Template init lua cfg and fix configs

internal/ingress/controller/nginx.go

@@ -690,6 +690,10 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error {
 		return err
 	}
 
+	err = n.createLuaConfig(&cfg)
+	if err != nil {
+		return err
+	}
 	err = createOpentelemetryCfg(&cfg)
 	if err != nil {
 		return err
@@ -1079,6 +1083,32 @@ func createOpentelemetryCfg(cfg *ngx_config.Configuration) error {
 	return os.WriteFile(cfg.OpentelemetryConfig, tmplBuf.Bytes(), file.ReadWriteByUser)
 }
 
+func (n *NGINXController) createLuaConfig(cfg *ngx_config.Configuration) error {
+	luaconfigs := &ngx_template.LuaConfig{
+		EnableMetrics: n.cfg.EnableMetrics,
+		ListenPorts: ngx_template.LuaListenPorts{
+			HTTPSPort:    strconv.Itoa(n.cfg.ListenPorts.HTTPS),
+			StatusPort:   strconv.Itoa(nginx.StatusPort),
+			SSLProxyPort: strconv.Itoa(n.cfg.ListenPorts.SSLProxy),
+		},
+		UseProxyProtocol:        cfg.UseProxyProtocol,
+		UseForwardedHeaders:     cfg.UseForwardedHeaders,
+		IsSSLPassthroughEnabled: n.cfg.EnableSSLPassthrough,
+		HTTPRedirectCode:        cfg.HTTPRedirectCode,
+		EnableOCSP:              cfg.EnableOCSP,
+		MonitorBatchMaxSize:     n.cfg.MonitorMaxBatchSize,
+		HSTS:                    cfg.HSTS,
+		HSTSMaxAge:              cfg.HSTSMaxAge,
+		HSTSIncludeSubdomains:   cfg.HSTSIncludeSubdomains,
+		HSTSPreload:             cfg.HSTSPreload,
+	}
+	jsonCfg, err := json.Marshal(luaconfigs)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(luaCfgPath, jsonCfg, file.ReadWriteByUser)
+}
+
 func cleanTempNginxCfg() error {
 	var files []string
 

internal/ingress/controller/template/template.go

@@ -194,13 +194,39 @@ func cleanConf(in, out *bytes.Buffer) error {
 	}
 }
 
-type LuaConfigs struct {
-	EnableMetrics       bool   `json:"enable_metrics"`
-	HTTPSPort           string `json:"httpsPort"`
-	StatusPort          string `json:"status_port"`
-	UseForwardedPorts   bool   `json:"use_forwarded_ports"`
-	EnableOCSP          bool   `json:"enable_ocsp"`
-	MonitorBatchMaxSize int    `json:"monitor_batch_max_size"`
+/* LuaConfig defines the structure that will be written as a config for lua scripts
+The json format should follow what's expected by lua:
+		use_forwarded_headers = %t,
+		use_proxy_protocol = %t,
+		is_ssl_passthrough_enabled = %t,
+		http_redirect_code = %v,
+		listen_ports = { ssl_proxy = "%v", https = "%v" },
+
+		hsts = %t,
+		hsts_max_age = %v,
+		hsts_include_subdomains = %t,
+		hsts_preload = %t,
+*/
+
+type LuaConfig struct {
+	EnableMetrics           bool           `json:"enable_metrics"`
+	ListenPorts             LuaListenPorts `json:"listen_ports"`
+	UseForwardedHeaders     bool           `json:"use_forwarded_headers"`
+	UseProxyProtocol        bool           `json:"use_proxy_protocol"`
+	IsSSLPassthroughEnabled bool           `json:"is_ssl_passthrough_enabled"`
+	HTTPRedirectCode        int            `json:"http_redirect_code"`
+	EnableOCSP              bool           `json:"enable_ocsp"`
+	MonitorBatchMaxSize     int            `json:"monitor_batch_max_size"`
+	HSTS                    bool           `json:"hsts"`
+	HSTSMaxAge              string         `json:"hsts_max_age"`
+	HSTSIncludeSubdomains   bool           `json:"hsts_include_subdomains"`
+	HSTSPreload             bool           `json:"hsts_preload"`
+}
+
+type LuaListenPorts struct {
+	HTTPSPort    string `json:"https"`
+	StatusPort   string `json:"status_port"`
+	SSLProxyPort string `json:"ssl_proxy"`
 }
 
 // Write populates a buffer using a template with NGINX configuration
@@ -441,13 +467,21 @@ func locationConfigForLua(l, a interface{}) string {
 		return "{}"
 	}
 
-	return fmt.Sprintf(`{
-		force_ssl_redirect = %t,
-		ssl_redirect = %t,
-		force_no_ssl_redirect = %t,
-		preserve_trailing_slash = %t,
-		use_port_in_redirects = %t,
-	}`,
+	/* Lua expects the following vars
+		force_ssl_redirect = string_to_bool(ngx.var.force_ssl_redirect),
+	    ssl_redirect = string_to_bool(ngx.var.ssl_redirect),
+	    force_no_ssl_redirect = string_to_bool(ngx.var.force_no_ssl_redirect),
+	    preserve_trailing_slash = string_to_bool(ngx.var.preserve_trailing_slash),
+	    use_port_in_redirects = string_to_bool(ngx.var.use_port_in_redirects),
+	*/
+
+	return fmt.Sprintf(`
+	    set $force_ssl_redirect "%t";
+	    set $ssl_redirect "%t";
+	    set $force_no_ssl_redirect "%t";
+	    set $preserve_trailing_slash "%t";
+	    set $use_port_in_redirects "%t";
+	`,
 		location.Rewrite.ForceSSLRedirect,
 		location.Rewrite.SSLRedirect,
 		isLocationInLocationList(l, all.Cfg.NoTLSRedirectLocations),

internal/ingress/controller/util.go

@@ -98,8 +98,9 @@ func rlimitMaxNumFiles() int {
 }
 
 const (
-	defBinary = "/usr/bin/nginx"
-	cfgPath   = "/etc/nginx/nginx.conf"
+	defBinary  = "/usr/bin/nginx"
+	cfgPath    = "/etc/nginx/nginx.conf"
+	luaCfgPath = "/etc/nginx/lua/cfg.json"
 )
 
 // NginxExecTester defines the interface to execute

rootfs/etc/nginx/lua/lua_ingress.lua

@@ -1,4 +1,5 @@
 local ngx_re_split = require("ngx.re").split
+local string_to_bool = require("util").string_to_bool
 
 local certificate_configured_for_current_request =
   require("certificate").configured_for_current_request
@@ -108,7 +109,16 @@ end
 -- rewrite gets called in every location context.
 -- This is where we do variable assignments to be used in subsequent
 -- phases or redirection
-function _M.rewrite(location_config)
+function _M.rewrite()
+
+  local location_config = {
+    force_ssl_redirect = string_to_bool(ngx.var.force_ssl_redirect),
+    ssl_redirect = string_to_bool(ngx.var.ssl_redirect),
+    force_no_ssl_redirect = string_to_bool(ngx.var.force_no_ssl_redirect),
+    preserve_trailing_slash = string_to_bool(ngx.var.preserve_trailing_slash),
+    use_port_in_redirects = string_to_bool(ngx.var.use_port_in_redirects),
+  }
+
   ngx.var.pass_access_scheme = ngx.var.scheme
 
   ngx.var.best_http_host = ngx.var.http_host or ngx.var.host

rootfs/etc/nginx/lua/nginx/ngx_rewrite.lua

@@ -0,0 +1,5 @@
+local lua_ingress = require("lua_ingress")
+local balancer = require("balancer")
+
+lua_ingress.rewrite()
+balancer.rewrite()

rootfs/etc/nginx/lua/ngx_conf_init.lua

@@ -1,46 +1,54 @@
-local function initialize_ingress(statusport, enablemetrics, ocsp, ingress)
-    collectgarbage("collect")
-    -- init modules
-    local ok, res
-    ok, res = pcall(require, "lua_ingress")
-    if not ok then
-      error("require failed: " .. tostring(res))
-    else
-      lua_ingress = res
-      lua_ingress.set_config(ingress)
-    end
-
-    ok, res = pcall(require, "configuration")
-    if not ok then
-      error("require failed: " .. tostring(res))
-    else
-      configuration = res
-      configuration.prohibited_localhost_port = statusport
-    end
-
-    ok, res = pcall(require, "balancer")
-    if not ok then
-      error("require failed: " .. tostring(res))
-    else
-      balancer = res
-    end
+local cjson = require("cjson.safe")
 
-    if enablemetrics then
-        ok, res = pcall(require, "monitor")
-        if not ok then
-            error("require failed: " .. tostring(res))
-        else
-            monitor = res
-        end
-    end
+collectgarbage("collect")
+local f = io.open("/etc/nginx/lua/cfg.json", "r")
+local content = f:read("*a")
+f:close()
+local configfile = cjson.decode(content)
 
-    ok, res = pcall(require, "certificate")
+local luaconfig = ngx.shared.luaconfig
+luaconfig:set("enablemetrics", configfile.enable_metrics)
+luaconfig:set("listen_https_ports", configfile.listen_ports.https)
+luaconfig:set("use_forwarded_headers", configfile.use_forwarded_headers)
+-- init modules
+local ok, res
+ok, res = pcall(require, "lua_ingress")
+if not ok then
+  error("require failed: " .. tostring(res))
+else
+  lua_ingress = res
+  lua_ingress.set_config(configfile)
+end
+ok, res = pcall(require, "configuration")
+if not ok then
+  error("require failed: " .. tostring(res))
+else
+  configuration = res
+  if not configfile.listen_ports.status_port then
+    error("required status port not found")
+  end
+  configuration.prohibited_localhost_port = configfile.listen_ports.status_port
+end
+ok, res = pcall(require, "balancer")
+if not ok then
+  error("require failed: " .. tostring(res))
+else
+  balancer = res
+end
+if configfile.enable_metrics then
+    ok, res = pcall(require, "monitor")
     if not ok then
-      error("require failed: " .. tostring(res))
+        error("require failed: " .. tostring(res))
     else
-      certificate = res
-      certificate.is_ocsp_stapling_enabled = ocsp
+        monitor = res
     end
 end
-
-return { initialize_ingress = initialize_ingress }
+ok, res = pcall(require, "certificate")
+if not ok then
+  error("require failed: " .. tostring(res))
+else
+  certificate = res
+  if configfile.enable_ocsp then
+    certificate.is_ocsp_stapling_enabled = configfile.enable_ocsp
+  end
+end

rootfs/etc/nginx/lua/ngx_conf_init_stream.lua

@@ -1,31 +1,30 @@
-local function initialize_stream(statusport)
-  collectgarbage("collect")
-
-  -- init modules
-  local ok, res
-
-  ok, res = pcall(require, "configuration")
-  if not ok then
-    error("require failed: " .. tostring(res))
-  else
-    configuration = res
-  end
-
-  ok, res = pcall(require, "tcp_udp_configuration")
-  if not ok then
-    error("require failed: " .. tostring(res))
-  else
-    tcp_udp_configuration = res
-    tcp_udp_configuration.prohibited_localhost_port = statusport
-
-  end
-
-  ok, res = pcall(require, "tcp_udp_balancer")
-  if not ok then
-    error("require failed: " .. tostring(res))
-  else
-    tcp_udp_balancer = res
+local cjson = require("cjson.safe")
+collectgarbage("collect")
+local f = io.open("/etc/nginx/lua/cfg.json", "r")
+local content = f:read("*a")
+f:close()
+local configfile = cjson.decode(content)
+-- init modules
+local ok, res
+ok, res = pcall(require, "configuration")
+if not ok then
+  error("require failed: " .. tostring(res))
+else
+  configuration = res
+end
+ok, res = pcall(require, "tcp_udp_configuration")
+if not ok then
+  error("require failed: " .. tostring(res))
+else
+  tcp_udp_configuration = res
+  if not configfile.listen_ports.status_port then
+    error("required status port not found")
   end
+  tcp_udp_configuration.prohibited_localhost_port = configfile.listen_ports.status_port
+end
+ok, res = pcall(require, "tcp_udp_balancer")
+if not ok then
+  error("require failed: " .. tostring(res))
+else
+  tcp_udp_balancer = res
 end
-
-return { initialize_stream = initialize_stream }

rootfs/etc/nginx/lua/ngx_conf_init_worker.lua

@@ -1,12 +1,15 @@
-local function initialize_worker(enablemetrics, monitorbatchsize)
-  local lua_ingress = require("lua_ingress")
-  local balancer = require("balancer")
-  local monitor = require("monitor")
-  lua_ingress.init_worker()
-  balancer.init_worker()
-  if enablemetrics then
-    monitor.init_worker(monitorbatchsize)
-  end
-end
+local cjson = require("cjson.safe")
 
-return { initialize_worker = initialize_worker }
+local f = io.open("/etc/nginx/lua/cfg.json", "r")
+local content = f:read("*a")
+f:close()
+local configfile = cjson.decode(content)
+
+local lua_ingress = require("lua_ingress")
+local balancer = require("balancer")
+local monitor = require("monitor")
+lua_ingress.init_worker()
+balancer.init_worker()
+if configfile.enable_metrics and configfile.monitor_batch_max_size then
+  monitor.init_worker(configfile.monitor_batch_max_size)
+end

rootfs/etc/nginx/lua/util.lua

@@ -146,6 +146,11 @@ function _M.is_blank(str)
   return str == nil or string_len(str) == 0
 end
 
+function _M.string_to_bool(str)
+  if str == "true" then return true end
+  return false
+end
+
 -- this implementation is taken from:
 -- https://github.com/luafun/luafun/blob/master/fun.lua#L33
 -- SHA: 04c99f9c393e54a604adde4b25b794f48104e0d0