Home / server / Questions / 679923
Accepted
xref
Asked: 2015-04-02 12:17:13 +0800 CST

Put nginx in maintenance mode for certain IPs

  • 772

Because of the way if statements work in nginx (no nesting, no multiple conditions) I can't figure out a way to combine these two features:

  • Using the nginx Geo module I have a list of allowed ips
  • On my filesystem if I touch appname in a certain dir the application automatically goes into 503 maintenance mode.

This is what I would like to do, but it's not allowed in nginx:

location / {
    if (-f /var/www/maintmode/appname && $allowed_ip = no) {
        return 503;
    }   
    try_files $uri;
}

If the above was possible in nginx, anyone on the allowed_ip list from the Geo module would bypass the 503 and get to use the site as normal. Then when verified the application is working rm appname from the maint dir and 503 maintenance mode ends.

The benefit of this method would be touching a single file enables/disables maint mode without ever having to modify a conf and reloading nginx.

Any ideas on how I can get something like this to work?

nginx

2 Answers

  1. If you already are using geo you should have something like this:

    geo $client {
    default not_allowed;
    10.0.0.0/8 allowed;
}

    So instead of using /var/www/maintmode/appname you could use:

    location / {
    if (-f /var/www/maintmode/$client) {
        return 503;
    }
    try_files $uri $uri/;
}

    If file /var/www/maintmode/not_allowed exists the page goes into maintenance mode except for the ip addresses in the allowed list.

    • 2
  2. Best Answer

    So thanks to the tip from HD here is how I went about solving this one:

    Took advantage of this fact form the Geo docs: When default is not specified, the default value will be an empty string.

    geo $allowed_client {
    10.0.0.0/8 allowed;
}

server {
    ...
    set $appname app1;
    location / {
        $maintmode "${appname}${allowed_client}"
        if (-f /var/www/maintmode/$maintmode) {
            return 503;
        }
        try_files $uri $uri/;
    }
}

    so I can still touch app1 in the maint dir to shut down a specific app, because if we have a valid IP $maintmode = app1allowed, which will skip past the 503. All other IPs will have $maintmode = app1 which will fall into the 503. Thanks HD!

    • 0