Partially Revert "caddy-frontend: Drop nginx"

This partially reverts commit 863507174c1c3c0365bfa35a7cf298a516b5946d.

Only instance part for nginx is kept, thus Caddy can start replace it.

software/caddy-frontend/buildout.hash.cfg

@@ -19,7 +19,7 @@ md5sum = f686f765e55d1dce2e55a400f0714b3e
 
 [template-apache-frontend]
 filename = instance-apache-frontend.cfg
-md5sum = b11009be54bb2045ca239198c1e6b4f2
+md5sum = 8a4883472d6401bc7669ae70c9bafc43
 
 [template-apache-replicate]
 filename = instance-apache-replicate.cfg.in
@@ -27,7 +27,7 @@ md5sum = 9e76028df7e93d3e32982884d5dc0913
 
 [template-slave-list]
 filename = templates/apache-custom-slave-list.cfg.in
-md5sum = 7c904edd37754ac89b436c3632aca0bc
+md5sum = c4d65c0e32e611083e4d63cded10431f
 
 [template-slave-configuration]
 filename = templates/custom-virtualhost.conf.in
@@ -43,7 +43,7 @@ md5sum = d1a7a759aa2801c96ecf4445a33203f2
 
 [template-custom-slave-list]
 filename = templates/apache-custom-slave-list.cfg.in
-md5sum = 7c904edd37754ac89b436c3632aca0bc
+md5sum = c4d65c0e32e611083e4d63cded10431f
 
 [template-not-found-html]
 filename = templates/notfound.html

software/caddy-frontend/common.cfg

@@ -123,6 +123,13 @@ filename = storage.config.jinja2
 download-only = true
 mode = 0644
 
+# NGINX Configuration
+[template-nginx-configuration]
+recipe = slapos.recipe.template
+url = ${:_profile_base_location_}/templates/nginx.cfg.in
+output = ${buildout:directory}/template-nginx.cfg.in
+mode = 0644
+
 [template-apache-lazy-script-call]
 <=download-template
 filename = apache-lazy-script-call.sh.in
@@ -131,6 +138,14 @@ filename = apache-lazy-script-call.sh.in
 <=download-template
 filename = caddy-graceful-script.sh.in
 
+[template-nginx-eventsource-slave-virtualhost]
+<=download-template
+filename = nginx-eventsource-slave.conf.in
+
+[template-nginx-notebook-slave-virtualhost]
+<=download-template
+filename = nginx-notebook-slave.conf.in
+
 # Migrated from KVM recipe
 [http-proxy]
 # https://github.com/nodejitsu/node-http-proxy

software/caddy-frontend/instance-apache-frontend.cfg

@@ -8,6 +8,7 @@ parts =
   ca-frontend
   certificate-authority
   logrotate-entry-apache
+  logrotate-entry-nginx
   apache-frontend
   switch-apache-softwaretype
   frontend-caddy-graceful
@@ -24,6 +25,13 @@ parts =
   promise-apache-is-process-older-than-dependency-set
   promise-apache-mpm-watchdog
 
+  promise-nginx-frontend-v4-https
+  promise-nginx-frontend-v4-http
+  promise-nginx-frontend-v6-https
+  promise-nginx-frontend-v6-http
+  promise-nginx-configuration
+  promise-nginx-is-process-older-than-dependency-set
+
   trafficserver-launcher
   trafficserver-reload
   trafficserver-configuration-directory
@@ -34,6 +42,9 @@ parts =
   trafficserver-promise-listen-port
   trafficserver-promise-cache-availability
 
+## Nginx
+  nginx-frontend
+
 ## Monitor for apache
   monitor-base
   monitor-ats-cache-stats-wrapper
@@ -73,6 +84,8 @@ crontabs = $${:etc}/crontabs
 cronstamps = $${:etc}/cronstamps
 ca-dir = $${:srv}/ssl
 
+varnginx = $${:var}/nginx
+
 [switch-apache-softwaretype]
 recipe = slapos.cookbook:softwaretype
 single-default = $${dynamic-custom-personal-template-slave-list:rendered}
@@ -95,6 +108,8 @@ configuration.domain = example.org
 configuration.public-ipv4 =
 configuration.port = 4443
 configuration.plain_http_port = 8080
+configuration.plain_nginx_port = 8081
+configuration.nginx_port = 9443
 configuration.server-admin = admin@example.com
 configuration.apache_custom_https = ""
 configuration.apache_custom_http = ""
@@ -154,6 +169,8 @@ template-slave-configuration = ${template-slave-configuration:target}
 template-default-slave-virtualhost = ${template-default-slave-virtualhost:target}
 template-cached-slave-virtualhost = ${template-cached-slave-virtualhost:target}
 caddy-location = ${caddy:location}
+template-nginx-eventsource-slave-virtualhost = ${template-nginx-eventsource-slave-virtualhost:target}
+template-nginx-notebook-slave-virtualhost = ${template-nginx-notebook-slave-virtualhost:target}
 
 [dynamic-custom-personal-template-slave-list]
 < = jinja2-template-base
@@ -162,10 +179,13 @@ filename = custom-personal-instance-slave-list.cfg
 extensions = jinja2.ext.do
 extra-context =
     key apache_configuration_directory caddy-directory:slave-configuration
+    key nginx_configuration_directory caddy-directory:nginx-slave-configuration
     key apache_cached_configuration_directory caddy-directory:slave-with-cache-configuration
     key slave_with_cache_configuration_directory caddy-directory:slave-with-cache-configuration
     key http_port instance-parameter:configuration.plain_http_port
     key https_port instance-parameter:configuration.port
+    key nginx_http_port instance-parameter:configuration.plain_nginx_port
+    key nginx_https_port instance-parameter:configuration.nginx_port
     key public_ipv4 instance-parameter:configuration.public-ipv4
     key slave_instance_list instance-parameter:slave-instance-list
     key extra_slave_instance_list instance-parameter:configuration.extra_slave_instance_list
@@ -174,15 +194,19 @@ extra-context =
     key local_ipv4 instance-parameter:ipv4-random
     key local_ipv6 instance-parameter:ipv6-random
     key global_ipv6 slap-network-information:global-ipv6
+    key varnginx directory:varnginx
     key empty_template software-release-path:template-empty
     key template_custom_slave_configuration software-release-path:template-slave-configuration
     key template_default_slave_configuration software-release-path:template-default-slave-virtualhost
     key template_cached_slave_configuration software-release-path:template-cached-slave-virtualhost
+    key template_eventsource_slave_configuration software-release-path:template-nginx-eventsource-slave-virtualhost
+    key template_notebook_slave_configuration software-release-path:template-nginx-notebook-slave-virtualhost
     raw software_type single-custom-personal
     key frontend_lazy_graceful_reload frontend-caddy-lazy-graceful:rendered
     section logrotate_dict logrotate
     section frontend_configuration frontend-configuration
     section apache_configuration apache-configuration
+    section nginx_configuration nginx-configuration
     key monitor_base_url monitor-instance-parameter:monitor-base-url 
     key promise_directory monitor-directory:promises
     key report_directory monitor-directory:reports
@@ -268,6 +292,7 @@ cache = $${directory:var}/cache
 mod-ssl = $${:cache}/httpd_mod_ssl
 vh-ssl = $${:slave-configuration}/ssl
 slave-log = $${directory:log}/httpd
+nginx-slave-configuration = $${directory:etc}/nginx-slave-conf.d/
 
 [apache-configuration]
 frontend-configuration = $${directory:etc}/Caddyfile
@@ -375,6 +400,18 @@ sharedscripts = true
 notifempty = true
 create = true
 
+[logrotate-entry-nginx]
+<= logrotate
+recipe = slapos.cookbook:logrotate.d
+name = apache-nginx
+log = $${nginx-configuration:error_log} $${nginx-configuration:access_log}
+frequency = daily
+rotatep-num = 30
+post = $${nginx-configuration:nginx-graceful-command}
+sharedscripts = true
+notifempty = true
+create = true
+
 #################
 # Trafficserver
 #################
@@ -659,3 +696,75 @@ path = $${directory:promise}/re6st-connectivity
 url = $${instance-parameter:configuration.re6st-verification-url}
 dash_path = ${dash:location}/bin/dash
 curl_path = ${curl:location}/bin/curl
+
+#######################
+# Nginx
+#
+[nginx-frontend]
+recipe = slapos.cookbook:wrapper
+command-line = ${caddy:output}
+  -conf $${nginx-configuration:output}
+wrapper-path = $${directory:service}/frontend_nginx
+
+[nginx-configuration]
+recipe = slapos.recipe.template
+url = ${template-nginx-configuration:output}
+output = $${directory:etc}/nginx.cfg
+mode = 0600
+access_log = $${directory:log}/nginx-access.log
+error_log = $${directory:log}/nginx-error.log
+ip = $${slap-network-information:global-ipv6}
+local_ip = $${slap-network-information:local-ipv4}
+port = $${instance-parameter:configuration.nginx_port}
+plain_port = $${instance-parameter:configuration.plain_nginx_port}
+worker_processes = 4
+worker_connections = 1024
+slave-configuration-directory = $${caddy-directory:nginx-slave-configuration}
+pid-file = $${directory:run}/nginx.pid 
+nginx-graceful-command = $${:nginx-configuration-verification}; if [ $? -eq 0 ]; then kill -HUP $(cat $${:pid-file}); fi
+nginx-configuration-verification = $${nginx-frontend:wrapper-path} -validate
+
+[frontend-nginx-graceful]
+< = jinja2-template-base
+template = ${template-wrapper:output}
+rendered = $${directory:etc-run}/frontend-nginx-safe-graceful
+mode = 0700
+extra-context =
+    key content nginx-configuration:nginx-graceful-command
+
+[promise-nginx-configuration]
+< = jinja2-template-base
+template = ${template-wrapper:output}
+rendered = $${directory:promise}/nginx-configuration-promise
+mode = 0700
+extra-context =
+    key content nginx-configuration:nginx-configuration-verification
+
+[promise-nginx-frontend-v4-https]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/nginx_frontend_ipv4_https
+hostname = $${instance-parameter:ipv4-random}
+port = $${instance-parameter:configuration.nginx_port}
+
+[promise-nginx-frontend-v4-http]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/nginx_frontend_ipv4_http
+hostname = $${instance-parameter:ipv4-random}
+port = $${instance-parameter:configuration.plain_nginx_port}
+
+[promise-nginx-frontend-v6-https]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/nginx_frontend_ipv6_https
+hostname = $${instance-parameter:ipv6-random}
+port = $${instance-parameter:configuration.nginx_port}
+
+[promise-nginx-frontend-v6-http]
+recipe = slapos.cookbook:check_port_listening
+path = $${directory:promise}/nginx_frontend_ipv6_http
+hostname = $${instance-parameter:ipv6-random}
+port = $${instance-parameter:configuration.plain_nginx_port}
+
+[promise-nginx-is-process-older-than-dependency-set]
+recipe = slapos.cookbook:wrapper
+command-line = ${buildout:bin-directory}/is-process-older-than-dependency-set $${nginx-configuration:pid-file} 
+wrapper-path = $${directory:promise}/promise-nginx-is-process-older-than-dependency-set

software/caddy-frontend/templates/apache-custom-slave-list.cfg.in

@@ -82,8 +82,12 @@ crl = {{ custom_ssl_directory }}/crl/
 {# Set slave domain if none was defined #}
 {%   if slave_instance.get('custom_domain', None) == None -%}
 {%     set domain_prefix = slave_instance.get('slave_reference').replace("-", "").replace("_", "").lower() -%}
+{%     if slave_type in NGINX_TYPE_LIST -%}
+{%       do slave_instance.__setitem__('custom_domain', "%s.%s" % (domain_prefix, slapparameter_dict.get('nginx-domain', slapparameter_dict.get('domain')))) -%}
+{%     else -%}
 {%       do slave_instance.__setitem__('custom_domain', "%s.%s" % (domain_prefix, slapparameter_dict.get('domain'))) -%}
 {%     endif -%}
+{%   endif -%}
 
 {%   set enable_cache = (('' ~ slave_instance.get('enable_cache', '')).lower() in TRUE_VALUES and slave_type != 'redirect') -%}
 {%   if enable_cache and 'url' in slave_instance -%}
@@ -203,7 +207,11 @@ apache_custom_https = {{ dumps(apache_custom_https) }}
 
 [{{ slave_section_title }}]
 < = jinja2-template-base
+{%   if slave_type in NGINX_TYPE_LIST %}
+rendered = {{ nginx_configuration_directory }}/${:filename}
+{%   else %}
 rendered = {{ apache_configuration_directory }}/${:filename}
+{%   endif %}
 
 
 {%   if apache_custom_http %}
@@ -223,6 +231,8 @@ extra-context =
     raw global_ipv6 {{ global_ipv6 }}
     raw local_ipv4 {{ local_ipv4 }}
     raw local_ipv6 {{ local_ipv6 }}
+    raw nginx_http_port {{ nginx_http_port }} 
+    raw nginx_https_port {{ nginx_https_port }}
     section slave_parameter {{ slave_configuration_section_name }}
 {{ '\n' }}
 

software/caddy-frontend/templates/nginx-eventsource-slave.conf.in

+{% set url = slave_parameter.get('url') -%}
+{% set https_url = slave_parameter.get('https-url', url) -%}
+{% if url.startswith("http://") or url.startswith("https://") -%}
+{%   set upstream = url.split("/")[2] -%}
+{%   set https_upstream = https_url.split("/")[2] -%}
+{%   set protocol = url.split("/")[0] -%}
+{%   set https_protocol = https_url.split("/")[0] -%}
+{%   set proxy_pass = '%s//%s' % (protocol, slave_parameter.get('slave_reference')) -%}
+{%   set https_proxy_pass = '%s//https_%s' % (protocol, slave_parameter.get('slave_reference')) -%}
+{%- set ssl_configuration_list = [('ssl_certificate', 'path_to_ssl_crt'),
+                                 ('ssl_certificate_key', 'path_to_ssl_key')] -%}
+
+
+upstream {{ slave_parameter.get('slave_reference') }} {
+  server {{ upstream }};
+}
+
+upstream https_{{ slave_parameter.get('slave_reference') }} {
+  server {{ https_upstream }};
+}
+
+
+server {
+  listen [{{ global_ipv6 }}]:{{ nginx_http_port }};
+  listen {{ local_ipv4 }}:{{ nginx_http_port }};
+
+  server_name {{ slave_parameter.get('custom_domain') }};
+
+  error_log {{ slave_parameter.get('error_log') }} error; 
+  access_log {{ slave_parameter.get('access_log') }} custom;
+  
+  location /pub {
+    push_stream_publisher;
+    push_stream_channels_path $arg_id;
+    # store messages in memory
+    push_stream_store_messages  off;
+
+    # Message size limit
+    # client_max_body_size MUST be equal to client_body_buffer_size or
+    # you will be sorry.
+    client_max_body_size 16k;
+    client_body_buffer_size 16k;
+
+   }
+
+   location ~ /sub/(.*) {
+     # activate subscriber mode for this location
+     add_header "Access-Control-Allow-Origin" "*";
+     add_header 'Access-Control-Allow-Credentials' 'false';
+     add_header 'Access-Control-Allow-Methods' 'GET, HEAD, OPTIONS';
+     add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';
+
+     push_stream_subscriber eventsource;
+     # positional channel path
+     push_stream_channels_path $1;
+
+     # content-type
+     default_type "text/event-stream; charset=utf-8";
+  }
+
+}
+
+server {
+  listen [{{ global_ipv6 }}]:{{ nginx_https_port }} ssl;
+  listen {{ local_ipv4 }}:{{ nginx_https_port }} ssl;
+
+  server_name {{ slave_parameter.get('custom_domain') }};
+
+  error_log {{ slave_parameter.get('error_log') }} error;
+  access_log {{ slave_parameter.get('access_log') }} custom;
+
+  ssl on;
+  
+  ssl_session_timeout 5m;
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_ciphers 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:HIGH:!aNULL:!MD5';
+  ssl_prefer_server_ciphers on;
+  ssl_session_cache shared:SSL:10m;
+
+{% for key, value in ssl_configuration_list -%}
+{%   if value in slave_parameter -%}
+{{ '  %s' % key }} {{ slave_parameter.get(value) }};
+{% endif -%}
+{% endfor %}
+
+  location /pub {
+    push_stream_publisher;
+    push_stream_channels_path $arg_id;
+    # store messages in memory
+    push_stream_store_messages  off;
+
+    # Message size limit
+    # client_max_body_size MUST be equal to client_body_buffer_size or
+    # you will be sorry.
+    client_max_body_size 16k;
+    client_body_buffer_size 16k;
+
+   }
+
+   location ~ /sub/(.*) {
+     # activate subscriber mode for this location
+     add_header "Access-Control-Allow-Origin" "*";
+     add_header 'Access-Control-Allow-Credentials' 'false';
+     add_header 'Access-Control-Allow-Methods' 'GET, HEAD, OPTIONS';
+     add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';
+
+     push_stream_subscriber eventsource;
+     # positional channel path
+     push_stream_channels_path $1;
+
+     # content-type
+     default_type "text/event-stream; charset=utf-8";
+  }
+}
+{% endif -%}

software/caddy-frontend/templates/nginx-notebook-slave.conf.in

+{% set url = slave_parameter.get('url') -%}
+{% set https_url = slave_parameter.get('https-url', url) -%}
+{% if url.startswith("http://") or url.startswith("https://") -%}
+{%   set upstream = url.split("/")[2] -%}
+{%   set https_upstream = https_url.split("/")[2] -%}
+{%   set protocol = url.split("/")[0] -%}
+{%   set https_protocol = https_url.split("/")[0] -%}
+{%   set proxy_pass = '%s//%s' % (protocol, slave_parameter.get('slave_reference')) -%}
+{%   set https_proxy_pass = '%s//https_%s' % (protocol, slave_parameter.get('slave_reference')) -%}
+{%- set ssl_configuration_list = [('ssl_certificate', 'path_to_ssl_crt'),
+                                 ('ssl_certificate_key', 'path_to_ssl_key')] -%}
+
+
+upstream {{ slave_parameter.get('slave_reference') }} {
+  server {{ upstream }};
+}
+
+upstream https_{{ slave_parameter.get('slave_reference') }} {
+  server {{ https_upstream }};
+}
+
+
+server {
+  listen [{{ global_ipv6 }}]:{{ nginx_http_port }};
+  listen {{ local_ipv4 }}:{{ nginx_http_port }};
+
+  server_name {{ slave_parameter.get('custom_domain') }};
+
+  error_log {{ slave_parameter.get('error_log') }} error; 
+  access_log {{ slave_parameter.get('access_log') }} custom;
+
+  location / {
+        proxy_pass            {{ proxy_pass }};
+        proxy_set_header      Host $host;
+  }
+
+  location ~ /api/kernels/ {
+        proxy_pass            {{ proxy_pass }};
+        proxy_set_header      Host $host;
+        # websocket support
+        proxy_http_version    1.1;
+        proxy_set_header      Upgrade "websocket";
+        proxy_set_header      Connection "Upgrade";
+        proxy_read_timeout    86400;
+   }
+
+  location ~ /terminals/ {
+        proxy_pass            {{ proxy_pass }};
+        proxy_set_header      Host $host;
+        # websocket support
+        proxy_http_version    1.1;
+        proxy_set_header      Upgrade "websocket";
+        proxy_set_header      Connection "Upgrade";
+        proxy_read_timeout    86400;
+  }
+}
+
+server {
+  listen [{{ global_ipv6 }}]:{{ nginx_https_port }} ssl;
+  listen {{ local_ipv4 }}:{{ nginx_https_port }} ssl;
+
+  server_name {{ slave_parameter.get('custom_domain') }};
+
+  error_log {{ slave_parameter.get('error_log') }} error;
+  access_log {{ slave_parameter.get('access_log') }} custom;
+
+  ssl on;
+  
+  ssl_session_timeout 5m;
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_ciphers 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:HIGH:!aNULL:!MD5';
+  ssl_prefer_server_ciphers on;
+  ssl_session_cache shared:SSL:10m;
+
+{% for key, value in ssl_configuration_list -%}
+{%   if value in slave_parameter -%}
+{{ '  %s' % key }} {{ slave_parameter.get(value) }};
+{% endif -%}
+{% endfor %}
+
+  location / {
+        proxy_pass            {{ https_proxy_pass }};
+        proxy_set_header      Host $host;
+  }
+
+  location ~ /api/kernels/ {
+        proxy_pass            {{ https_proxy_pass }};
+        proxy_set_header      Host $host;
+        # websocket support
+        proxy_http_version    1.1;
+        proxy_set_header      Upgrade "websocket";
+        proxy_set_header      Connection "Upgrade";
+        proxy_read_timeout    86400;
+   }
+
+  location ~ /terminals/ {
+        proxy_pass            {{ https_proxy_pass }};
+        proxy_set_header      Host $host;
+        # websocket support
+        proxy_http_version    1.1;
+        proxy_set_header      Upgrade "websocket";
+        proxy_set_header      Connection "Upgrade";
+        proxy_read_timeout    86400;
+  }
+}
+{% endif -%}

software/caddy-frontend/templates/nginx.cfg.in

+daemon off; # run in the foreground so supervisord can look after it
+
+worker_processes $${nginx-configuration:worker_processes};
+pid $${nginx-configuration:pid-file};
+
+events {
+  worker_connections $${nginx-configuration:worker_connections};
+  # multi_accept on;
+}
+
+error_log $${nginx-configuration:error_log};
+
+http {
+
+  ##
+  # Basic Settings
+  ##
+
+  sendfile on;
+  tcp_nopush on;
+  tcp_nodelay on;
+  keepalive_timeout 65;
+  types_hash_max_size 2048;
+  server_tokens off;
+
+  error_log $${nginx-configuration:error_log};
+  log_format custom '$remote_addr - $remote_user $time_local $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time';
+  access_log $${nginx-configuration:access_log} custom;
+
+  # server_names_hash_bucket_size 64;
+  # server_name_in_redirect off;
+
+  default_type application/octet-stream;
+
+  ssl_certificate $${ca-frontend:cert-file};
+  ssl_certificate_key $${ca-frontend:key-file};
+
+  ##
+  # Gzip Settings
+  ##
+  gzip on;
+  gzip_disable "msie6";
+
+  gzip_vary on;
+  gzip_proxied any;
+  gzip_comp_level 6;
+  gzip_buffers 16 8k;
+  gzip_http_version 1.1;
+  gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
+  
+  ##
+  # Push stream Settings
+  ##
+  push_stream_shared_memory_size                32m;
+
+  fastcgi_temp_path  $${directory:varnginx} 1 2;
+  uwsgi_temp_path  $${directory:varnginx} 1 2;
+  scgi_temp_path  $${directory:varnginx} 1 2;
+
+  client_body_temp_path $${directory:varnginx} 1 2;
+  proxy_temp_path $${directory:varnginx} 1 2;
+
+  include $${nginx-configuration:slave-configuration-directory}/*.conf;
+
+  server {
+    listen [$${nginx-configuration:ip}]:$${nginx-configuration:plain_port};
+    listen $${nginx-configuration:local_ip}:$${nginx-configuration:plain_port};
+
+
+    ## Serve an error 204 (No Content) for favicon.ico
+    location = /favicon.ico {
+      return 204;
+    }
+
+    location / {
+      root $${apache-directory:document-root};
+      index notfound.html;
+    }
+  }
+
+  server {
+    listen [$${nginx-configuration:ip}]:$${nginx-configuration:port} ssl;
+    listen $${nginx-configuration:local_ip}:$${nginx-configuration:port} ssl;
+
+    ssl on;
+  
+    ssl_session_timeout 5m;
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:HIGH:!aNULL:!MD5';
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+
+    ## Serve an error 204 (No Content) for favicon.ico
+    location = /favicon.ico {
+      return 204;
+    }
+
+    location / {
+      root $${apache-directory:document-root};
+      index notfound.html;
+    }
+  }
+}