oak-nginx 0.0.11

# Nginx Configuration Test File - Comprehensive Syntax Coverage
# This file tests various Nginx configuration syntax elements for lexer testing

# Main context directives
user nginx;
worker_processes auto;
worker_rlimit_nofile 65535;
worker_cpu_affinity auto;
worker_priority -5;

# Error log configuration
error_log /var/log/nginx/error.log warn;
error_log /var/log/nginx/debug.log debug;

# PID file
pid /var/run/nginx.pid;

# Load dynamic modules
load_module modules/ngx_http_geoip_module.so;
load_module modules/ngx_stream_module.so;
load_module modules/ngx_http_image_filter_module.so;

# Include additional configuration files
include /etc/nginx/modules-enabled/*.conf;

# Events context
events {
    # Connection processing method
    use epoll;
    
    # Maximum number of simultaneous connections
    worker_connections 4096;
    
    # Accept multiple connections
    multi_accept on;
    
    # Accept mutex
    accept_mutex off;
    accept_mutex_delay 500ms;
}

# HTTP context
http {
    # Basic settings
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 1000;
    types_hash_max_size 2048;
    server_tokens off;
    
    # Server names hash
    server_names_hash_bucket_size 128;
    server_names_hash_max_size 1024;
    
    # Client settings
    client_max_body_size 100M;
    client_body_buffer_size 128k;
    client_header_buffer_size 1k;
    large_client_header_buffers 4 4k;
    client_body_timeout 60s;
    client_header_timeout 60s;
    send_timeout 60s;
    
    # MIME types
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # Character set
    charset utf-8;
    charset_types text/xml text/plain text/vnd.wap.wml application/javascript application/rss+xml;
    
    # Logging configuration
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    
    log_format detailed '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status $bytes_sent '
                       '"$http_referer" "$http_user_agent" '
                       '$request_time $upstream_response_time '
                       '$pipe $connection_requests';
    
    log_format json escape=json '{'
                    '"time_local":"$time_local",'
                    '"remote_addr":"$remote_addr",'
                    '"remote_user":"$remote_user",'
                    '"request":"$request",'
                    '"status": "$status",'
                    '"body_bytes_sent":"$body_bytes_sent",'
                    '"request_time":"$request_time",'
                    '"http_referrer":"$http_referer",'
                    '"http_user_agent":"$http_user_agent"'
                    '}';
    
    access_log /var/log/nginx/access.log main;
    access_log /var/log/nginx/detailed.log detailed;
    
    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 1000;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml+rss
        application/atom+xml
        image/svg+xml;
    
    # Brotli compression (if module available)
    brotli on;
    brotli_comp_level 6;
    brotli_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    
    # SSL/TLS settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    
    # Security headers
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';" always;
    
    # Rate limiting
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=general:10m rate=5r/s;
    
    # Connection limiting
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    
    # Geo module configuration
    geo $country {
        default        ZZ;
        127.0.0.0/24   US;
        192.168.1.0/24 US;
        10.1.0.0/16    US;
        ::1            US;
    }
    
    # Map module configuration
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }
    
    map $remote_addr $limit {
        ~^192\.168\.1\. "";
        default         $binary_remote_addr;
    }
    
    map $http_user_agent $mobile {
        default       0;
        "~*android"   1;
        "~*iphone"    1;
        "~*ipad"      1;
        "~*mobile"    1;
    }
    
    # Split clients for A/B testing
    split_clients "${remote_addr}AAA" $variant {
        50%     .one;
        50%     .two;
    }
    
    # Upstream configuration
    upstream backend {
        least_conn;
        server backend1.example.com:8080 weight=3 max_fails=3 fail_timeout=30s;
        server backend2.example.com:8080 weight=2 max_fails=3 fail_timeout=30s;
        server backend3.example.com:8080 weight=1 max_fails=3 fail_timeout=30s backup;
        server unix:/tmp/backend4 weight=1;
        
        keepalive 32;
        keepalive_requests 100;
        keepalive_timeout 60s;
    }
    
    upstream api_backend {
        ip_hash;
        server api1.example.com:8080;
        server api2.example.com:8080;
        server api3.example.com:8080 down;
    }
    
    upstream websocket_backend {
        server ws1.example.com:8080;
        server ws2.example.com:8080;
    }
    
    # Cache configuration
    proxy_cache_path /var/cache/nginx/proxy levels=1:2 keys_zone=my_cache:10m max_size=10g 
                     inactive=60m use_temp_path=off;
    
    fastcgi_cache_path /var/cache/nginx/fastcgi levels=1:2 keys_zone=fastcgi_cache:10m max_size=10g 
                       inactive=60m use_temp_path=off;
    
    # Default server (catch-all)
    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        
        return 444;
    }
    
    # HTTP to HTTPS redirect server
    server {
        listen 80;
        listen [::]:80;
        server_name example.com www.example.com;
        
        # ACME challenge for Let's Encrypt
        location /.well-known/acme-challenge/ {
            root /var/www/certbot;
        }
        
        location / {
            return 301 https://$server_name$request_uri;
        }
    }
    
    # Main HTTPS server
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name example.com www.example.com;
        
        # SSL certificate configuration
        ssl_certificate /etc/ssl/certs/example.com.crt;
        ssl_certificate_key /etc/ssl/private/example.com.key;
        ssl_trusted_certificate /etc/ssl/certs/ca-certs.pem;
        
        # Document root
        root /var/www/html;
        index index.html index.htm index.php;
        
        # Custom error pages
        error_page 404 /404.html;
        error_page 500 502 503 504 /50x.html;
        
        # Rate limiting
        limit_req zone=general burst=20 nodelay;
        limit_conn addr 10;
        
        # Main location
        location / {
            try_files $uri $uri/ @fallback;
            
            # Cache static files
            location ~* \.(jpg|jpeg|png|gif|ico|css|js|pdf|txt)$ {
                expires 1y;
                add_header Cache-Control "public, immutable";
                access_log off;
            }
        }
        
        # API endpoints
        location /api/ {
            limit_req zone=api burst=50 nodelay;
            
            proxy_pass http://api_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # Proxy timeouts
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
            
            # Proxy buffering
            proxy_buffering on;
            proxy_buffer_size 4k;
            proxy_buffers 8 4k;
            proxy_busy_buffers_size 8k;
            
            # Proxy caching
            proxy_cache my_cache;
            proxy_cache_valid 200 302 10m;
            proxy_cache_valid 404 1m;
            proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
            proxy_cache_lock on;
            proxy_cache_lock_timeout 5s;
            
            add_header X-Cache-Status $upstream_cache_status;
        }
        
        # WebSocket proxy
        location /ws/ {
            proxy_pass http://websocket_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            proxy_read_timeout 86400;
        }
        
        # PHP-FPM configuration
        location ~ \.php$ {
            try_files $uri =404;
            
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
            fastcgi_index index.php;
            
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            
            # FastCGI caching
            fastcgi_cache fastcgi_cache;
            fastcgi_cache_valid 200 60m;
            fastcgi_cache_methods GET HEAD;
            fastcgi_cache_key "$scheme$request_method$host$request_uri";
            fastcgi_cache_use_stale error timeout invalid_header http_500;
            
            # Skip cache for certain conditions
            fastcgi_cache_bypass $skip_cache;
            fastcgi_no_cache $skip_cache;
            
            add_header X-FastCGI-Cache $upstream_cache_status;
        }
        
        # Admin area with authentication
        location /admin/ {
            auth_basic "Admin Area";
            auth_basic_user_file /etc/nginx/.htpasswd;
            
            # IP whitelist
            allow 192.168.1.0/24;
            allow 10.0.0.0/8;
            deny all;
            
            try_files $uri $uri/ /admin/index.php?$query_string;
        }
        
        # Login endpoint with strict rate limiting
        location /login {
            limit_req zone=login burst=5 nodelay;
            
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
        
        # File upload location
        location /upload {
            client_max_body_size 500M;
            client_body_timeout 300s;
            
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            proxy_request_buffering off;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }
        
        # Static file serving with advanced caching
        location /static/ {
            alias /var/www/static/;
            
            # Cache headers
            expires 1y;
            add_header Cache-Control "public, immutable";
            
            # Compression
            gzip_static on;
            
            # Security
            add_header X-Content-Type-Options nosniff;
            
            # Disable access log for static files
            access_log off;
            
            # Handle missing files
            try_files $uri $uri/ =404;
        }
        
        # Downloads with bandwidth limiting
        location /downloads/ {
            alias /var/www/downloads/;
            
            # Bandwidth limiting
            limit_rate 1m;
            limit_rate_after 10m;
            
            # Security headers
            add_header Content-Disposition "attachment";
            add_header X-Content-Type-Options nosniff;
            
            # Access control
            valid_referers none blocked server_names *.example.com;
            if ($invalid_referer) {
                return 403;
            }
        }
        
        # Deny access to sensitive files
        location ~ /\. {
            deny all;
            access_log off;
            log_not_found off;
        }
        
        location ~ ~$ {
            deny all;
            access_log off;
            log_not_found off;
        }
        
        location ~* \.(sql|bak|backup|log)$ {
            deny all;
            access_log off;
            log_not_found off;
        }
        
        # Fallback location
        location @fallback {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
    
    # API-only server
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name api.example.com;
        
        ssl_certificate /etc/ssl/certs/api.example.com.crt;
        ssl_certificate_key /etc/ssl/private/api.example.com.key;
        
        # CORS headers
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
        add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
        add_header Access-Control-Expose-Headers "Content-Length,Content-Range" always;
        
        # Handle preflight requests
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin "*";
            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
            add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization";
            add_header Access-Control-Max-Age 1728000;
            add_header Content-Type "text/plain; charset=utf-8";
            add_header Content-Length 0;
            return 204;
        }
        
        location / {
            limit_req zone=api burst=100 nodelay;
            
            proxy_pass http://api_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # API-specific caching
            proxy_cache my_cache;
            proxy_cache_valid 200 5m;
            proxy_cache_valid 404 1m;
            proxy_cache_key "$scheme$request_method$host$request_uri$http_authorization";
            
            add_header X-Cache-Status $upstream_cache_status;
        }
    }
    
    # Load balancer status page
    server {
        listen 8080;
        server_name localhost;
        
        location /nginx_status {
            stub_status on;
            access_log off;
            
            allow 127.0.0.1;
            allow 192.168.1.0/24;
            deny all;
        }
        
        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }
    
    # Include additional server configurations
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

# Stream context for TCP/UDP load balancing
stream {
    # Logging
    log_format basic '$remote_addr [$time_local] '
                     '$protocol $status $bytes_sent $bytes_received '
                     '$session_time';
    
    access_log /var/log/nginx/stream.log basic;
    
    # Upstream for database connections
    upstream database {
        server db1.example.com:5432 weight=3 max_fails=3 fail_timeout=30s;
        server db2.example.com:5432 weight=2 max_fails=3 fail_timeout=30s;
        server db3.example.com:5432 backup;
    }
    
    # Upstream for Redis
    upstream redis_cluster {
        server redis1.example.com:6379;
        server redis2.example.com:6379;
        server redis3.example.com:6379;
    }
    
    # Database load balancer
    server {
        listen 5432;
        proxy_pass database;
        proxy_timeout 1s;
        proxy_responses 1;
        proxy_connect_timeout 1s;
    }
    
    # Redis load balancer
    server {
        listen 6379;
        proxy_pass redis_cluster;
        proxy_timeout 3s;
        proxy_responses 1;
    }
    
    # SSH load balancer
    server {
        listen 2222;
        proxy_pass backend;
        proxy_timeout 1s;
        proxy_responses 1;
    }
    
    # DNS load balancer (UDP)
    server {
        listen 53 udp;
        proxy_pass dns_servers;
        proxy_timeout 1s;
        proxy_responses 1;
        error_log /var/log/nginx/dns.log;
    }
    
    upstream dns_servers {
        server 8.8.8.8:53;
        server 8.8.4.4:53;
        server 1.1.1.1:53;
    }
}

# Mail proxy context
mail {
    server_name mail.example.com;
    auth_http localhost:9000/cgi-bin/auth;
    
    proxy_pass_error_message on;
    
    # IMAP proxy
    server {
        listen 143;
        protocol imap;
        proxy on;
    }
    
    # POP3 proxy
    server {
        listen 110;
        protocol pop3;
        proxy on;
    }
    
    # SMTP proxy
    server {
        listen 25;
        protocol smtp;
        proxy on;
    }
    
    # Secure mail proxies
    server {
        listen 993 ssl;
        protocol imap;
        proxy on;
        ssl_certificate /etc/ssl/certs/mail.example.com.crt;
        ssl_certificate_key /etc/ssl/private/mail.example.com.key;
    }
    
    server {
        listen 995 ssl;
        protocol pop3;
        proxy on;
        ssl_certificate /etc/ssl/certs/mail.example.com.crt;
        ssl_certificate_key /etc/ssl/private/mail.example.com.key;
    }
    
    server {
        listen 465 ssl;
        protocol smtp;
        proxy on;
        ssl_certificate /etc/ssl/certs/mail.example.com.crt;
        ssl_certificate_key /etc/ssl/private/mail.example.com.key;
    }
}