On the application server, Nginx duplicates each request with ngx_http_mirror_module and sends the copy to Filter. The visitor still receives the application server's response. Nginx discards the Filter's answer to the copy.
Mikiri WAF packages stay on the Filter. This page changes only the virtual host on the application server. Accepting the copy on the Filter is in Traffic copy.
Replace %WAF SERVER% and %PORT% with the Filter address and the port it listens on. web_backend is the existing upstream of the application.
upstream mirror_upstream {
server %WAF SERVER%:%PORT%;
server 127.0.0.1:88 backup;
}
server {
listen 127.0.0.1:88 default_server;
return 200 "Response code: 200";
add_header Content-Type text/plain;
access_log off;
}
server {
...
location / {
mirror /mirror;
proxy_pass http://web_backend;
include proxy_params;
}
location = /mirror {
internal;
proxy_pass http://mirror_upstream$request_uri;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_connect_timeout 10s;
proxy_send_timeout 10s;
proxy_read_timeout 15s;
}
}
%WAF SERVER% is the Filter that receives the copy. 127.0.0.1:88 backup answers the mirror locally when the Filter does not accept the connection, so a Filter outage does not hold the visitor's request. return 200 on that listener completes the mirror. access_log off keeps it from filling the disk.
mirror /mirror duplicates the request according to location = /mirror. That location is internal, so a visitor cannot open it. Host must be the site name, so the Filter selects the right virtual host. X-Real-IP must be the visitor address, so the event is not attributed to the application server. The three timeouts limit how long the mirror waits for the Filter.
On Apache, IIS, or another server, use that server's request-mirror feature and send the duplicate to %WAF SERVER%:%PORT% with the same two headers.
After the application server is changed:
nginx -t && service nginx reload