FROM nginx:1.18.0-alpine
 
LABEL link1="https://github.com/nginx-modules/nginx_upstream_check_module"
 
RUN set -x \
  && tempDir="$(mktemp -d)" \
  && chown nobody:nobody $tempDir \
  && cd $tempDir \
  && wget "http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" \
  && tar xzf nginx-${NGINX_VERSION}.tar.gz \
  && apk add --no-cache --virtual .build-deps gcc libc-dev make openssl-dev pcre-dev zlib-dev linux-headers curl gnupg libxslt-dev gd-dev geoip-dev git \
  && git clone --depth 1 https://github.com/nginx-modules/nginx_upstream_check_module nginx-${NGINX_VERSION}/nginx_upstream_check_module \
  && CONFARGS=$(nginx -V 2>&1 | sed -n -e 's/^.*arguments: //p') \
  && CONFARGS=${CONFARGS/-Os -fomit-frame-pointer/-Os} \
  && cd nginx-$NGINX_VERSION \
  && patch -p1 < nginx_upstream_check_module/check_1.16.1+.patch \
  && ./configure --with-compat $CONFARGS --add-module=nginx_upstream_check_module \
  && make \
  && make install \
  && cd / \
  && rm -rf $tempDir \
  && apk del .build-deps \
  && rm -rf /var/cache/apk/* \
  && ln -sf /dev/stdout /var/log/nginx/access.log \
  && ln -sf /dev/stderr /var/log/nginx/error.log
 
EXPOSE 80
 
STOPSIGNAL SIGTERM
 
CMD ["nginx", "-g", "daemon off;"]

server_tokens off;

upstream docs {
  least_conn;
  server docs1.domain.com weight=10;
  server docs2.domain.com;
  check interval=5000 rise=1 fall=3 timeout=4000 type=http;
  check_http_send "HEAD / HTTP/1.1\r\nHost: docs.domain.com\r\nUser-Agent: nginx\r\n\r\n";
}

server {
        listen 80 default;
        return 307 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name docs.domain.com;

  proxy_set_header Host                $http_host;
  proxy_set_header X-Real-IP           $remote_addr;
  proxy_set_header X-Forwarded-Ssl     on;
  proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto   $scheme;

  location / {
    proxy_pass http://docs;
  }

  ssl_protocols	SSLv3 TLSv1.2 TLSv1.3;
  ssl_certificate	/ssl/domain.com.crt;
  ssl_certificate_key	/ssl/domain.com.key;
  ssl_dhparam		/ssl/dhparam.pem;
}

server {
  listen 80;

  root /var/www;
  index index.html index.php;

  location ~ \.php$ {
    fastcgi_pass   mngt.domain.com:9000;
    fastcgi_index  index.php;
    fastcgi_param  PATH_INFO $fastcgi_script_name;
    fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
    include /etc/nginx/fastcgi_params;
  }
  location = /favicon.ico {
    log_not_found off;
  }
}

FROM nginx:1.16.1-alpine

LABEL maintainer="domain" \
      release-date="2020–02–09" \
      link1="https://github.com/stnoonan/spnego-http-auth-nginx-module" \
      link2="https://gist.github.com/hermanbanken/96f0ff298c162a522ddbba44cad31081" \
      link3="https://github.com/fclmman/alpine-nginx-spnego/blob/master/Dockerfile"

RUN set -x \
  && tempDir="$(mktemp -d)" \
  && chown nobody:nobody $tempDir \
  && cd $tempDir \
  && wget "http://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz" \
  && tar xzf nginx-${NGINX_VERSION}.tar.gz \
  && apk add --no-cache krb5 \
  && apk add --no-cache --virtual .build-deps gcc libc-dev make openssl-dev pcre-dev zlib-dev linux-headers curl gnupg libxslt-dev gd-dev geoip-dev git krb5-dev \
  && git config --global http.proxy $http_proxy \
  && git clone https://github.com/stnoonan/spnego-http-auth-nginx-module.git nginx-${NGINX_VERSION}/spnego-http-auth-nginx-module \
  && CONFARGS=$(nginx -V 2>&1 | sed -n -e 's/^.*arguments: //p') \
  && CONFARGS=${CONFARGS/-Os -fomit-frame-pointer/-Os} \
  && cd nginx-$NGINX_VERSION \
  && ./configure --with-compat $CONFARGS --add-dynamic-module=spnego-http-auth-nginx-module \
  && make modules \
  && cp objs/ngx_http_auth_spnego_module.so /etc/nginx/modules/ \
  && sed -i -e '1 s/^/load_module \/etc\/nginx\/modules\/ngx_http_auth_spnego_module.so;\n/;' /etc/nginx/nginx.conf \
  && cd / \
  && rm -rf $tempDir \
  && apk del .build-deps \
  && rm -rf /var/cache/apk/* \
  && ln -sf /dev/stdout /var/log/nginx/access.log \
  && ln -sf /dev/stderr /var/log/nginx/error.log

EXPOSE 80

STOPSIGNAL SIGTERM

CMD ["nginx", "-g", "daemon off;"]

#docker
docker run -d -p443:443 -p80:80 \
  -v /data/docker/nginx/conf:/etc/nginx/conf.d:ro \
  -v /data/docker/nginx/ssl:/ssl:ro \
  --name nginx nginx:stable-alpine
 
#docker-compose
docker-compose up -d
 
#swarm
docker service create -p 443:443 -p80:80 \
 --mount type=bind,source=/data/docker/nginx/conf,destination=/etc/nginx/conf.d,readonly \
 --mount type=bind,source=/data/docker/nginx/ssl,destination=/ssl,readonly \
 --name nginx nginx:stable-alpine
 
docker stack deploy --compose-file docker-compose.yaml nginx

version: '3.7'
volumes:
  conf:
    driver_opts:
      type: none
      device: ${VOLPATH-/data/docker/nginx}/conf
      o: bind
  ssl:
    driver_opts:
      type: none
      device: ${VOLPATH-/data/docker/nginx}/ssl
      o: bind

services:
 nginx:
  image: nginx:stable-alpine
  container_name: nginx
  ports:
    - mode: host
      protocol: tcp
      published: 80
      target: 80
    - mode: host
      protocol: tcp
      published: 443
      target: 443
  volumes:
   - conf:/etc/nginx/conf.d:ro
   - ssl:/ssl:ro
  restart: always

По 2r/s на 1 IP, с всплесками до 1 и общим по 4r/s с всплесками до 3 на определённый путь.

Обновить configmap в nginx, для helm:

  --set controller.allowSnippetAnnotations=true \
  --set controller.config.http-snippet='limit_req_zone $binary_remote_addr_map zone=ip_v3request:10m rate=2r/s;
map $request_uri $binary_remote_addr_map {
  ~*^/api/v3/Request $binary_remote_addr;
}
limit_req_zone $v3request_map zone=v3request:10m rate=4r/s;
map $request_uri $v3request_map {
  ~*^/api/v3/Request 1;
}'

и добавить в ingress сервиса:

ingress:
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      limit_req zone=ip_v3request burst=1 nodelay;
      limit_req zone=v3request burst=3 nodelay;
      limit_req_status 429;