Using API calls, you can manage Nginx web server settings.
Settings are managed using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
Available only for the
Enterpriseplan.The
nameparameter is required for all the entities except the global settings. The value of a parameter is transmitted in its entirety and completely replaces the previously saved one; to reset an individual parameter,nullis passed as its value. An empty string is not allowed for a string parameter.The
activeparameter is available only forset_globalandset_server.
To get the data in the format of an Nginx configuration file, the ?format=nginx parameter is used, for example:
curl 'http://api.example.com:8080/nginx/v1/get_server?format=nginx' --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
The parameter is available for /nginx/v1/get_global, /nginx/v1/get_server and /nginx/v1/get_upstream. When using ?format=nginx, the data for which "active": false is set is not displayed the response is returned as configuration text (not as JSON).
The options listed below are available both in the global settings and in the settings of a virtual host and of its locations. The value set for a virtual host or a location takes precedence over the value set in the global settings.
If the value is false, the settings are deactivated. The option is available for the global settings and for a virtual host.
"active": true
This option sets the maximum allowed size of the request body from a visitor or an API client. If the size is larger than the specified size, error 413 (Request Entity Too Large) is returned to that visitor or API client. Setting the option to 0 deactivates checking the size of the request body.
"client_max_body_size": "25m"
This option sets the maximum allowed buffer size for reading the request body from a visitor or an API client. If the request body is larger than the specified size, the entire request body or part of it is written to a temporary file.
"client_body_buffer_size": "25m"
This option limits the total size of buffers that may be busy sending a response to the visitor or the API client while the response has not yet been fully read. The remaining buffers are used to read the response and, if necessary, to buffer part of the response to a temporary file. The value cannot be lower than 24k when response analysis is activated.
"proxy_busy_buffers_size": "16k"
Sets the location of the request log.
If the value is off, the log entry will be deactivated.
"access_log": {
"path": "/var/log/nginx/access.log"
}
or
"access_log": {
"path": "off"
}
Sets the location of the error log.
If the value is off, the log entry will be deactivated.
"error_log": {
"path": "/var/log/nginx/error.log"
}
or
"error_log": {
"path": "off"
}
Includes in the configuration another file or files that match the specified mask. The included files must contain syntactically correct directives and blocks.
"include": [
"snippets/misc.conf",
"vhosts/*.conf"
]
This section allows to set global Nginx settings, which will be located in /etc/nginx/mikiri-waf/filter/nginx/nginx.conf. Supports the following control commands:
Request example:
curl http://api.example.com:8080/nginx/v1/get_global --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"configuration": {
"active": boolean,
"resolver": string,
"limit_req_zone": [string, ...],
"limit_conn_zone": [string, ...],
"real_ip_header": string,
"resolver_timeout": string,
"set_real_ip_from": [string, ...],
"client_max_body_size": string,
"client_body_buffer_size": string,
"proxy_busy_buffers_size": string,
"access_log": object,
"error_log": object,
"include": array
}
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"configuration": {
"active": true,
"resolver": "127.0.0.1 [::1]:5353 valid=30s",
"limit_req_zone": [
"$binary_remote_addr zone=mylimit_1:10m rate=10r/s"
],
"limit_conn_zone": [
"$binary_remote_addr zone=addr:10m"
],
"real_ip_header": "X-Forwarded-For",
"resolver_timeout": "30s",
"set_real_ip_from": [
"192.168.1.0/24"
],
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
]
}
}
Request example:
curl http://api.example.com:8080/nginx/v1/set_global --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"active": true,
"resolver": "127.0.0.1 [::1]:5353 valid=30s",
"resolver_timeout": "30s",
"set_real_ip_from": [
"192.168.1.0/24",
"192.168.2.1"
],
"real_ip_header": "X-Forwarded-For",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"limit_req_zone": [
"$binary_remote_addr zone=mylimit_1:10m rate=10r/s",
"$binary_remote_addr zone=mylimit_2:10m rate=10r/s"
],
"limit_conn_zone": [
"$binary_remote_addr zone=addr:10m"
]
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
In addition to the options listed below, the common options are available.
The DNS server address. The valid value indicates how long the DNS server's response will be considered valid.
The value is set in the format address ... [valid=%N%s|m|h|d] [ipv4=on|off] [ipv6=on|off]. UNIX sockets (unix:) are allowed.
"resolver": "127.0.0.1 [::1]:5353 valid=30s"
This option sets the value (in seconds) during which Nginx will wait for a response from the DNS server.
"resolver_timeout": "30s"
This option specifies trusted addresses that transmit the correct replacement address. Trusted addresses can also be set using the hostname.
IPv4/IPv6 addresses, CIDRs (for example, 10.10.10.1/24) UNIX sockets are allowed.
"set_real_ip_from": [
"192.168.1.0/24",
"192.168.2.1",
"2001:0db8::/32"
]
Specifies the request header field, the value of which will be used to replace the address of the visitor or the API client. One of the values X-Real-IP, X-Forwarded-For or proxy_protocol is allowed.
"real_ip_header": "X-Forwarded-For"
Sets the parameters of the shared memory zone, which stores the state for different key values. You can use text, variables combinations of them as a key. Requests with an empty key value are not counted.
The value is set in the format $key zone=%name%:%size% rate=%N%r/s|m|h.
A
limit_req_zonezone cannot be deleted or renamed if it is used in thelimit_reqoption of any location.
"limit_req_zone": [
"$binary_remote_addr zone=mylimit_1:10m rate=10r/s",
"$binary_remote_addr zone=mylimit_2:10m rate=10r/s"
]
Sets the shared memory zone that stores the current number of connections for each key. You can use text, variables combinations of them as a key. Requests with an empty key value are not counted.
The value is set in the format $key zone=%name%:%size%. The size suffix is b, k, m, or g. Zone names must be unique. The zone is written into the global Nginx configuration and is referenced by the limit_conn directive. A zone cannot be deleted or renamed while a location uses it in limit_conn.
"limit_conn_zone": [
"$binary_remote_addr zone=addr:10m"
]
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/nginx/v1/get_global_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
On the Enterprise plan a Content Security Policy that Filter would send still produces a hash when the global block itself is missing. The response is none again when no policy is rendered. See Content Security Policy settings.
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/nginx/v1/set_global --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"resolver": null,
"resolver_timeout": null,
"set_real_ip_from": null,
"real_ip_header": null,
"client_max_body_size": null,
"client_body_buffer_size": null,
"proxy_busy_buffers_size": null,
"access_log": null,
"error_log": null,
"include": null,
"limit_req_zone": null,
"limit_conn_zone": null
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
name is the name of the configuration that will be located in /etc/nginx/mikiri-waf/filter/nginx/%NAME%.conf.
An entity that is used in at least one configuration cannot be deleted.
The section is used to configure the domain file. Supports the following control commands:
Request example:
curl http://api.example.com:8080/nginx/v1/get_server --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"configuration": [
{
"active": boolean,
"name": string,
"root": string,
"index": string,
"listen": [string, ...],
"add_header": {string, ...},
"error_page": {string, ...},
"client_max_body_size": string,
"client_body_buffer_size": string,
"proxy_busy_buffers_size": string,
"access_log": object,
"error_log": object,
"include": array,
"return": string,
"locations": [
{
"location": string,
"pass_type": string,
"path": string,
"index": string,
"add_header": {string, ...},
"error_page": {string, ...},
"limit_req": string,
"limit_req_status": integer,
"limit_conn": string,
"limit_conn_status": integer,
"client_max_body_size": string,
"client_body_buffer_size": string,
"proxy_busy_buffers_size": string,
"access_log": object,
"error_log": object,
"include": array,
"return": string
},
...
],
"server_name": string,
"ssl_ciphers": string,
"dhparam_name": string,
"ssl_protocols": string,
"certificate_name": string,
"ssl_session_timeout": string
}
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"configuration": [
{
"active": true,
"name": "example.com",
"root": "/var/www/site",
"index": "index index.html index.php",
"listen": [
"localhost:443 default_server ssl proxy_protocol"
],
"add_header":{
"Content-type": "text/html; charset=utf-8"
},
"error_page": {
"404 502": "=200 /404.html"
},
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"locations": [
{
"location": "/path_1",
"pass_type": "root",
"path": "/var/www/html",
"index": "index index.html index.php",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": ["snippets/misc.conf"],
"return": "301 $scheme://$host$request_uri",
"add_header":{
"Content-type": "text/html; charset=utf-8"
},
"error_page": {
"404 502": "=200 /404.html"
},
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444,
"limit_conn": "addr 10",
"limit_conn_status": 503
},
...
],
"server_name": "www.example.com example.com",
"ssl_ciphers": "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384",
"dhparam_name": "dhparam",
"ssl_protocols": "TLSv1.2 TLSv1.3",
"certificate_name": "SSL",
"ssl_session_timeout": "10m"
}
]
}
Request example:
curl http://api.example.com:8080/nginx/v1/set_server --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"active": true,
"name": "%CONFIGURATION NAME%",
"listen": [
"localhost:80 default_server",
"[::1]:443 default_server ssl"
],
"server_name": "www.example.com example.com",
"certificate_name": "%NAME%",
"dhparam_name": "%NAME%",
"ssl_session_timeout": "10m",
"ssl_ciphers": "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384",
"ssl_protocols": "TLSv1.2 TLSv1.3",
"root": "/var/www/site",
"index": "index.php index.html",
"add_header": {
"Content-Encoding": "gzip",
"Content-type": "text/html; charset=utf-8"
},
"error_page": {
"404 502": "=200 /404.html",
"504": "=200 @bad_gateway"
},
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"locations": [
{
"location": "/path_1",
"pass_type": "root",
"path": "/var/www/html",
"index": "index.php",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"add_header": {
"Content-Encoding": "gzip",
"Content-type": "text/html; charset=utf-8"
},
"error_page": {
"504": "=200 @bad_gateway",
"404 502": "=200 /404.html"
},
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444
},
{
"location": "/path_2",
"pass_type": "alias",
"path": "/var/www/static_2",
"autoindex": "on",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444
},
{
"location": "/path_3",
"pass_type": "proxy_pass",
"proxy_pass": "http://proxy_upstream",
"proxy_http_version": 1.0,
"proxy_set_header": {
"X-Real-IP": "$remote_addr",
"Host": "$http_host"
},
"proxy_connect_timeout": "60s",
"proxy_send_timeout": "60s",
"proxy_read_timeout": "60s",
"proxy_intercept_errors": "on",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444
},
{
"location": "/path_4",
"pass_type": "memcached_pass",
"memcached_pass": "memc_upstream",
"set": "$memcached_key $uri",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444
},
{
"location": "/path_5",
"pass_type": "waf_ws_proxy_pass",
"waf_ws_proxy_pass": "http://ws_upstream",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"proxy_http_version": 1.1,
"proxy_set_header": {
"Upgrade": "$http_upgrade",
"Connection": "upgrade"
}
},
{
"location": "/path_6",
"pass_type": "grpc_pass",
"grpc_pass": "grpc://grpc_upstream",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri"
},
{
"location": "/path_7",
"pass_type": "waf_grpc_pass",
"waf_grpc_pass": "grpc://grpc_upstream",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri"
}
]
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
In addition to the options listed below, the common options are available.
The name of the configuration. Only the characters [\w\-.] are allowed.
"name": "example.com"
General settings
The configuration specifies the address where the web server will receive requests.
The address can be specified as a domain name/IP address and port (optional), only the port or as a UNIX socket path.
127.0.0.1:8000
127.0.0.1
8000
*:8000
localhost:8000
[::]:8000
[::1]
unix:/var/run/nginx.sock
The value default_server means that the server will be the default server for the specified address:port pair. If there is no default_server parameter, then the default server will be the first server that describes the address:port pair.
The ssl parameter indicates that all connections accepted on this port must operate in SSL mode. This allows you to set a compact configuration for a server running in two modes at once — HTTP and HTTPS.
The proxy_protocol parameter allows you to enable the PROXY protocol for connections to the proxied server.
The value is set in the format address[:port] [default_server] [ssl] [proxy_protocol].
The
http2parameter of thelistendirective is not used: starting with Nginx1.25.1it is deprecated HTTP/2 support is enabled by the separatehttp2directive, which can be set through a configuration template.
"listen": [
"localhost:80 default_server",
"[::1]:443 default_server ssl proxy_protocol"
]
Server name.
It is allowed to use the wildcard value to replace the first or last part of the name.
"server_name": "www.example.com example.com"
This option specifies the root directory for requests.
"root": "/var/www/site"
The option defines the files to be used as an index. You can use variables in the file name. The files are checked in the order they are listed. There may be a file with an absolute path at the end of the list.
"index": "index.php index.html"
Enables directory listing.
"autoindex": "on"
Sets the header field for the response, subject to the response code 200, 201, 204, 206, 301, 302, 303, 304, 307 or 308.
"add_header": {
"Content-Encoding": "gzip",
"Content-type": "text/html; charset=utf-8"
}
Sets the URI that will be displayed for the specified errors. Variables can be used in the URI value.
The intercepted response codes are set in the range 300-599, the returned response code - in the range 200-599. A value in the format @name refers to a named location or upstream.
"error_page": {
"504": "=200 @bad_gateway",
"404 502": "=200 /404.html"
}
Completes the processing and returns the specified code to the visitor or the API client. The non-standard code 444 closes the connection without transmitting the response header.
"return": "301 $scheme://$host$request_uri"
The shared memory zone (zone) and the maximum size of the burst of requests (burst). If the rate of requests exceeds the rate described in the zone, their processing is curbed so that requests are processed at the specified speed.
The value is set in the format zone=%name% [burst=%N%] [nodelay | delay=%N%]. The zone must be declared in the limit_req_zone option of the global settings.
"limit_req": "zone=mylimit_1 burst=20 nodelay"
The response code used when rejecting requests.
"limit_req_status": 444
Sets the shared memory zone and the maximum number of connections for one key. When that number is reached, further connections are rejected.
The value is set in the format %zone% %N%. The zone must be declared in the limit_conn_zone option of the global settings.
"limit_conn": "addr 10"
The response code used when rejecting connections. Nginx itself uses 503 when this is omitted.
"limit_conn_status": 503
Traffic encryption settings
The canonical name of the SSL certificate and private key for the server. The name is set when creating it in the SSL certificate settings section.
The canonical name of the pem file required for the operation of Forward Secrecy (if an attacker finds out any session key, they will only be able to access data protected by this key). The name is set when creating it in the DHParam settings section.
This option sets the time during which the visitor or the API client can reuse the session parameters.
"ssl_session_timeout": "10m"
This option specifies the allowed ciphers. The ciphers are set in the format supported by the OpenSSL library.
"ssl_ciphers": "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384"
The option allows the use of the specified protocols. It is not recommended to enable the outdated TLSv1 and TLSv1.1 protocols.
"ssl_protocols": "TLSv1.2 TLSv1.3"
Request proxying settings
Allows you to redefine or add request header fields passed to the proxied server. You can use text, variables combinations of them as values.
"proxy_set_header": {
"Host": "$http_host"
}
The version of the HTTP protocol for proxying. The default version is 1.0.
"proxy_http_version": 1.0
Timeout for establishing a connection with the proxied server.
"proxy_connect_timeout": "60s"
When the parameter is activated, responses from the proxied server with a response code of 300 or higher will be intercepted and redirected for processing using the error_page.
"proxy_intercept_errors": "on"
The timeout for sending the request to the proxied server.
"proxy_send_timeout": "60s"
Timeout when reading the response from the proxied server.
"proxy_read_timeout": "60s"
The option defines the list of used locations for the domain and their parameters. Parameter setting involves the use of required and auxiliary parameters.
location - the prefix that will be used for comparison with the URI of the request.
"location": "/"
"location": "/user/"
pass_type - the type of request processing.
7 types of processing are supported: root, alias, proxy_pass, memcached_pass, waf_ws_proxy_pass, grpc_pass, waf_grpc_pass.
The
waf_ws_proxy_passparameter is used in cases where it is necessary to proxy and analyze requests using the WebSocket protocol. If such an analysis is not required when proxying requests, you can use theproxy_passoption.The
waf_grpc_passparameter is used in cases where it is required to analyze the contents of the request body transmitted over thegRPCprotocol. If the analysis of the contents of the request body is not required, thegrpc_passparameter can be used.
path option to specify the root directory for requests, for example:"path": "/var/www/site"
With the value path /var/www/site and location /user/, a request for the resource /user/index.html will return the contents of the file /var/www/site/user/index.html.
location. When using this type of request processing, you must use the path option to specify a directory for requests, for example:"path": "/var/www/site"
With the value alias /var/www/site and location /user/, a request for the resource /user/index.html will return the contents of the file /var/www/site/index.html.
location.The address can be set as a domain name/IP address and port (optional), a UNIX socket, or an upstream name. You can add a URI to the server address, for example:
"proxy_pass": "http://127.0.0.1:8080/remote/"
"proxy_pass": "http://unix:/tmp/backend.socket:/uri/"
"proxy_pass": "http://upstream_name"
memcached server where requests will be redirected when accessing the location.The address can be specified as a domain name/IP address and port (required), a UNIX socket, or an upstream name, for example:
"memcached_pass": "localhost:11211"
"memcached_pass": "unix:/tmp/memcached.socket"
"memcached_pass": "http://upstream_name"
When using memcached_pass, the set parameter is required. It defines the value of the $memcached_key variable, for example:
"set": "$memcached_key $uri"
location when using the WebSocket protocol.The address can be set as a domain name/IP address and port (optional), a UNIX socket, or an upstream name. It is allowed to add a URI to the server address, for example:
"waf_ws_proxy_pass": "http://127.0.0.1:8080/remote/"
"waf_ws_proxy_pass": "http://unix:/tmp/backend.socket:/uri/"
"waf_ws_proxy_pass": "http://upstream_name"
The
waf_ws_proxy_passparameter is used in cases where it is necessary to proxy and analyze requests using the WebSocket protocol. If such an analysis is not required when proxying requests, you can use theproxy_passoption.
location.The address can be specified as a domain name/IP address and port, a UNIX socket, or an upstream name, for example:
"grpc_pass": "localhost:9000"
"grpc_pass": "unix:/tmp/grpc.socket"
"grpc_pass": "http://upstream_name"
"grpc_pass": "grpc://127.0.0.1:9000"
"grpc_pass": "grpcs://127.0.0.1:443"
location. It is used if you need to analyze the contents of the request body that is being forwarded to the gRPC server.The address can be set as a domain name/IP address and port, a UNIX socket, or an upstream name, for example:
"waf_grpc_pass": "localhost:9000"
"waf_grpc_pass": "unix:/tmp/grpc.socket"
"waf_grpc_pass": "http://upstream_name"
"waf_grpc_pass": "grpc://127.0.0.1:9000"
"waf_grpc_pass": "grpcs://127.0.0.1:443"
root
index, autoindex, add_header, error_page, client_max_body_size, client_body_buffer_size, proxy_busy_buffers_size, access_log, error_log, include, return, limit_req, limit_req_status, limit_conn, limit_conn_status
alias
index, autoindex, add_header, error_page, client_max_body_size, client_body_buffer_size, proxy_busy_buffers_size, access_log, error_log, include, return, limit_req, limit_req_status, limit_conn, limit_conn_status
proxy_pass
proxy_http_version, proxy_connect_timeout, proxy_intercept_errors, proxy_send_timeout, proxy_read_timeout, client_max_body_size, client_body_buffer_size, proxy_busy_buffers_size, access_log, error_log, include, return, limit_req, limit_req_status, limit_conn, limit_conn_status
waf_ws_proxy_pass
proxy_http_version, proxy_connect_timeout, proxy_intercept_errors, proxy_send_timeout, proxy_read_timeout, client_max_body_size, client_body_buffer_size, proxy_busy_buffers_size, access_log, error_log, include, return, limit_req, limit_req_status, limit_conn, limit_conn_status
memcached_pass
client_max_body_size, client_body_buffer_size, proxy_busy_buffers_size, access_log, error_log, limit_req, limit_req_status, limit_conn, limit_conn_status
grpc_pass
client_max_body_size, client_body_buffer_size, proxy_busy_buffers_size, access_log, error_log, include, return, limit_req, limit_req_status, limit_conn, limit_conn_status
waf_grpc_pass
client_max_body_size, client_body_buffer_size, proxy_busy_buffers_size, access_log, error_log, include, return, limit_req, limit_req_status, limit_conn, limit_conn_status
"locations": [
{
"location": "/path_1",
"pass_type": "root",
"path": "/var/www/html",
"index": "index.php",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"add_header": {
"Content-Encoding": "gzip",
"Content-type": "text/html; charset=utf-8"
},
"error_page": {
"504": "=200 @bad_gateway",
"404 502": "=200 /404.html"
},
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444
},
{
"location": "/path_2",
"pass_type": "alias",
"path": "/var/www/static_2",
"autoindex": "on",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444
},
{
"location": "/path_3",
"pass_type": "proxy_pass",
"proxy_pass": "http://proxy_upstream",
"proxy_http_version": 1.0,
"proxy_set_header": {
"X-Real-IP": "$remote_addr",
"Host": "$http_host"
},
"proxy_connect_timeout": "60s",
"proxy_send_timeout": "60s",
"proxy_read_timeout": "60s",
"proxy_intercept_errors": "on",
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444,
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri"
},
{
"location": "/path_4",
"pass_type": "memcached_pass",
"memcached_pass": "memc_upstream",
"set": "$memcached_key $uri",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"limit_req": "zone=mylimit_1 burst=20 nodelay",
"limit_req_status": 444
},
{
"location": "/path_5",
"pass_type": "waf_ws_proxy_pass",
"waf_ws_proxy_pass": "http://ws_upstream",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri",
"proxy_http_version": 1.1,
"proxy_set_header": {
"Upgrade": "$http_upgrade",
"Connection": "upgrade"
}
},
{
"location": "/path_6",
"pass_type": "grpc_pass",
"grpc_pass": "grpc://grpc_upstream",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
},
"include": [
"snippets/misc.conf"
],
"return": "301 $scheme://$host$request_uri"
},
{
"location": "/path_7",
"pass_type": "waf_grpc_pass",
"waf_grpc_pass": "grpc://grpc_upstream",
"client_max_body_size": "25m",
"client_body_buffer_size": "25m",
"proxy_busy_buffers_size": "16k",
"access_log": {
"path": "/var/log/nginx/access.log"
},
"error_log": {
"path": "/var/log/nginx/error.log"
}
}
]
location within a virtual host is not allowed;memcached_pass is used only together with set;ssl parameter in listen requires a defined certificate_name and vice versa;limit_req must be declared in the limit_req_zone option of the global settings;limit_conn must be declared in the limit_conn_zone option of the global settings;limit_conn_zone zone cannot be deleted or renamed if it is used in the limit_conn option of any location;proxy_pass, memcached_pass or error_page must exist.Request example:
curl http://api.example.com:8080/nginx/v1/set_server --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"name": "%CONFIGURATION NAME%",
"listen": null,
"server_name": null,
"certificate_name": null,
"dhparam_name": null,
"ssl_session_timeout": null,
"ssl_ciphers": null,
"ssl_protocols": null,
"root": null,
"index": null,
"add_header": null,
"error_page": null,
"locations": null
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/nginx/v1/get_server_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/nginx/v1/set_server --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": {
"name": "%CONFIGURATION NAME%"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
name - The configuration file with load balancing parameters, which will be located in /etc/nginx/mikiri-waf/filter/nginx/%NAME%.conf.
The section is intended for configuring load balancing parameters. Supports the following control commands:
Request example:
curl http://api.example.com:8080/nginx/v1/get_upstream --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"configuration": [
{
"name": string,
"balancing_method": string,
"servers": [
{
"server": string,
"weight": integer,
"max_fails": integer,
"fail_timeout": string,
"backup": boolean,
"down": boolean
},
...
]
}
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"configuration": [
{
"name": "upstream_main",
"balancing_method": "ip_hash",
"servers": [
{
"server": "backend1.example.com",
"weight": 3,
"max_fails": 5,
"fail_timeout": "60s",
"backup": false,
"down": true
},
...
]
}
]
}
Request example:
curl http://api.example.com:8080/nginx/v1/set_upstream --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"name": "%CONFIGURATION NAME%",
"balancing_method": "ip_hash",
"servers": [
{
"server": "backend1.example.com",
"weight": 3
},
{
"server": "127.0.0.1:8080",
"fail_timeout": "60s"
},
{
"server": "192.0.2.1",
"max_fails": 5
},
{
"server": "backend3.example.com",
"weight": 3,
"fail_timeout": "60s",
"max_fails": 5
},
{
"server": "backend4.example.com"
},
{
"server": "backend5.example.com",
"backup": true
},
{
"server": "backend4.example.com",
"down": true
}
]
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The name of the server group for load balancing.
A method for distributing the load between servers.
It is allowed to use one of the values: ip_hash, least_conn or random.
"balancing_method": "ip_hash"
A list of servers that are used to process requests, as well as their parameters:
server is the server address. The address can be specified as a domain name/IP address and port (optional) or a UNIX socket. IPv6 and IPv4 addresses are allowed;weight is a numerical indicator of the priority of server selection when processing a request;fail_timeout - the time during which the specified number of unsuccessful attempts to work with the server must occur in order for the server to be considered unavailable (in the format %N%s|m|h);max_fails - the maximum number of unsuccessful attempts to communicate with the server during the time specified by the fail_timeout parameter;down - marks the server as permanently unavailable;backup - marks the server as a backup. Requests will be sent to it if the main servers are down.Validation conditions:
backup is not used together with the ip_hash and random balancing methods;backup and down must remain in the upstream."servers": [
{
"server": "backend1.example.com",
"weight": 3
},
{
"server": "127.0.0.1:8080",
"fail_timeout": "60s"
},
{
"server": "192.0.2.1",
"max_fails": 5
},
{
"server": "backend3.example.com",
"weight": 3,
"fail_timeout": "60s",
"max_fails": 5
},
{
"server": "backend4.example.com"
},
{
"server": "backend5.example.com",
"backup": true
},
{
"server": "backend4.example.com",
"down": true
}
]
Request example:
curl http://api.example.com:8080/nginx/v1/set_upstream --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"name": "%CONFIGURATION NAME%",
"balancing_method": null,
"servers": null
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/nginx/v1/get_upstream_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/nginx/v1/set_upstream --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": {
"name": "%CONFIGURATION NAME%"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
For security reasons, executing the get configuration command does not return the full contents of the
certificate_keyfield. The full information about the private keycertificate_keyis requested by the MLA agent at the URLhttp://api.example.com:8080/nginx/secure/v1/get_certificate, which is recommended to be allowed only for the Filter server.
name is the configuration name for SSL certificates and their private keys, which will be located in /etc/nginx/mikiri-waf/filter/nginx/ssl/certs/%NAME%.crt and /etc/nginx/mikiri-waf/filter/nginx/ssl/private/%NAME%.key.
The section is intended for configuring the parameters of SSL certificates and their private keys. Supports the following control commands:
Request example:
curl http://api.example.com:8080/nginx/v1/get_certificate --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"configuration": [
{
"name": string,
"certificate": string,
"certificate_key": string
}
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"configuration": [
{
"name": "SSL",
"certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS...",
"certificate_key": "LS0tLS1CRUdJTiBQUklWQVRF..."
}
]
}
Request example:
curl http://api.example.com:8080/nginx/v1/set_certificate --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"name": "%CONFIGURATION NAME%",
"certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVekNDQWpzQ0ZGei9jNjhLYk9USnlYOWpibWZMbjdmK1YwdWtNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1IOHgKQ3pBSkJnTlZCQVlUQWtGVk1RNHdEQVlEVlFRSURBVkJVMEZGUmpFTk1Bc0dBMVVFQnd3RVQzSmxiREVSTUE4RwpBMVVFQ2d3SVUxTlNSMEZCUldZeERqQU1CZ05WQkFzTUJYTnlaWFJuTVE0d0RBWURWUVFEREFWM1pUUm1aekVlCk1Cd0dDU3FHU0liM0RRRUpBUllQWVdSdGFXNUFZV1J0YVc0dVkyOXRNQjRYRFRJek1EY3hOekV3TlRZME0xb1gKRFRJMk1EUXhNVEV3TlRZME0xb3dUVEVMTUFrR0ExVUVCaE1DUTBFeERUQUxCZ05WQkFnTUJFNXZibVV4Q3pBSgpCZ05WQkFjTUFrNUNNUTB3Q3dZRFZRUUtEQVJPYjI1bE1STXdFUVlEVlFRRERBcGxlR0Z0Y0d4bExuSjFNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFySitBMkZ3cHFjMDhNVnRhVzZKeUsvbDkKQy9NWXFJRXZtRjZvdUt5V01ZRWFGMmlPK0l2VG1pN2hETkxQakR2ekhKRHJMYTZycjhJMkdMN0Nxdi9tdkN5NQpKZVBaSVZxeU9PQ0NLUEJFVXFrUkl4NUwvQ0hLMnVieHlxL1ZIWUExRysxanVqNzNINXZqUHM4anRyeFFNVG5OCkNacVBycmdoOTRlU0ViRmpER2JyZGlGSFpURmwyT01QdTlBVEJoRjF3dStwYS8yN3BJVm91S21BTnVTa0pTaUoKM29wRTkzZFJDYkUvWVhoTjJKTlNjdmdzcjBVbXBRd2t5VDJ4bGVKbHV0Sm5PZkZiK1NsdWFHVlloOUtncEwrcQorN2x3MFk0OEtYNnJGeXUzNko1RjBxNUN6T1hoMS9BZWFneStJQTdGanVSOU9tTFEvQVlwSGE1QmZMK0Fid0lECkFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNnV1VGTVZrMkVSaHF3WGpBT0YxVCt1cWZJM3pKZkVrTHAKYlZieW90d2dRMnZPU2VZdlAyU1dqdjZCMDExZEFONWNYTUIvOFhOVEdhdUNSajN1cEtTTUtvd1JaY1hjdUlKMApocUNDc01JZGw1bDFBQVFJWCtPTTJTeEpKdHVRK0dkWlhkQ294RStzN20zSHNCQ3UwbWRzY3doU0hGSnRmbXRhCit6eFJ4VmY5QkU3NDJSUE5ydXNFZmxwdVQ2Rm14QkpMUy9WYzVLOWtQMngwdjZQTjZYMUF4M09vRGhrQ3Nma2cKeXpwSFhtK3J1ZWJmcnNvcFdwUzJBM083T09CRk1lTVhZeHl3WjJUR2hmanh3R3ZGZml0ZnhFNnpTUnZnQ1A5WQphaUM5RUlMSXpodUdDNDFXNFFZYTJBUzNoaVF4Qms0eDcyeGZ1cXpmc212OE5Zd0lzY3BxCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",
"certificate_key": "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ3NuNERZWENtcHpUd3gKLi4uCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The canonical name of the SSL certificate and its private key, which will be used as the names of the corresponding files. Only the characters [\w\-.] are allowed.
"name": "example.com"
An SSL certificate and an SSL certificate chain (optional) in the PEM format, encoded in Base64.
The parameter is set together with the certificate_key parameter.
Validation conditions:
/ and other characters that allow going outside the directory."certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVekNDQWpzQ0ZGei9jNjhLYk9USnlYOWpibWZMbjdmK1YwdWtNQTBHQ1NxR1NJYjNEUUVCQ3dVQU1IOHgKQ3pBSkJnTlZCQVlUQWtGVk1RNHdEQVlEVlFRSURBVkJVMEZGUmpFTk1Bc0dBMVVFQnd3RVQzSmxiREVSTUE4RwpBMVVFQ2d3SVUxTlNSMEZCUldZeERqQU1CZ05WQkFzTUJYTnlaWFJuTVE0d0RBWURWUVFEREFWM1pUUm1aekVlCk1Cd0dDU3FHU0liM0RRRUpBUllQWVdSdGFXNUFZV1J0YVc0dVkyOXRNQjRYRFRJek1EY3hOekV3TlRZME0xb1gKRFRJMk1EUXhNVEV3TlRZME0xb3dUVEVMTUFrR0ExVUVCaE1DUTBFeERUQUxCZ05WQkFnTUJFNXZibVV4Q3pBSgpCZ05WQkFjTUFrNUNNUTB3Q3dZRFZRUUtEQVJPYjI1bE1STXdFUVlEVlFRRERBcGxlR0Z0Y0d4bExuSjFNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFySitBMkZ3cHFjMDhNVnRhVzZKeUsvbDkKQy9NWXFJRXZtRjZvdUt5V01ZRWFGMmlPK0l2VG1pN2hETkxQakR2ekhKRHJMYTZycjhJMkdMN0Nxdi9tdkN5NQpKZVBaSVZxeU9PQ0NLUEJFVXFrUkl4NUwvQ0hLMnVieHlxL1ZIWUExRysxanVqNzNINXZqUHM4anRyeFFNVG5OCkNacVBycmdoOTRlU0ViRmpER2JyZGlGSFpURmwyT01QdTlBVEJoRjF3dStwYS8yN3BJVm91S21BTnVTa0pTaUoKM29wRTkzZFJDYkUvWVhoTjJKTlNjdmdzcjBVbXBRd2t5VDJ4bGVKbHV0Sm5PZkZiK1NsdWFHVlloOUtncEwrcQorN2x3MFk0OEtYNnJGeXUzNko1RjBxNUN6T1hoMS9BZWFneStJQTdGanVSOU9tTFEvQVlwSGE1QmZMK0Fid0lECkFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNnV1VGTVZrMkVSaHF3WGpBT0YxVCt1cWZJM3pKZkVrTHAKYlZieW90d2dRMnZPU2VZdlAyU1dqdjZCMDExZEFONWNYTUIvOFhOVEdhdUNSajN1cEtTTUtvd1JaY1hjdUlKMApocUNDc01JZGw1bDFBQVFJWCtPTTJTeEpKdHVRK0dkWlhkQ294RStzN20zSHNCQ3UwbWRzY3doU0hGSnRmbXRhCit6eFJ4VmY5QkU3NDJSUE5ydXNFZmxwdVQ2Rm14QkpMUy9WYzVLOWtQMngwdjZQTjZYMUF4M09vRGhrQ3Nma2cKeXpwSFhtK3J1ZWJmcnNvcFdwUzJBM083T09CRk1lTVhZeHl3WjJUR2hmanh3R3ZGZml0ZnhFNnpTUnZnQ1A5WQphaUM5RUlMSXpodUdDNDFXNFFZYTJBUzNoaVF4Qms0eDcyeGZ1cXpmc212OE5Zd0lzY3BxCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
The private key of the SSL certificate in the PEM format, encoded in Base64. The parameter is set together with the certificate parameter.
"certificate_key": "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ3NuNERZWENtcHpUd3gKLi4uCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K"
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/nginx/v1/get_certificate_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/nginx/v1/set_certificate --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": {
"name": "%CONFIGURATION NAME%"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
For security reasons, executing the get configuration command does not return the full contents of the
dhparamfield. Full information aboutdhparamis requested by MLA at the URLhttp://api.example.com:8080/nginx/secure/v1/get_dhparam, which is recommended to be allowed only for the Filter server.
name is the name of the configuration with the DHParam parameters, which will be located in /etc/nginx/mikiri-waf/filter/nginx/ssl/dhparam/%NAME%.pem.
The section is used to configure the DHParam parameter. Supports the following control commands:
Request example:
curl http://api.example.com:8080/nginx/v1/get_dhparam --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"configuration": [
{
"name": string,
"dhparam": string
}
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"configuration": [
{
"name": "dhparam",
"dhparam": "LS0tLS1CRUdJTiBESCBQQVJBTUVURVJT..."
}
]
}
Request example:
curl http://api.example.com:8080/nginx/v1/set_dhparam --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"name": "%CONFIGURATION NAME%",
"dhparam": "LS0tLS1CRUdJTiBESCBQQVJBTUVURVJTLS0tLS0KTUlHSEFvR0JBT1lpNi9OQmljaHU5UDlPS3BpZ1RLQTB4WjNUWnZKQ3pWNzMvWkxCMkgvRFFzc2xUNWgyWEltcQpiazR0SHRGc2ViNDU0S29IR3JoM2FCbzFmcXB5REJQMDcxR0M3eE12c2xUQXVBanVIRmFVckd6NVNDTWRRN3A3CnJvaWNJdExNWE5razQ1WWpzazRPZjZHVXhDZXQ1MkdqSHo3a01yemdvbUtWTldjdU5BRGJBZ0VDCi0tLS0tRU5EIERIIFBBUkFNRVRFUlMtLS0tLQo="
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The canonical name of the pem file required for the operation of Forward Secrecy. Forward Secrecy means that if an attacker finds out any session key, he will only be able to access the data protected by this key.
The DHParam file in the PEM (PKCS#3) format, encoded in Base64.
Validation conditions:
PEM format (-----BEGIN DH PARAMETERS-----) and the DER structure are checked;/ and other characters that allow going outside the directory."dhparam": "LS0tLS1CRUdJTiBESCBQQVJBTUVURVJTLS0tLS0KTUlHSEFvR0JBT1lpNi9OQmljaHU5UDlPS3BpZ1RLQTB4WjNUWnZKQ3pWNzMvWkxCMkgvRFFzc2xUNWgyWEltcQpiazR0SHRGc2ViNDU0S29IR3JoM2FCbzFmcXB5REJQMDcxR0M3eE12c2xUQXVBanVIRmFVckd6NVNDTWRRN3A3CnJvaWNJdExNWE5razQ1WWpzazRPZjZHVXhDZXQ1MkdqSHo3a01yemdvbUtWTldjdU5BRGJBZ0VDCi0tLS0tRU5EIERIIFBBUkFNRVRFUlMtLS0tLQo="
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/nginx/v1/get_dhparam_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/nginx/v1/set_dhparam --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": {
"name": "%CONFIGURATION NAME%"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
name is the name of the configuration that will be located in /etc/nginx/mikiri-waf/filter/nginx/snippets/%NAME%.conf.
The section is intended for creating files containing a template of parameters used for integration into various areas of the Nginx web server through the include directive. Supports the following control commands:
Request example:
curl http://api.example.com:8080/nginx/v1/get_snippet --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"configuration": [
{
"name": string,
"snippet_data": string
}
]
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"configuration": [
{
"name": "gzip",
"snippet_data": "Z3ppcCAgb247Cmd6aXBfYnVmZmVycyAxNiA4azs="
}
]
}
Request example:
curl http://api.example.com:8080/nginx/v1/set_snippet --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"set": {
"name": "%FILE NAME%",
"snippet_data": "Z3ppcCAgb247Cmd6aXBfYnVmZmVycyAxNiA4azs="
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The name of the file (without the extension) that will be automatically created in /etc/nginx/mikiri-waf/filter/nginx/snippets/%NAME%.conf. Only the characters [\w\-.] are allowed.
The file is applied through the include option of the global settings, of a host or of a location.
The contents of the file are in the Base64 format.
"snippet_data": "Z3ppcCAgb247Cmd6aXBfYnVmZmVycyAxNiA4azs="
The method allows you to check whether the data has changed without downloading it in full. More detailed information is available in the relevant section.
Request example:
curl http://api.example.com:8080/nginx/v1/get_snippet_hash --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response example:
{"status": "success", "hash": "8ddd2b342d3190a866ee35afb249919a"}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/nginx/v1/set_snippet --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"del": {
"name": "%FILE NAME%"
}
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}