---
# Webserver Configuration
# Effective CPUs (float) across proxy and the current app
WEBSERVER_CPUS_EFFECTIVE: >-
{{
[
(lookup('applications') | resource_filter('svc-prx-openresty', 'cpus', service_name | default(''), RESOURCE_CPUS)) | float,
(lookup('applications') | resource_filter(application_id, 'cpus', service_name | default(''), RESOURCE_CPUS)) | float
] | min
}}
WEBSERVER_WORKER_PROCESSES: >-
{{
1 if (WEBSERVER_CPUS_EFFECTIVE | float) < 1
else (WEBSERVER_CPUS_EFFECTIVE | float | int)
}}
# worker_connections from pids_limit (use the smaller one), with correct key/defaults
WEBSERVER_WORKER_CONNECTIONS: >-
{{
[
(lookup('applications') | resource_filter('svc-prx-openresty', 'pids_limit', service_name | default(''), RESOURCE_PIDS_LIMIT)) | int,
(lookup('applications') | resource_filter(application_id, 'pids_limit', service_name | default(''), RESOURCE_PIDS_LIMIT)) | int
] | min
}}
# Not WEBSERVER_WORKER_*: their application_id is whichever role loaded the shared proxy first, whose limits then cap every vhost.
WEBSERVER_PROXY_WORKER_PROCESSES: >-
{{
[
(lookup('applications') | resource_filter('svc-prx-openresty', 'cpus', '', RESOURCE_CPUS)) | float | int,
1
] | max
}}
WEBSERVER_PROXY_WORKER_CONNECTIONS: "{{ lookup('config', 'svc-prx-openresty', 'services.openresty.worker_connections') | int }}"
WEBSERVER_PROXY_WORKER_RLIMIT_NOFILE: "{{ (WEBSERVER_PROXY_WORKER_CONNECTIONS | int) * 2 }}"
# Response security headers of every vhost; an app overrides any key under `security_headers` in its meta/server.yml.
WEBSERVER_SECURITY_HEADERS:
nosniff: false # X-Content-Type-Options: nosniff
referrer_policy: "" # Referrer-Policy, sent only when the upstream sends none; "" sends none
permissions_policy: "" # Permissions-Policy on HTML documents; "" sends none
hsts:
max_age: 31536000 # Strict-Transport-Security max-age in seconds
include_subdomains: false # adds includeSubDomains, which covers every subdomain of the vhost
preload: false # adds preload; requires include_subdomains and a max_age of one year
