kong.yml

######
## Kong configuration file. All commented values are default values.
## Uncomment and update a value to configure Kong to your needs.
##
## Lines starting with `##` are comments.
## Lines starting with `#` are properties that can be updated.
## Beware of YAML formatting for nested properties.

######
## Plugins that this node needs to execute.
## By default, Kong will try to execute all installed plugins on every request.
## If you are sure to only use a few plugins, uncomment and update this property to contain
## only those.
## Custom plugins also need to be added to this list.
# plugins_available:
#   - ssl
#   - jwt
#   - ...

######
## The Kong working directory. Equivalent to nginx's prefix path.
## This is where this running nginx instance will keep server files including logs.
## Make sure it has the appropriate permissions.
# nginx_working_dir: /usr/local/kong/

######
## Port which Kong proxies HTTP requests through, consumers will make requests against this port
## so make sure it is publicly available.
# proxy_port: 8000

######
## Same as proxy_port, but for HTTPS requests.
# proxy_ssl_port: 8443

######
## Specify how Kong performs DNS resolution (in the `dns_resolvers_available` property) you want to use.
## Options are: "dnsmasq" (You will need dnsmasq to be installed) or "server".
# dns_resolver: dnsmasq

######
## DNS resolvers configuration. Specify a DNS server or the port on which you want
## dnsmasq to run.
# dns_resolvers_available:
  # server:
    # address: "8.8.8.8:53"
  # dnsmasq:
    # port: 8053

######
## Port on which the admin API will listen to. The admin API is a private API which lets you
## manage your Kong infrastructure. It needs to be secured appropriatly.
# admin_api_port: 8001

######
## Specify which database to use from the databases_available property.
# database: cassandra

######
## Databases configuration.
# databases_available:
  # cassandra:
    ######
    ## Contact points to your Cassandra cluster.
    # contact_points:
    #   - "127.0.0.1:9042"

    ######
    ## Name of the keyspace used by Kong. Will be created if it does not exist.
    # keyspace: kong

    ######
    ## Keyspace options. Set those before running Kong or any migration.
    ## Those settings will be used to create a keyspace with the desired options
    ## when first running the migrations.
    ## See http://docs.datastax.com/en/cql/3.1/cql/cql_reference/create_keyspace_r.html
    ######
    ## The name of the replica placement strategy class for the keyspace.
    ## Can be "SimpleStrategy" or "NetworkTopologyStrategy".
    # replication_strategy: SimpleStrategy
    ######
    ## For SimpleStrategy only.
    ## The number of replicas of data on multiple nodes.
    # replication_factor: 1
    ######
    ## For NetworkTopologyStrategy only.
    ## The number of replicas of data on multiple nodes in each data center.
    # data_centers:
    #   dc1: 2
    #   dc2: 3

    #####
    ## Client-to-node TLS options.
    ## `enabled`: if true, will connect to your Cassandra instance using TLS.
    ## `verify`: if true, will verify the server certificate using the given CA file.
    ## `certificate_authority`: an absolute path to the trusted CA certificate in PEM format used to verify the server certificate.
    ## For additional SSL settings, see the ngx_lua `lua_ssl_*` directives.
    # ssl:
    #   enabled: false
    #   verify: false
    #   certificate_authority: "/path/to/cluster-ca-certificate.pem"

    ######
    ## Cluster authentication options. Provide a user and a password here if your cluster uses the
    ## PasswordAuthenticator scheme.
    # user: cassandra
    # password: cassandra

######
## Time (in seconds) for which entities from the database (APIs, plugins configurations...)
## are cached by Kong. Increase this value if you want to lower the number of requests made
## to your database.
# database_cache_expiration: 5

######
## SSL certificates to use.
# ssl_cert_path: /path/to/certificate.pem
# ssl_key_path: /path/to/certificate.key

######
## Sending anonymous error reports helps Kong developers to understand how it performs.
# send_anonymous_reports: true

######
## Size (in MB) of the Lua cache. This value may not be smaller than 32MB.
# memory_cache_size: 128

######
## The nginx configuration file which allows Kong to run.
## The placeholders will be computed and this property will be written as a file
## by Kong at `<nginx_working_dir>/nginx.conf` during startup.
## This file can tweaked to some extent, but many directives are necessary for Kong to work.
## /!\ BE CAREFUL
nginx: |
  worker_processes auto;
  error_log logs/error.log error;
  daemon on;

  worker_rlimit_nofile {{auto_worker_rlimit_nofile}};

  env KONG_CONF;
  env PATH;

  events {
    worker_connections {{auto_worker_connections}};
    multi_accept on;
  }

  http {
    resolver {{dns_resolver}};
    charset UTF-8;

    access_log logs/access.log;
    access_log off;

    # Timeouts
    keepalive_timeout 60s;
    client_header_timeout 60s;
    client_body_timeout 60s;
    send_timeout 60s;

    # Proxy Settings
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    proxy_ssl_server_name on;

    # IP Address
    real_ip_header X-Forwarded-For;
    set_real_ip_from 0.0.0.0/0;
    real_ip_recursive on;

    # Other Settings
    client_max_body_size 0;
    underscores_in_headers on;
    reset_timedout_connection on;
    tcp_nopush on;

    ################################################
    #  The following code is required to run Kong  #
    # Please be careful if you'd like to change it #
    ################################################

    # Lua Settings
    lua_package_path ';;';
    lua_code_cache on;
    lua_max_running_timers 4096;
    lua_max_pending_timers 16384;
    lua_shared_dict locks 100k;
    lua_shared_dict cache {{memory_cache_size}}m;
    lua_shared_dict cassandra 1m;
    lua_shared_dict cassandra_prepared 5m;
    lua_socket_log_errors off;
    {{lua_ssl_trusted_certificate}}

    init_by_lua '
      kong = require "kong"
      local status, err = pcall(kong.init)
      if not status then
        ngx.log(ngx.ERR, "Startup error: "..err)
        os.exit(1)
      end
    ';

    init_worker_by_lua 'kong.exec_plugins_init_worker()';

    server {
      server_name _;
      listen {{proxy_port}};
      listen {{proxy_ssl_port}} ssl;

      ssl_certificate_by_lua 'kong.exec_plugins_certificate()';

      ssl_certificate {{ssl_cert}};
      ssl_certificate_key {{ssl_key}};
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2;# omit SSLv3 because of POODLE (CVE-2014-3566)

      location / {
        default_type 'text/plain';

        # These properties will be used later by proxy_pass
        set $upstream_host nil;
        set $upstream_url nil;

        # Authenticate the user and load the API info
        access_by_lua 'kong.exec_plugins_access()';

        # Proxy the request
        # Proxy the request
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $upstream_host;
        proxy_pass $upstream_url;
        proxy_pass_header Server;

        # Add additional response headers
        header_filter_by_lua 'kong.exec_plugins_header_filter()';

        # Change the response body
        body_filter_by_lua 'kong.exec_plugins_body_filter()';

        # Log the request
        log_by_lua 'kong.exec_plugins_log()';
      }

      location /robots.txt {
        return 200 'User-agent: *\nDisallow: /';
      }

      error_page 500 /500.html;
      location = /500.html {
        internal;
        content_by_lua '
          local responses = require "kong.tools.responses"
          responses.send_HTTP_INTERNAL_SERVER_ERROR("An unexpected error occurred")
        ';
      }
    }

    server {
      listen {{admin_api_port}};

      client_max_body_size 10m;
      client_body_buffer_size 10m;

      location / {
        default_type application/json;
        content_by_lua '
          ngx.header["Access-Control-Allow-Origin"] = "*"
          if ngx.req.get_method() == "OPTIONS" then
            ngx.header["Access-Control-Allow-Methods"] = "GET,HEAD,PUT,PATCH,POST,DELETE"
            ngx.header["Access-Control-Allow-Headers"] = "Content-Type"
            ngx.exit(204)
          end
          local lapis = require "lapis"
          lapis.serve("kong.api.app")
        ';
      }

      location /nginx_status {
        internal;
        access_log off;
        stub_status;
      }

      location /robots.txt {
        return 200 'User-agent: *\nDisallow: /';
      }

      # Do not remove, additional configuration placeholder for some plugins
      # {{additional_configuration}}
    }
  }