worker_processes  1;
error_log error.log info;

events {
  worker_connections  1024;
}

http {
  # override file paths
  client_body_temp_path /usr/local/nginx/client_body_temp;
  proxy_temp_path /usr/local/nginx/proxy_temp;
  fastcgi_temp_path /usr/local/nginx/fastcgi_temp;
  uwsgi_temp_path /usr/local/nginx/uwsgi_temp;
  scgi_temp_path /usr/local/nginx/scgi_temp;

  default_type  application/octet-stream;
  # include mime.types;
  types {
    text/html                   html htm shtml;
    text/css                    css;
    application/javascript      js;
    application/wasm            wasm;
    text/plain                  txt;
    image/svg+xml               svg svgz;
    image/gif                   gif;
    image/jpeg                  jpeg jpg;
    image/png                   png;
    image/tiff                  tif tiff;
    image/x-icon                ico;
    image/x-ms-bmp              bmp;
    font/woff                   woff;
    font/woff2                  woff2;
    application/json            json;
    application/zip             zip;
    audio/mpeg                  mp3;
    audio/ogg                   ogg;
    audio/x-m4a                 m4a;
    video/mp4                   mp4;
    video/mpeg                  mpeg mpg;
    video/quicktime             mov;
    video/webm                  webm;
  }

  gzip on;
  gzip_disable "msie6";
  gzip_disable "MSIE [1-6]\.";
  gzip_proxied any;
  gzip_http_version 1.1;
  gzip_min_length 500;
  gzip_comp_level 9;
  gzip_types  text/plain text/css text/xml text/javascript;
              application/json application/javascript
              application/xml application/xml+rss application/atom+xml;

  client_max_body_size 10m;

  log_format format '[$time_local] "$request" $status $remote_addr:$remote_port -> SERVER:$server_name:$server_port
    DURATION=$request_time / RECEIVED=$request_length;BODY=$content_length;Content-Length=$http_content_length; / SENT=$bytes_sent;BODY=$body_bytes_sent
    HEADERS= Host: "$http_host" Origin: "$http_origin" User-Agent: "$http_user_agent" X-header: "$http_x_header"';
  access_log access.log format;

  sendfile on;
  tcp_nopush on;
  #keepalive_timeout  0;
  keepalive_timeout 65;
  underscores_in_headers on;
  server_tokens off;
  etag off;
  add_header X-XSS-Protection '1; mode=block';

  # whitelist cross-origin servers
  #   - default to same origin
  #   - allow HTTP/HTTPS example.com:8080
  #   - set * for all other HTTPS domains
  map $http_origin $allowed_origin {
    default                     "$scheme://$hostname:$server_port";
    "http://example.com:8080"     $http_origin;
    "https://example.com:8080"    $http_origin;
    "~^https://.+"              "*";
  }

  root html;

  server {
    set $root html;
    listen 8080 default_server;
    listen [::]:8080 default_server;
    server_name _;

    error_page 500 502 503 504  /50x.html;
    location = /50x.html {
      root html;
    }
    error_page 400 404  @notfound;
    location @notfound {
      return 404 'Not found\n';
    }

    # index index.html;

    location / {
      # Preflighted requests
      if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' $allowed_origin;
        # Allow cookies
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        # Custom headers and headers various browsers *should* be OK with but aren't
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        # add_header 'Content-Type' 'text/plain charset=UTF-8';
        # add_header 'Content-Length' 0;
        return 204;
      }
      if ($request_method = 'POST') {
        add_header 'Access-Control-Allow-Origin' $allowed_origin;
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
      }
      if ($request_method = 'GET') {
        add_header 'Access-Control-Allow-Origin' $allowed_origin;
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
      }

      try_files $uri $uri/ =404;
    }

    location /app/ {
      alias $root/app_files/;
    }

    # include other conf-files (at server-level)
    include other.conf;
  }
}

# download nginx source
curl -sSL https://nginx.org/download/nginx-1.22.1.tar.gz | tar -xzf -

# download build-tools
sudo dnf install -y --setopt=install_weak_deps=False gcc binutils make
  # pcre-devel for ngx_http_rewrite_module
  # zlib-devel for ngx_http_gzip_static_module

# either install openssl-devel, pcre-devel, and zlib-devel
sudo dnf install -y --setopt=install_weak_deps=False openssl-devel pcre-devel zlib-devel
# or download sources and use --with-prce/openssl/zlib
curl -sSL https://www.zlib.net/zlib-1.2.13.tar.gz | tar -xzf -
curl -sSL https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.40/pcre2-10.40.tar.gz | tar -xzf -
curl -sSL https://www.openssl.org/source/openssl-3.0.7.tar.gz | tar -xzf -

{ cd nginx-1.22.1; ./configure --help; } # view configuration options
# edit the nginx.conf to not listen on privileged port 80
sed -E -i 's/listen +80;/listen 8080;/' nginx-1.22.1/conf/nginx.conf

# run the helper script
./nginx.sh configure
./nginx.sh build
./nginx.sh install
./nginx.sh run

#!/bin/sh

set -o nounset
set -o errexit

pushd "$(dirname $(readlink -f ${0}))" > /dev/null
INSTALLDIR=${INSTALLDIR:-${PWD}/installdir}
BUILDDIR=${PWD}/builddir
mkdir -p ${BUILDDIR} 2>/dev/null || :

function configure
{
  PREFIX='.'
  pushd nginx-1.22.1 > /dev/null && \
  ./configure \
    --build=custom-build \
    --with-cc-opt='-O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -Wno-pointer-to-int-cast -Wno-unused-function' \
    --with-ld-opt="-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -Wl,-z,origin,-rpath='\$\$ORIGIN',--disable-new-dtags" \
    --with-debug \
    --builddir=${BUILDDIR} \
    --with-zlib=../zlib-1.2.13 --with-zlib-opt='-fPIE -pie -Wl,-z,relro -Wl,-z,now' \
    --with-pcre=../pcre2-10.40 --with-pcre-opt='-fPIE -pie -Wl,-z,relro -Wl,-z,now' \
    --with-openssl=../openssl-3.0.7 \
    \
    --prefix=${PREFIX} \
    --sbin-path=${PREFIX} \
    --conf-path=${PREFIX}/conf/nginx.conf \
    --pid-path=${PREFIX}/nginx.pid \
    --lock-path=${PREFIX}/lock \
    --modules-path=${PREFIX}/modules \
    --error-log-path=${PREFIX}/error.log \
    --http-log-path=${PREFIX}/access.log \
    --http-client-body-temp-path=${PREFIX}/tmp/client_body \
    --http-proxy-temp-path=${PREFIX}/tmp/proxy \
    --http-fastcgi-temp-path=${PREFIX}/tmp/fastcgi \
    --http-uwsgi-temp-path=${PREFIX}/tmp/uwsgi \
    --http-scgi-temp-path=${PREFIX}/tmp/scgi \
    --user=$(id -u) \
    --group=$(id -g) \
    \
    --with-http_ssl_module \
    --with-http_v2_module \
    --with-http_gzip_static_module \
    --with-http_dav_module \
    --with-http_stub_status_module
  popd > /dev/null
}
function build
{
  pushd nginx-1.22.1 > /dev/null
  make build
}
function install
{
  mkdir -p ${INSTALLDIR}/{conf,lock,modules,tmp} 2>/dev/null || :
  cp -v ${BUILDDIR}/nginx ${INSTALLDIR}/
  cp -vr nginx-1.22.1/conf ${INSTALLDIR}/
  cp -vr nginx-1.22.1/html ${INSTALLDIR}/
}
function run
{
  pushd ${INSTALLDIR}
  ./nginx -g "daemon off; error_log stderr info;" $@
}
function reload
{
  cp confs/*.conf ${INSTALLDIR}/conf/
  cp -r public/* ${INSTALLDIR}/html/
  kill -s HUP $(cat ${INSTALLDIR}/nginx.pid)
}

if [ $# -eq 0 ]
then
  echo "USAGE: ${0} configure | build | install | run | reload"
else
  "$@"
fi

http {
  perl_modules /opt/app-root/etc/perl;
  perl_require Version.pm;
  perl_set $perl_version Version::installed;
}

upstream fastcgi_backend {
    server 127.0.0.1:9000;

    keepalive 8;
}

server {
    ...

    location /fastcgi/ {
        fastcgi_pass fastcgi_backend;
        fastcgi_keep_conn on;
        ...
    }
}