proto $pass_access_scheme {
+        default          $http_x_forwarded_proto;
+        ''               $scheme;
+    }
+
+    map $http_x_forwarded_port $pass_server_port {
+       default           $http_x_forwarded_port;
+       ''                $server_port;
+    }
+
+    {{ if $cfg.UseProxyProtocol }}
+    map $http_x_forwarded_for $the_real_ip {
+        default          $http_x_forwarded_for;
+        ''               $proxy_protocol_addr;
+    }
+    {{ else }}
+    map $http_x_forwarded_for $the_real_ip {
+        default          $http_x_forwarded_for;
+        ''               $remote_addr;
+    }
+    {{ end }}
+
+    # map port 442 to 443 for header X-Forwarded-Port
+    map $pass_server_port $pass_port {
+        442              443;
+        default          $pass_server_port;
+    }
+
+    # Map a response error watching the header Content-Type
+    map $http_accept $httpAccept {
+        default          html;
+        application/json json;
+        application/xml  xml;
+        text/plain       text;
+    }
+
+    map $httpAccept $httpReturnType {
+        default          text/html;
+        json             application/json;
+        xml              application/xml;
+        text             text/plain;
+    }
+
+    # Obtain best http host
+    map $http_host $this_host {
+        default          $http_host;
+        ''               $host;
+    }
+
+    map $http_x_forwarded_host $best_http_host {
+        default          $http_x_forwarded_host;
+        ''               $this_host;
+    }
+
+    server_name_in_redirect off;
+    port_in_redirect        off;
+
+    ssl_protocols {{ $cfg.SSLProtocols }};
+
+    # turn on session caching to drastically improve performance
+    {{ if $cfg.SSLSessionCache }}
+    ssl_session_cache builtin:1000 shared:SSL:{{ $cfg.SSLSessionCacheSize }};
+    ssl_session_timeout {{ $cfg.SSLSessionTimeout }};
+    {{ end }}
+
+    # allow configuring ssl session tickets
+    ssl_session_tickets {{ if $cfg.SSLSessionTickets }}on{{ else }}off{{ end }};
+
+    # slightly reduce the time-to-first-byte
+    ssl_buffer_size {{ $cfg.SSLBufferSize }};
+
+    {{ if not (empty $cfg.SSLCiphers) }}
+    # allow configuring custom ssl ciphers
+    ssl_ciphers '{{ $cfg.SSLCiphers }}';
+    ssl_prefer_server_ciphers on;
+    {{ end }}
+
+    {{ if not (empty $cfg.SSLDHParam) }}
+    # allow custom DH file http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
+    ssl_dhparam {{ $cfg.SSLDHParam }};
+    {{ end }}
+
+    {{ if not $cfg.EnableDynamicTLSRecords }}
+    ssl_dyn_rec_size_lo 0;
+    {{ end }}
+
+    ssl_ecdh_curve {{ $cfg.SSLECDHCurve }};
+
+    {{ if .CustomErrors }}
+    # Custom error pages
+    proxy_intercept_errors on;
+    {{ end }}
+
+    {{ range $errCode := $cfg.CustomHTTPErrors }}
+    error_page {{ $errCode }} = @custom_{{ $errCode }};{{ end }}
+
+    proxy_ssl_session_reuse on;
+
+    {{ if $cfg.AllowBackendServerHeader }}
+    proxy_pass_header Server;
+    {{ end }}
+
+    {{ range $name, $upstream := $backends }}
+    {{ if eq $upstream.SessionAffinity.AffinityType "cookie" }}
+    upstream sticky-{{ $upstream.Name }} {
+        sticky hash={{ $upstream.SessionAffinity.CookieSessionAffinity.Hash }} name={{ $upstream.SessionAffinity.CookieSessionAffinity.Name }}  httponly;
+
+        {{ if (gt $cfg.UpstreamKeepaliveConnections 0) }}
+        keepalive {{ $cfg.UpstreamKeepaliveConnections }};
+        {{ end }}
+
+        {{ range $server := $upstream.Endpoints }}server {{ $server.Address | formatIP }}:{{ $server.Port }} max_fails={{ $server.MaxFails }} fail_timeout={{ $server.FailTimeout }};
+        {{ end }}
+    }
+    {{ end }}
+
+    upstream {{ $upstream.Name }} {
+        # Load balance algorithm; empty for round robin, which is the default
+        {{ if ne $cfg.LoadBalanceAlgorithm "round_robin" }}
+        {{ $cfg.LoadBalanceAlgorithm }};
+        {{ end }}
+
+        {{ if (gt $cfg.UpstreamKeepaliveConnections 0) }}
+        keepalive {{ $cfg.UpstreamKeepaliveConnections }};
+        {{ end }}
+
+        {{ range $server := $upstream.Endpoints }}server {{ $server.Address | formatIP }}:{{ $server.Port }} max_fails={{ $server.MaxFails }} fail_timeout={{ $server.FailTimeout }};
+        {{ end }}
+    }
+    {{ end }}
+
+    {{/* build the maps that will be use to validate the Whitelist */}}
+    {{ range $index, $server := .Servers }}
+    {{ range $location := $server.Locations }}
+    {{ $path := buildLocation $location }}
+
+    {{ if isLocationAllowed $location }}
+    {{ if gt (len $location.Whitelist.CIDR) 0 }}
+    geo $the_real_ip {{ buildDenyVariable (print $server.Hostname "_"  $path) }} {
+        default 1;
+
+        {{ range $ip := $location.Whitelist.CIDR }}
+        {{ $ip }} 0;{{ end }}
+    }
+    {{ end }}
+    {{ end }}
+    {{ end }}
+    {{ end }}
+
+    {{/* build all the required rate limit zones. Each annotation requires a dedicated zone */}}
+    {{/* 1MB -> 16 thousand 64-byte states or about 8 thousand 128-byte states */}}
+    {{ range $zone := (buildRateLimitZones $cfg.LimitConnZoneVariable .Servers) }}
+    {{ $zone }}
+    {{ end }}
+
+    {{ $backlogSize := .BacklogSize }}
+    {{ range $index, $server := .Servers }}
+    server {
+        server_name {{ $server.Hostname }};
+        listen 80{{ if $cfg.UseProxyProtocol }} proxy_protocol{{ end }}{{ if eq $server.Hostname "_"}} default_server reuseport backlog={{ $backlogSize }}{{end}};
+        {{ if $IsIPV6Enabled }}listen [::]:80{{ if $cfg.UseProxyProtocol }} proxy_protocol{{ end }}{{ if eq $server.Hostname "_"}} default_server reuseport backlog={{ $backlogSize }}{{ end }};{{ end }}
+        set $proxy_upstream_name "-";
+
+        {{/* Listen on 442 because port 443 is used in the TLS sni server */}}
+        {{/* This listener must always have proxy_protocol enabled, because the SNI listener forwards on source IP info in it. */}}
+        {{ if not (empty $server.SSLCertificate) }}listen 442 proxy_protocol{{ if eq $server.Hostname "_"}} default_server reuseport backlog={{ $backlogSize }}{{end}} ssl {{ if $cfg.UseHTTP2 }}http2{{ end }};
+        {{ if $IsIPV6Enabled }}{{ if not (empty $server.SSLCertificate) }}listen [::]:442 proxy_protocol{{ end }} {{ if eq $server.Hostname "_"}} default_server reuseport backlog={{ $backlogSize }}{{end}} ssl {{ if $cfg.UseHTTP2 }}http2{{ end }};{{ end }}
+        {{/* comment PEM sha is required to detect changes in the generated configuration and force a reload */}}
+        # PEM sha: {{ $server.SSLPemChecksum }}
+        ssl_certificate                         {{ $server.SSLCertificate }};
+        ssl_certificate_key                     {{ $server.SSLCertificate }};
+        {{ end }}
+
+        {{ if (and (not (empty $server.SSLCertificate)) $cfg.HSTS) }}
+        more_set_headers                        "Strict-Transport-Security: max-age={{ $cfg.HSTSMaxAge }}{{ if $cfg.HSTSIncludeSubdomains }}; includeSubDomains{{ end }};{{ if $cfg.HSTSPreload }} preload{{ end }}";
+        {{ end }}
+
+        {{ if $cfg.EnableVtsStatus }}vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;{{ end }}
+
+        {{ range $location := $server.Locations }}
+        {{ $path := buildLocation $location }}
+        {{ $authPath := buildAuthLocation $location }}
+
+        {{ if not (empty $location.CertificateAuth.AuthSSLCert.CAFileName) }}
+        # PEM sha: {{ $location.CertificateAuth.AuthSSLCert.PemSHA }}
+        ssl_client_certificate              {{ $location.CertificateAuth.AuthSSLCert.CAFileName }};
+        ssl_verify_client on;
+        ssl_verify_depth {{ $location.CertificateAuth.ValidationDepth }};
+        {{ end }}
+
+        {{ if not (empty $location.Redirect.AppRoot)}}
+        if ($uri = /) {
+            return 302 {{ $location.Redirect.AppRoot }};
+        }
+        {{ end }}
+
+        {{ if not (empty $authPath) }}
+        location = {{ $authPath }} {
+            internal;
+            set $proxy_upstream_name "internal";
+
+            {{ if not $location.ExternalAuth.SendBody }}
+            proxy_pass_request_body     off;
+            proxy_set_header            Content-Length "";
+            {{ end }}
+            {{ if not (empty $location.ExternalAuth.Method) }}
+            proxy_method                {{ $location.ExternalAuth.Method }};
+            proxy_set_header            X-Original-URI $request_uri;
+            proxy_set_header            X-Scheme       $pass_access_scheme;
+            {{ end }}
+            proxy_pass_request_headers  on;
+            proxy_set_header            Host {{ $location.ExternalAuth.Host }};
+            proxy_ssl_server_name       on;
+
+            client_max_body_size        "{{ $location.Proxy.BodySize }}";
+
+
+            set $target {{ $location.ExternalAuth.URL }};
+            proxy_pass $target;
+        }
+        {{ end }}
+
+        location {{ $path }} {
+            set $proxy_upstream_name "{{ buildUpstreamName $server.Hostname $backends $location }}";
+
+            {{ if (or $location.Redirect.ForceSSLRedirect (and (not (empty $server.SSLCertificate)) $location.Redirect.SSLRedirect)) }}
+            # enforce ssl on server side
+            if ($pass_access_scheme = http) {
+                return 301 https://$best_http_host$request_uri;
+            }
+            {{ end }}
+
+            {{ if isLocationAllowed $location }}
+            {{ if gt (len $location.Whitelist.CIDR) 0 }}
+            if ({{ buildDenyVariable (print $server.Hostname "_"  $path) }}) {
+                return 403;
+            }
+            {{ end }}
+
+            port_in_redirect {{ if $location.UsePortInRedirects }}on{{ else }}off{{ end }};
+
+            {{ if not (empty $authPath) }}
+            # this location requires authentication
+            auth_request {{ $authPath }};
+            {{- range $idx, $line := buildAuthResponseHeaders $location }}
+            {{ $line }}
+            {{- end }}
+            {{ end }}
+
+            {{ if not (empty $location.ExternalAuth.SigninURL) }}
+            error_page 401 = {{ $location.ExternalAuth.SigninURL }};
+            {{ end }}
+
+
+            {{/* if the location contains a rate limit annotation, create one */}}
+            {{ $limits := buildRateLimit $location }}
+            {{ range $limit := $limits }}
+            {{ $limit }}{{ end }}
+
+            {{ if $location.BasicDigestAuth.Secured }}
+            {{ if eq $location.BasicDigestAuth.Type "basic" }}
+            auth_basic "{{ $location.BasicDigestAuth.Realm }}";
+            auth_basic_user_file {{ $location.BasicDigestAuth.File }};
+            {{ else }}
+            auth_digest "{{ $location.BasicDigestAuth.Realm }}";
+            auth_digest_user_file {{ $location.BasicDigestAuth.File }};
+            {{ end }}
+            proxy_set_header Authorization "";
+            {{ end }}
+
+            {{ if $location.EnableCORS }}
+            {{ template "CORS" }}
+            {{ end }}
+
+            client_max_body_size                    "{{ $location.Proxy.BodySize }}";
+
+            proxy_set_header Host                   $best_http_host;
+
+            # Pass the extracted client certificate to the backend
+            {{ if not (empty $location.CertificateAuth.AuthSSLCert.CAFileName) }}
+            proxy_set_header ssl-client-cert        $ssl_client_cert;
+            {{ end }}
+
+            # Allow websocket connections
+            proxy_set_header                        Upgrade           $http_upgrade;
+            proxy_set_header                        Connection        $connection_upgrade;
+
+            proxy_set_header X-Real-IP              $the_real_ip;
+            proxy_set_header X-Forwarded-For        $the_real_ip;
+            proxy_set_header X-Forwarded-Host       $best_http_host;
+            proxy_set_header X-Forwarded-Port       $pass_port;
+            proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
+            proxy_set_header X-Original-URI         $request_uri;
+            proxy_set_header X-Scheme               $pass_access_scheme;
+
+            # mitigate HTTPoxy Vulnerability
+            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
+            proxy_set_header Proxy                  "";
+
+            # Custom headers to proxied server
+            {{ range $k, $v := $proxyHeaders }}
+            proxy_set_header {{ $k }}                    "{{ $v }}";
+            {{ end }}
+
+            proxy_connect_timeout                   {{ $location.Proxy.ConnectTimeout }}s;
+            proxy_send_timeout                      {{ $location.Proxy.SendTimeout }}s;
+            proxy_read_timeout                      {{ $location.Proxy.ReadTimeout }}s;
+
+            proxy_redirect                          off;
+            proxy_buffering                         off;
+            proxy_buffer_size                       "{{ $location.Proxy.BufferSize }}";
+            proxy_buffers                           4 "{{ $location.Proxy.BufferSize }}";
+
+            proxy_http_version                      1.1;
+
+            proxy_cookie_domain                     {{ $location.Proxy.CookieDomain }};
+            proxy_cookie_path                       {{ $location.Proxy.CookiePath }};
+
+            # In case of errors try the next upstream server before returning an error
+            proxy_next_upstream                     {{ buildNextUpstream $location.Proxy.NextUpstream }}{{ if $cfg.RetryNonIdempotent }} non_idempotent{{ end }};
+
+            {{/* rewrite only works if the content is not compressed */}}
+            {{ if $location.Redirect.AddBaseURL }}
+            proxy_set_header                        Accept-Encoding     "";
+            {{ end }}
+
+            {{/* Add any additional configuration defined */}}
+            {{ $location.ConfigurationSnippet }}
+
+            {{ buildProxyPass $server.Hostname $backends $location }}
+            {{ else }}
+            #{{ $location.Denied }}
+            return 503;
+            {{ end }}
+        }
+        {{ end }}
+
+        {{ if eq $server.Hostname "_" }}
+        # health checks in cloud providers require the use of port 80
+        location {{ $healthzURI }} {
+            access_log off;
+            return 200;
+        }
+
+        # this is required to avoid error if nginx is being monitored
+        # with an external software (like sysdig)
+        location /nginx_status {
+            allow 127.0.0.1;
+            {{ if $IsIPV6Enabled }}allow ::1;{{ end }}
+            deny all;
+
+            access_log off;
+            stub_status on;
+        }
+        {{ end }}
+
+        {{ template "CUSTOM_ERRORS" $cfg }}
+    }
+
+    {{ end }}
+
+    # default server, used for NGINX healthcheck and access to nginx stats
+    server {
+        # Use the port 18080 (random value just to avoid known ports) as default port for nginx.
+        # Changing this value requires a change in:
+        # https://github.com/kubernetes/contrib/blob/master/ingress/controllers/nginx/nginx/command.go#L104
+        listen 18080 default_server reuseport backlog={{ .BacklogSize }};
+        {{ if $IsIPV6Enabled }}listen [::]:18080 default_server reuseport backlog={{ .BacklogSize }};{{ end }}
+        set $proxy_upstream_name "-";
+
+        location {{ $healthzURI }} {
+            access_log off;
+            return 200;
+        }
+
+        location /nginx_status {
+            set $proxy_upstream_name "internal";
+
+            {{ if $cfg.EnableVtsStatus }}
+            vhost_traffic_status_display;
+            vhost_traffic_status_display_format html;
+            {{ else }}
+            access_log off;
+            stub_status on;
+            {{ end }}
+        }
+
+        # this location is used to extract nginx metrics
+        # using prometheus.
+        # TODO: enable extraction for vts module.
+        location /internal_nginx_status {
+            set $proxy_upstream_name "internal";
+
+            allow 127.0.0.1;
+            {{ if not $cfg.DisableIpv6 }}allow ::1;{{ end }}
+            deny all;
+
+            access_log off;
+            stub_status on;
+        }
+
+        location / {
+            set $proxy_upstream_name "upstream-default-backend";
+            proxy_pass             http://upstream-default-backend;
+        }
+        {{ template "CUSTOM_ERRORS" $cfg }}
+    }
+
+    # default server for services without endpoints
+    server {
+        listen 8181;
+        set $proxy_upstream_name "-";
+
+        location / {
+            {{ if .CustomErrors }}
+            content_by_lua_block {
+                openURL(ngx.req.get_headers(0), 503)
+            }
+            {{ else }}
+            return 503;
+            {{ end }}
+        }
+    }
+}
+
+stream {
+    log_format log_stream {{ $cfg.LogFormatStream }};
+
+    {{ if $cfg.DisableAccessLog }}
+    access_log off;
+    {{ else }}
+    access_log /var/log/nginx/access.log log_stream;
+    {{ end }}
+
+    error_log  /var/log/nginx/error.log;
+
+    # TCP services
+    {{ range $i, $tcpServer := .TCPBackends }}
+    upstream tcp-{{ $tcpServer.Port }}-{{ $tcpServer.Backend.Namespace }}-{{ $tcpServer.Backend.Name }}-{{ $tcpServer.Backend.Port }} {
+    {{ range $j, $endpoint := $tcpServer.Endpoints }}
+        server                  {{ $endpoint.Address }}:{{ $endpoint.Port }};
+    {{ end }}
+    }
+    server {
+        listen                  {{ $tcpServer.Port }}{{ if $tcpServer.Backend.UseProxyProtocol }} proxy_protocol{{ end }};
+        {{ if $IsIPV6Enabled }}listen                  [::]:{{ $tcpServer.Port }}{{ if $tcpServer.Backend.UseProxyProtocol }} proxy_protocol{{ end }};{{ end }}
+        proxy_pass              tcp-{{ $tcpServer.Port }}-{{ $tcpServer.Backend.Namespace }}-{{ $tcpServer.Backend.Name }}-{{ $tcpServer.Backend.Port }};
+    }
+
+    {{ end }}
+
+    # UDP services
+    {{ range $i, $udpServer := .UDPBackends }}
+    upstream udp-{{ $udpServer.Port }}-{{ $udpServer.Backend.Namespace }}-{{ $udpServer.Backend.Name }}-{{ $udpServer.Backend.Port }} {
+    {{ range $j, $endpoint := $udpServer.Endpoints }}
+        server                  {{ $endpoint.Address }}:{{ $endpoint.Port }};
+    {{ end }}
+    }
+
+    server {
+        listen                  {{ $udpServer.Port }} udp;
+        {{ if $IsIPV6Enabled }}listen                  [::]:{{ $udpServer.Port }} udp;{{ end }}
+        proxy_responses         1;
+        proxy_pass              udp-{{ $udpServer.Port }}-{{ $udpServer.Backend.Namespace }}-{{ $udpServer.Backend.Name }}-{{ $udpServer.Backend.Port }};
+    }
+    {{ end }}
+}
+
+{{/* definition of templates to avoid repetitions */}}
+{{ define "CUSTOM_ERRORS" }}
+        {{ range $errCode := .CustomHTTPErrors }}
+        location @custom_{{ $errCode }} {
+            internal;
+            content_by_lua_block {
+                openURL(ngx.req.get_headers(0), {{ $errCode }})
+            }
+        }
+        {{ end }}
+{{ end }}
+
+{{/* CORS support from https://michielkalkman.com/snippets/nginx-cors-open-configuration.html */}}
+{{ define "CORS" }}
+     if ($request_method = 'OPTIONS') {
+        add_header 'Access-Control-Allow-Origin' '*';
+        #
+        # Om nom nom cookies
+        #
+        add_header 'Access-Control-Allow-Credentials' 'true';
+        add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS';
+        #
+        # Custom headers and headers various browsers *should* be OK with but aren't
+        #
+        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
+        #
+        # Tell client that this pre-flight info is valid for 20 days
+        #
+        add_header 'Access-Control-Max-Age' 1728000;
+        add_header 'Content-Type' 'text/plain charset=UTF-8';
+        add_header 'Content-Length' 0;
+        return 204;
+     }
+     set $cors_method 0;
+     if ($request_method = 'GET') {
+        set $cors_method 1;
+     }
+     if ($request_method = 'PUT') {
+        set $cors_method 1;
+     }
+     if ($request_method = 'POST') {
+        set $cors_method 1;
+     }
+     if ($request_method = 'DELETE') {
+        set $cors_method 1;
+     }
+
+     if ($cors_method = 1) {
+        add_header 'Access-Control-Allow-Origin' '*' always;
+        add_header 'Access-Control-Allow-Credentials' 'true';
+        add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS';
+        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
+     }
+{{ end }}

controllers/ext_nginx/rootfs/ingress-controller/clean-nginx-conf.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# This script removes consecutive empty lines in nginx.conf
+# Using sed is more simple than using a go regex
+
+# first sed removes empty lines
+# second sed command replaces the empty lines
+sed -e 's/^  *$/\'$'\n/g' | sed -e '/^$/{N;/^\n$/d;}'

controllers/ext_nginx/rootfs/nginx-ingress-controller.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Kubernetes nginx-ingress controller.
+Documentation=https://github.com/GoogleCloudPlatform/kubernetes
+
+[Service]
+User=root
+Environment=POD_NAMESPACE=default
+Environment=POD_NAME=default
+ExecStart=./ingress-controller/nginx-ingress-controller --default-backend-service=REPLACEME --apiserver-host=https://$K8_API --kubeconfig /path/kubeconfig
+WorkingDirectory=/ingress-controller
+Restart=on-failure
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target