pmm.conf

  upstream managed-grpc {
    server 127.0.0.1:7771;
    keepalive 32;
  }
  upstream managed-json {
    server 127.0.0.1:7772;
    keepalive 32;
    keepalive_requests 100;
    keepalive_timeout 75s;
  }

  upstream qan-api-grpc {
    server 127.0.0.1:9911;
    keepalive 32;
  }
  upstream qan-api-json {
    server 127.0.0.1:9922;
    keepalive 32;
    keepalive_requests 100;
    keepalive_timeout 75s;
  }

  upstream vmproxy {
    server localhost:8430;
    keepalive 32;
    keepalive_requests 100;
    keepalive_timeout 75s;
  }

  server {
    listen 8080;
    listen 8443 ssl http2;
    server_name _;
    server_tokens off;

    # allow huge requests
    large_client_header_buffers 128 64k;

    client_max_body_size 10m;

    ssl_certificate /srv/nginx/certificate.crt;
    ssl_certificate_key /srv/nginx/certificate.key;
    ssl_trusted_certificate /srv/nginx/ca-certs.pem;
    ssl_dhparam /srv/nginx/dhparam.pem;

    # this block checks for maintenance.html file and, if it exists, it redirects all requests to the maintenance page
    # there are two exceptions for it /v1/updates/Status and /auth_request endpoints
    set $maintenance_mode 0;

    if (-f /usr/share/pmm-server/maintenance/maintenance.html) {
        set $maintenance_mode 1;
    }

    if ($request_uri ~* "^/v1/updates/Status|^/auth_request") {
        set $maintenance_mode 0;
    }

    if ($maintenance_mode = 1) {
        return 503;
    }

    error_page 503 @maintenance;

    location @maintenance {
        auth_request off;
        root /usr/share/pmm-server/maintenance;
        rewrite ^(.*)$ /maintenance.html break;
    }


    # Enable passing of the remote user's IP address to all
    # proxied services using the X-Forwarded-For header
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # Enable auth_request for all locations, including root
    # (but excluding /auth_request and /setup below).
    auth_request /auth_request;

    # Store the value of X-Must-Setup header of auth_request subrequest response in the variable.
    # It is used below in /auth_request.
    auth_request_set $auth_request_must_setup $upstream_http_x_must_setup;

    # Store the value of X-Proxy-Filter header of auth_request subrequest response in the variable.
    auth_request_set $auth_request_proxy_filter $upstream_http_x_proxy_filter;
    proxy_set_header X-Proxy-Filter $auth_request_proxy_filter;  

    # nginx completely ignores auth_request subrequest response body.
    # We use that directive to send the same request to the same location as a normal request
    # to get a response body or redirect and return it to the client.
    # auth_request supports only 401 and 403 statuses; 401 is reserved for this configration,
    # and 403 is used for normal pmm-managed API errors.
    error_page 401 = /auth_request;

    # Internal location for authentication via pmm-managed/Grafana.
    # First, nginx sends request there to authenticate it. If it is not authenticated by pmm-managed/Grafana,
    # it is sent to this location for the second time (as a normal request) by error_page directive above.
    location /auth_request {
      internal;

      auth_request off;

      proxy_pass http://managed-json/auth_request;

      # nginx always strips body from authentication subrequests.
      # Overwrite Content-Length to avoid problems on Go side and to keep connection alive.
      proxy_pass_request_body off;
      proxy_set_header Content-Length 0;

      proxy_http_version 1.1;
      proxy_set_header Connection "";

      # This header is set only for to the second request, not for the first subrequest.
      # That variable is set above.
      proxy_set_header X-Must-Setup $auth_request_must_setup;

      # Those headers are set for both subrequest and normal request.
      proxy_set_header X-Original-Uri $request_uri;
      proxy_set_header X-Original-Method $request_method;
    }

    # AWS setup wizard
    location /setup {
      auth_request off;

      alias /usr/share/percona-dashboards/setup-page;
      try_files $uri /index.html break;
    }

    # PMM UI
    location /pmm-ui {
      # Will redirect on FE to login page if user is not authenticated
      auth_request off;

      alias /usr/share/pmm-ui;
      try_files $uri /index.html break;
    }

    # Grafana
    rewrite ^/$ $scheme://$http_host/graph/;
    rewrite ^/graph$ /graph/;
    location /graph {
      proxy_cookie_path / "/;";
      proxy_pass http://127.0.0.1:3000;
      rewrite ^/graph/(.*) /$1 break;
      proxy_read_timeout 600;
      proxy_http_version 1.1;
      proxy_set_header Connection $connection_upgrade;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Host $http_host;
      proxy_set_header X-Proxy-Filter $auth_request_proxy_filter;
    }

    # Prometheus
    location /prometheus {
      proxy_pass http://127.0.0.1:9090;
      proxy_read_timeout 600;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
    }
    location /prometheus/api/v1 {
      proxy_pass http://vmproxy;
      proxy_read_timeout 600;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
    }
    
    # VictoriaMetrics
    location /victoriametrics/ {
      proxy_pass http://127.0.0.1:9090/prometheus/;
      proxy_read_timeout 600;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      client_body_buffer_size 10m;
    }

    # VMAlert
    location /prometheus/rules {
      proxy_pass http://127.0.0.1:8880/api/v1/rules;
      proxy_read_timeout 600;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
    }
    location /prometheus/alerts {
      proxy_pass http://127.0.0.1:8880/api/v1/alerts;
      proxy_read_timeout 600;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
    }

    # Swagger UI
    rewrite ^/swagger/swagger.json$ $scheme://$http_host/swagger.json permanent;
    rewrite ^(/swagger)/(.*)$ $scheme://$http_host/swagger permanent;
    location /swagger {
      auth_request off;
      root /usr/share/pmm-managed/swagger;
      try_files $uri /index.html break;
    }

    # pmm-managed gRPC APIs
    location /agent. {
      grpc_pass grpc://managed-grpc;
      # Disable request body size check for gRPC streaming, see https://trac.nginx.org/nginx/ticket/1642.
      # pmm-managed uses grpc.MaxRecvMsgSize for that.
      client_max_body_size 0;
    }
    location /inventory. {
      grpc_pass grpc://managed-grpc;
    }
    location /management. {
      grpc_pass grpc://managed-grpc;
    }
    location /server. {
      grpc_pass grpc://managed-grpc;
    }

    # pmm-managed JSON APIs
    location /v1/ {
      proxy_pass http://managed-json/v1/;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
    }

    # qan-api gRPC APIs should not be exposed

    # qan-api JSON APIs
    location /v1/qan {
      proxy_pass http://qan-api-json/v1/qan;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
    }

    # compatibility with PMM 1.x
    rewrite ^/ping$ /v1/server/readyz;
    # compatibility with PMM 2.x
    rewrite ^/v1/readyz$ /v1/server/readyz;
    rewrite ^/v1/version$ /v1/server/version;
    rewrite ^/logs.zip$ /v1/server/logs.zip;

    # logs.zip in both PMM 1.x and 2.x variants
    location /v1/server/logz.zip {
      proxy_pass http://managed-json;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
    }

    # pmm-dump artifacts
    location /dump {
      alias /srv/dump/;
    }

    # This localtion stores static content for general pmm-server purposes.
    # Ex.: local-rss.xml - contains Percona's news when no internet connection.
    location /pmm-static {
      auth_request off;
      alias /usr/share/pmm-server/static;
    }

    # proxy requests to the Percona's blog feed
    # fallback to local rss if pmm-server is isolated from internet.
    # https://jira.percona.com/browse/PMM-6153
    location = /percona-blog/feed {
      auth_request off;
      proxy_ssl_server_name on;

      set $feed https://www.percona.com/blog/feed/;
      proxy_pass $feed;
      proxy_set_header User-Agent "$http_user_agent pmm-server/3.x";
      error_page 500 502 503 504 /pmm-static/local-rss.xml;
    }
  }