Skip to content

Commit 4e3b390

Browse files
authored
Merge branch 'main' into agent/nms-46504
2 parents 11e16b4 + 25c12b2 commit 4e3b390

File tree

10 files changed

+289
-390
lines changed

10 files changed

+289
-390
lines changed

.github/workflows/ossf_scorecard.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,6 @@ jobs:
5656

5757
# Upload the results to GitHub's code scanning dashboard.
5858
- name: Upload SARIF results to code scanning
59-
uses: github/codeql-action/upload-sarif@df559355d593797519d70b90fc8edd5db049e7a2 # v3.29.5
59+
uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
6060
with:
6161
sarif_file: results.sarif

content/includes/nim/installation/optional-steps/install-configure-vault.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@ NGINX Instance Manager can use [Vault](https://www.vaultproject.io/) as a datast
1111

1212
To install and enable Vault, follow these steps:
1313

14-
- Follow Vault's instructions to [install Vault 1.8.8 or later](https://www.vaultproject.io/docs/install) for your distribution.
14+
- Follow Vault's instructions to [install Vault 1.8.8 or later](https://developer.hashicorp.com/vault/install) for your operating system.
1515
- Ensure you're running Vault in a [production-hardened environment](https://learn.hashicorp.com/tutorials/vault/production-hardening).
1616
- After installing NGINX Instance Manager, follow the steps to [configure Vault for storing secrets]({{< ref "/nim/system-configuration/configure-vault.md" >}}).

content/includes/nim/tech-specs/nim-app-protect-support.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ NGINX Instance Manager supports the following versions of [NGINX App Protect WAF
88

99
| NGINX Instance Manager | NGINX App Protect WAF |
1010
|------------------------|------------------------------------|
11-
| 2.17.0–2.20.0 | Release 4.8.0–4.15.0, 5.1.0–5.7.0 |
11+
| 2.17.0–2.20.0 | Release 4.8.0–4.16.0, 5.1.0–5.8.0 |
1212
| 2.15.1–2.16.0 | Release 4.8.0–4.10.0 |
1313
| 2.14.1–2.15.0 | Release 4.4.0–4.7.0 |
1414
| 2.13.0–2.14.0 | Release 4.3.0–4.5.0 |

content/nginx/admin-guide/dynamic-modules/acme.md

Lines changed: 54 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -198,25 +198,71 @@ In a text editor, open the NGINX Plus configuration file:
198198
- `/etc/nginx/nginx.conf` for Linux
199199
- `/usr/local/etc/nginx/nginx.conf` for FreeBSD
200200
201-
For a complete list of directives, embedded variables, default span attributes, refer to the `ngx_http_acme_module` official documentation.
202201
203-
List of directives:
202+
For a complete list of directives and variables refer to the `ngx_http_acme_module` [official documentation](https://nginx.org/en/docs/http/ngx_http_acme_module.html) and [NGINX ACME module GitHub project](https://github.com/nginx/nginx-acme).
204203
205-
[`https://nginx.org/en/docs/http/ngx_http_acme_module.html#directives`](https://nginx.org/en/docs/ngx_otel_module.html#directives)
204+
1. To enable ACME functionality, specify the directory URL of the ACME server with the [`uri`](https://nginx.org/en/docs/http/ngx_http_acme_module.html#uri) directive.
206205
207-
List of variables:
206+
Additionally, you can provide information regarding how to contact the client in case of certificate-related issues or where to store module data with the [`contact`](https://nginx.org/en/docs/http/ngx_http_acme_module.html#contact) and [`state_path`](https://nginx.org/en/docs/http/ngx_http_acme_module.html#state_path) directives.
208207
209-
[`https://nginx.org/en/docs/http/ngx_http_acme_module.html#variables`](https://nginx.org/en/docs/ngx_otel_module.html#variables)
208+
```nginx
209+
acme_issuer letsencrypt {
210+
uri https://acme-v02.api.letsencrypt.org/directory;
211+
# contact [email protected];
212+
state_path /var/cache/nginx/acme-letsencrypt;
210213
214+
accept_terms_of_service;
215+
}
216+
```
211217
212-
## Usage example
218+
2. If necessary, you can increase the default shared memory zone that stores certificates, private keys, and challenge data for all the configured certificate issuers with the [`acme_shared_zone`](https://nginx.org/en/docs/http/ngx_http_acme_module.html#acme_shared_zone) directive. The default zone size is `256k`.
213219
214-
```shell
220+
```nginx
221+
acme_shared_zone zone=acme_shared:1M;
222+
```
223+
224+
3. Configure Challenges by defining a listener on port 80 in the nginx configuration to process ACME HTTP-01 challenges:
225+
226+
```nginx
227+
server {
228+
# listener on port 80 is required to process ACME HTTP-01 challenges
229+
listen 80;
230+
231+
location / {
232+
#Serve a basic 404 response while listening for challenges
233+
return 404;
234+
}
235+
}
236+
```
237+
238+
4. Automate the issuance or renewal of TLS certificates with the [`acme_certificate`](https://nginx.org/en/docs/http/ngx_http_acme_module.html#acme_certificate) directive in the respective [`server`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server) block. The directive requires the list of identifiers (domains) for which the certificates need to be dynamically issued that can be defined with the [`server_name`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_name) directive. The [`$acme_certificate`](https://nginx.org/en/docs/http/ngx_http_core_module.html#var_acme_certificate_key) and [`$acme_certificate_key`](https://nginx.org/en/docs/http/ngx_http_core_module.html#var_acme_certificate_key) variables are used to pass the SSL certificate and key information for the associated domain:
239+
240+
```nginx
241+
server {
242+
243+
listen 443 ssl;
244+
245+
server_name .example.com;
246+
247+
acme_certificate letsencrypt;
248+
249+
ssl_certificate $acme_certificate;
250+
ssl_certificate_key $acme_certificate_key;
251+
ssl_certificate_cache max=2;
252+
}
253+
```
254+
255+
Note that not all values accepted by the [`server_name`](https://nginx.org/en/docs/http/ngx_http_core_module.html#server_name) directive are valid identifiers. Wildcards and regular expressions are not supported.
256+
257+
258+
## Full example
259+
260+
```nginx
215261
resolver 127.0.0.1:53;
216262
217263
acme_issuer example {
218264
uri https://acme.example.com/directory;
219-
# contact [email protected];
265+
# contact [email protected];
220266
state_path /var/cache/nginx/acme-example;
221267
accept_terms_of_service;
222268
}

content/nim/fundamentals/tech-specs.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,9 @@ The table below shows the estimated storage requirements for **NGINX OSS**, base
132132
| | 250 | 14 | 4 GiB |
133133
{{</bootstrap-table>}}
134134

135+
## ClickHouse tuning {#clickhouse-tuning}
136+
The default ClickHouse configuration works efficiently with NGINX Instance Manager. If you change the configuration and ClickHouse runs out of memory, see the [ClickHouse configuration guide]({{< ref "/nim/system-configuration/configure-clickhouse.md#clickhouse-tuning" >}}) to adjust the settings.
137+
135138
## Firewall ports {#firewall}
136139

137140
NGINX Instance Manager and NGINX Agent use the Unix domain socket by default and proxy through the gateway on port `443`.

content/nim/nginx-app-protect/setup-waf-config-management.md

Lines changed: 32 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -55,13 +55,15 @@ The table below shows which WAF compiler version to use for each version of NGIN
5555

5656
| NGINX App Protect WAF version | WAF compiler version |
5757
|-------------------------------|----------------------------|
58+
| 5.8.0 | nms-nap-compiler-v5.498.0 |
5859
| 5.7.0 | nms-nap-compiler-v5.442.0 |
5960
| 5.6.0 | nms-nap-compiler-v5.342.0 |
6061
| 5.5.0 | nms-nap-compiler-v5.264.0 |
6162
| 5.4.0 | nms-nap-compiler-v5.210.0 |
6263
| 5.3.0 | nms-nap-compiler-v5.144.0 |
6364
| 5.2.0 | nms-nap-compiler-v5.48.0 |
6465
| 5.1.0 | nms-nap-compiler-v5.17.0 |
66+
| 4.16.0 | nms-nap-compiler-v5.498.0 |
6567
| 4.15.0 | nms-nap-compiler-v5.442.0 |
6668
| 4.14.0 | nms-nap-compiler-v5.342.0 |
6769
| 4.13.0 | nms-nap-compiler-v5.264.0 |
@@ -88,13 +90,13 @@ The table below shows which WAF compiler version to use for each version of NGIN
8890
To install the WAF compiler on Debian or Ubuntu, run the following command:
8991

9092
```shell
91-
sudo apt-get install nms-nap-compiler-v5.442.0
93+
sudo apt-get install nms-nap-compiler-v5.498.0
9294
```
9395

9496
If you want to install more than one version of the WAF compiler on the same system, append the `--force-overwrite` option to the install command after the first installation:
9597

9698
```shell
97-
sudo apt-get install nms-nap-compiler-v5.442.0 -o Dpkg::Options::="--force-overwrite"
99+
sudo apt-get install nms-nap-compiler-v5.498.0 -o Dpkg::Options::="--force-overwrite"
98100
```
99101

100102
{{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -118,7 +120,7 @@ To install the WAF compiler on RHEL 8.1 :
118120
3. Install the WAF compiler:
119121

120122
```shell
121-
sudo yum install nms-nap-compiler-v5.442.0
123+
sudo yum install nms-nap-compiler-v5.498.0
122124
```
123125

124126
### RHEL 9
@@ -140,7 +142,7 @@ To install the WAF compiler on RHEL 9:
140142
3. Install the WAF compiler:
141143

142144
```shell
143-
sudo yum install nms-nap-compiler-v5.442.0
145+
sudo yum install nms-nap-compiler-v5.498.0
144146
```
145147

146148
4. {{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -164,7 +166,7 @@ To install the WAF compiler on Oracle Linux 8.1:
164166
3. Install the WAF compiler:
165167

166168
```shell
167-
sudo yum install nms-nap-compiler-v5.442.0
169+
sudo yum install nms-nap-compiler-v5.498.0
168170
```
169171

170172
4. {{< include "nim/nap-waf/restart-nms-integrations.md" >}}
@@ -240,20 +242,23 @@ error when creating the nginx repo retriever - NGINX repo certificates not found
240242

241243
If needed, you can also [install the WAF compiler manually](#install-the-waf-compiler).
242244

245+
243246
## Install or update the WAF compiler in a disconnected environment
244247

245248
To install the WAF compiler on a system without internet access, complete these steps:
246249

247250
- **Step 1:** Generate the WAF compiler package on a system that has internet access.
248251
- **Step 2:** Move the generated package to the offline target system and install it.
249252

253+
250254
Note : Version of NAP compiler can be referred from the table at the top of this page.
251-
Current latest version 5.442.0 at the point of writing this document is used in below commands.
255+
Current latest version 5.498.0 at the point of writing this document is used in below commands.
252256

253257
{{<tabs name="WAF compiler installation in offline environment">}}
254258

255259
{{%tab name="Ubuntu"%}}
256260

261+
257262
### Install on Ubuntu 24.04, 22.04
258263

259264
#### Step 1: On a system with internet access
@@ -276,10 +281,12 @@ sudo tee /etc/apt/sources.list.d/nms.list
276281
sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx
277282
mkdir -p compiler && cd compiler
278283
sudo apt-get update
279-
sudo apt-get download nms-nap-compiler-v5.442.0
284+
285+
sudo apt-get download nms-nap-compiler-v5.498.0
280286
cd ../
281287
mkdir -p compiler/compiler.deps
282-
sudo apt-get install --download-only --reinstall --yes --print-uris nms-nap-compiler-v5.442.0 | grep ^\' | cut -d\' -f2 | xargs -n 1 wget -P ./compiler/compiler.deps
288+
sudo apt-get install --download-only --reinstall --yes --print-uris nms-nap-compiler-v5.498.0 | grep ^\' | cut -d\' -f2 | xargs -n 1 wget -P ./compiler/compiler.deps
289+
283290
tar -czvf compiler.tar.gz compiler/
284291
```
285292

@@ -320,10 +327,12 @@ sudo tee /etc/apt/sources.list.d/nms.list
320327
sudo wget -q -O /etc/apt/apt.conf.d/90pkgs-nginx https://cs.nginx.com/static/files/90pkgs-nginx
321328
mkdir -p compiler && cd compiler
322329
sudo apt-get update
323-
sudo apt-get download nms-nap-compiler-v5.442.0
330+
331+
sudo apt-get download nms-nap-compiler-v5.498.0
332+
324333
cd ../
325334
mkdir -p compiler/compiler.deps
326-
sudo apt-get install --download-only --reinstall --yes --print-uris nms-nap-compiler-v5.442.0 | grep ^\' | cut -d\' -f2 | xargs -n 1 wget -P ./compiler/compiler.deps
335+
sudo apt-get install --download-only --reinstall --yes --print-uris nms-nap-compiler-v5.498.0 | grep ^\' | cut -d\' -f2 | xargs -n 1 wget -P ./compiler/compiler.deps
327336
tar -czvf compiler.tar.gz compiler/
328337
```
329338

@@ -340,6 +349,7 @@ sudo dpkg -i ./compiler/*.deb
340349

341350
{{%/tab%}}
342351

352+
343353
{{%tab name="RHEL9, Oracle-9 "%}}
344354

345355
### Install on RHEL 9 or Oracle Linux 9
@@ -359,7 +369,8 @@ sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/nms.repo
359369
sudo yum-config-manager --disable rhel-9-appstream-rhui-rpms
360370
sudo yum update -y
361371
sudo mkdir -p nms-nap-compiler
362-
sudo yumdownloader --resolve --destdir=nms-nap-compiler nms-nap-compiler-v5.442.0
372+
373+
sudo yumdownloader --resolve --destdir=nms-nap-compiler nms-nap-compiler-v5.498.0
363374
tar -czvf compiler.tar.gz nms-nap-compiler/
364375
```
365376

@@ -376,6 +387,7 @@ sudo dnf install *.rpm --disablerepo=*
376387

377388
{{%/tab%}}
378389

390+
379391
{{%tab name="Redhat-8, Oracle-8"%}}
380392

381393
### Install on RHEL-8 or Oracle Linux 8
@@ -401,7 +413,8 @@ EOF
401413
402414
sudo yum update -y
403415
sudo mkdir -p nms-nap-compiler
404-
sudo yumdownloader --resolve --destdir=nms-nap-compiler nms-nap-compiler-v5.442.0
416+
417+
sudo yumdownloader --resolve --destdir=nms-nap-compiler nms-nap-compiler-v5.498.0
405418
tar -czvf compiler.tar.gz nms-nap-compiler/
406419
```
407420

@@ -1194,21 +1207,21 @@ sudo /opt/nms-nap-compiler/app_protect-<version>/bin/apcompile -h
11941207
**Example:**
11951208
11961209
```shell
1197-
sudo /opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -h
1210+
sudo /opt/nms-nap-compiler/app_protect-5.498.0/bin/apcompile -h
11981211
```
11991212
12001213
**Expected output:**
12011214
12021215
```text
12031216
USAGE:
1204-
/opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile <options>
1217+
/opt/nms-nap-compiler/app_protect-5.498.0/bin/apcompile <options>
12051218
12061219
Examples:
1207-
/opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -p /path/to/policy.json -o mypolicy.tgz
1208-
/opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -p policyA.json -g myglobal.json -o /path/to/policyA_bundle.tgz
1209-
/opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -g myglobalsettings.json --global-state-outfile /path/to/myglobalstate.tgz
1210-
/opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -b /path/to/policy_bundle.tgz --dump
1211-
/opt/nms-nap-compiler/app_protect-5.442.0/bin/apcompile -l logprofA.json -o /path/to/logprofA_bundle.tgz
1220+
/opt/nms-nap-compiler/app_protect-5.498.0/bin/apcompile -p /path/to/policy.json -o mypolicy.tgz
1221+
/opt/nms-nap-compiler/app_protect-5.498.0/bin/apcompile -p policyA.json -g myglobal.json -o /path/to/policyA_bundle.tgz
1222+
/opt/nms-nap-compiler/app_protect-5.498.0/bin/apcompile -g myglobalsettings.json --global-state-outfile /path/to/myglobalstate.tgz
1223+
/opt/nms-nap-compiler/app_protect-5.498.0/bin/apcompile -b /path/to/policy_bundle.tgz --dump
1224+
/opt/nms-nap-compiler/app_protect-5.498.0/bin/apcompile -l logprofA.json -o /path/to/logprofA_bundle.tgz
12121225
```
12131226
12141227
### Confirm NGINX Agent configuration on the NGINX App Protect WAF instance

0 commit comments

Comments
 (0)