I'm trying to use this buildpack along with pack from buildpacks.io. When I use the same notation of heroku CLI by passing in the flag --buildpack https://github.com/heroku/heroku-buildpack-nginx.git as described here, it asks for a tar archive.

I then went to the github releases and pasted the latest .tar.gz url as parameter and then it says it couldn't find a buildpack.toml file.

I've read about some trusted buildpacks but wasn't able to understand what should I do in order to get pack trusting it and I am not sure it is related.

I'd appreciate any advice that could be helpful towards getting pack to work.

Thanks a bunch!

I'm trying to configure nginx solo. When I tried using the "Existing App Setup" example, it specified using heroku-community/nginx, but that doesn't contain bin/start-nginx-solo.

Now I'm using the New App example, which specifies
https://github.com/heroku/heroku-buildpack-nginx

and it's working.

Sorry, wrong issue...

Add Brotli and Google pagespeed modules to this buildpack, please.

Hi,
I upgraded my old Cedar-14 to Heroku-18 and now my web app doesn't work any more.

the issue is :
2019-04-08T14:09:05.932714+00:00 app[web.1]: 2019/04/08 14:09:05 [crit] 17#0: *3 connect() to unix:/tmp/nginx.socket failed (2: No such file or directory) while connecting to upstream, client: xx.xx.xx.xx, server: _, request: "GET /index.html HTTP/1.1", upstream: "http://unix:/tmp/nginx.socket:/index.html"

I add the Procfile with -> web: nginx-start-solo

Does anyone could help me ?

Thanks
Eric

Hi. I have a Next.js app which runs on NodeJS. Stumbled upon this package while searching for a way to force HTTPS when user visits HTTP route manually. For example redirect from http://mysite.com/login to https://mysite.com/login if user enters first url.

I made a config folder with a config file just like in «SSL on Heroku» example from this repo and added a buildpack on Heroku in project settings. I also made a tmp folder with app-initialized file, but do not really understand if that is enough and what it does. Here's a screenshot of project's structure https://gyazo.com/d79a69c3254c47b526f5f07d3f69f79e.

Also I changed Procfile to this. yarn start starts nextjs app in prod mode.

web: bin/start-nginx yarn start

App builds without errors and I can see that this buildpack is being used in logs. But upon visiting http route I do not get redirected to the https version of it. Please help.

PS: heroku logs also show a bund of messages between requests and I think they are about this buildpack. Here's a screenshot https://gyazo.com/ed0287773e6888351aa4f049acbf8bb4

Hi,

I am using this build pack with my application in Heroku and was just wondering if there is a way to make it work with ssl ?

As it seems it was not originally compiled with the ssl module
log message I got: ... the "ssl" parameter requires ngx_http_ssl_module in ./config/nginx.conf:30

~ $ nginx -V
nginx version: nginx/1.9.5
built by gcc 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.10)
configure arguments: --with-pcre=pcre-8.37 --with-zlib=zlib-1.2.11 --with-http_gzip_static_module --with-http_realip_module --prefix=/tmp/nginx --add-module=//tmp/nginx.lcuziO0aKW/nginx-1.9.5/headers-more-nginx-module-0.261

I tried to modify the build script and add the module but doesn't seem to work.
--with-http_ssl_module \

Thank you

My app - when deployed to Heroku - is using the heroku-nginx buildpack, and I have the following line in my nginx.conf.erb file

client_max_body_size 10m;

which I have moved around to different sections (http, server, etc...) with no success, i.e. the 10MB limit seems to have no effect. Even placing it in all three http/server/location stanzas of the nginx.conf.erb based on some recommendations in old stackoverflow topics about this nginx configuration parameter.

My app includes an upload route to accept user data for analysis and visualization. The upload is implemented via Dropzone.js with chunking, which works well when tested locally on a development server.

On Heroku with the heroku-nginx buildpack, the upload fails and always throws the following error at approx 2MB in the Heroku app log. (Large file transfers work if I remove the nginx layer.)

2021-04-09T13:41:39.578633+00:00 app[web.1]: 2021/04/09 13:41:39 [error] 23#0: *17 client intended to send too large body: 2000873 bytes, client: 10.7.193.239,
The app then shows the following 500 error in the client browser...

Internal Server Error
The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.

How can one configure the NGINX layer on Heroku to allow such larger files?

It would be useful having the possibility to enable the error_log debug, but currently the executable is compiled without the --with-debug flag and then it cannot be used. See official reference here.
Probably, delivering two executable versions (nginx, nginx-debug) could be useful to maintain performance under high load in case of production usage.

If I have node js server (or any server for that matter) behind nginx, how can I see it's logs?

Hi,

I've been working with a fork of heroku-buildpack-nginx with the goal of having an nginx-based buildpack that can be fully enabled with a heroku buidlpack:add command, without requiring any changes in the application config or code. Such a mode turned out to be possible with the following approach:

No Procfile modification

nginx can be started as a background process from a .profile.d script (https://devcenter.heroku.com/articles/buildpack-api#profile-d-scripts). This removes the need to modify the Procfile to launch the start-nginx script (as with the start-nginx script, some care is needed to properly terminate a dyno when either nginx or the web app terminates).

No need to listen on a Unix domain socket

The .profile.d script can remap the $PORT environment variable to any other TCP port and pass the remapped port to the application. nginx can then listen on the original $PORT and proxy the requests to the remapped local port instead of the Unix domain socket. Heroku runtime guarantees that only $PORT is externally accessible, external traffic to any other port is filtered out by a firewall https://devcenter.heroku.com/articles/dynos#common-runtime-networking.

No need to create /tmp/app-initialized when the backend is ready for traffic

All three supported Heroku stacks include the netcat tool that can be used to wait in a loop for the app to start accepting requests on a local TCP port.

I open this issue for a reference if you ever consider supporting such a mode; please feel free to close it. For reference, here is my .profile.d script that implements this mode (it includes code specific to my buildpack, not intended to be generic).

I'm getting getting the following error with both heroku-16 and heroku-18:

bin/start-nginx: No such file or directory

The BUILDPACK_URL is https://github.com/ddollar/heroku-buildpack-multi.git.

Here is the .buildpacks file:

"https://github.com/heroku/heroku-buildpack-nginx.git"
"https://github.com/heroku/heroku-buildpack-nodejs.git"

Is there something I'm missing?

Hey. I've put nginx.conf.erb into config/ directory of my app, and changed location / section to just return:

location / {
    return 200;
}

After deployment nothing changed, seems like buildpack ignores that file. Can you please suggest what's wrong, or how could I debug this? Build log says nginx-buildpack: Custom config found in app/config.

Procfile:
web: bin/start-nginx nuxt start

Hi there 👋

My company has been using Heroku and NGINX for a long time now. We currently use a custom buildpack that builds NGINX and configures it with the Google PageSpeed module added in.

I wanted to see if there was any interest in offering support for including the Google PageSpeed module in the community buildpack. This would allow my company and others to have easy access to this module with the community version.

I could see this being implemented in one of two ways.

The first way could be to create additional build targets in the Makefile for NGINX with PageSpeed, and then commit the resulting packaged binaries: nginx-with-pagespeed-heroku-16.tgz, etc. Bringing PageSpeed into the Heroku application during the build in that case could involve setting some sort of environment variable NGINX_WITH_PAGESPEED=true to dynamically include it. Of course, the conversation becomes, do we then need to accommodate new binaries for all add-on modules? I'd argue since this is a more popular one, that maybe only PageSpeed would be supported.

The second way could be to just include Google PageSpeed in the factory build of NGINX. I'm not totally sure of the downstream implications of this. I imagine that could result in a larger binary, and possibly a larger Heroku slug, which may not be ideal.

Anyways, I'm curious to hear your thoughts about this! If there is interest, I would love to create a PR for it.

Hey
where can i get Admin Password for Nginx validation?
i checked sample nginx config file.. but in heroku how to config it?

https://subdomain.herokuapp.com is requesting your username and password. The site says: “Admin”

Hi,

Could you update the readme/config with a sample to force SSL? I think it would be useful as Heroku is a bit non-standard in this regard. I believe this is the config:

if ($http_x_forwarded_proto != "https") {
return 301 https://$host$request_uri;
}

Please could someone help with indicating if it is possible to hot reload the configuration with this build pack?

I’m trying to achieve updating the configuration without having to restart the dyno.

Any help would be greatly appreciated!

Hi,

Would it be possible to know what changes I would need to make to deploy this as a standalone proxy app in Heroku, without the touch file step or any web-server.

I would like to let it just listen to the Heroku $PORT env variable and then let my apps and incoming traffic proxy through it.

Would it just be the addition of a Procfile to start it ?

Thank you

Hi,

Would you consider adding the Google Brotli extension for Nginx to the buildpack?

Reference: https://github.com/google/ngx_brotli

Serving brotli compressed files reduce transfer size for HTML, CSS, JS and SVG files better than with GZIP, but not JPG, PNG, WebP, GIFs etc. (binary files). So both (GZIP and Brotli) should be available.

Thank you!
Rico

The README mentions that it is possible to customize nginx's compile options via the https://github.com/heroku/heroku-buildpack-nginx/blob/master/scripts/build_nginx script.

The script says it's designed to be run in a Heroku web dyno and the final binary downloaded for vendoring. However, it is light on details as to how to go about this.

Looking through the script's history, I've found a call to setup a Python web server but this was removed in a51ae63#diff-c1594fe8a33425936bb1b25a1f142c6b. Perhaps a red herring but the loop to keep the bash script running was also removed in e64133f#diff-c1594fe8a33425936bb1b25a1f142c6b.

What I've attempted so far is:

• clone the repository
• make the change I wanted (including --with-http_geoip_module in the ./configure call)
• added back in the python server (creating a requirements.txt file so Heroku would use the Python buildpack)
• create a Profile with web: scripts/build_nginx
• and push to a new Heroku app

I'm able to deploy by my logs.txt (relevant portion duplicated below) say the app crashes.

Googling has also hit a dead end for the moment so I'm hopeful that whatever I'm missing is more obvious to those with more experience than me.

2020-08-22T21:40:45.033008+00:00 app[web.1]: checking for OS
2020-08-22T21:40:45.037078+00:00 app[web.1]: + Linux 4.4.0-1076-aws x86_64
2020-08-22T21:40:46.670273+00:00 app[web.1]: checking for C compiler ... not found
2020-08-22T21:40:46.679991+00:00 app[web.1]: 
2020-08-22T21:40:46.679993+00:00 app[web.1]: ./configure: error: C compiler cc is not found
2020-08-22T21:40:46.679994+00:00 app[web.1]: 
2020-08-22T21:40:46.689548+00:00 app[web.1]: make: *** No rule to make target 'install'.  Stop.
2020-08-22T21:40:46.747961+00:00 app[web.1]: checking for OS
2020-08-22T21:40:46.751417+00:00 app[web.1]: + Linux 4.4.0-1076-aws x86_64
2020-08-22T21:40:46.772664+00:00 app[web.1]: checking for C compiler ... not found
2020-08-22T21:40:46.776255+00:00 app[web.1]: 
2020-08-22T21:40:46.776302+00:00 app[web.1]: ./configure: error: C compiler cc is not found
2020-08-22T21:40:46.776325+00:00 app[web.1]: 
2020-08-22T21:40:46.779272+00:00 app[web.1]: make: *** No rule to make target 'install'.  Stop.
2020-08-22T21:40:46.784637+00:00 app[web.1]: cp: cannot stat '/tmp/nginx/sbin/nginx': No such file or directory
2020-08-22T21:40:46.786734+00:00 app[web.1]: cp: cannot stat '/tmp/nginx-debug/sbin/nginx': No such file or directory
2020-08-22T21:40:46.788976+00:00 app[web.1]: cp: cannot stat '/tmp/nginx/conf/mime.types': No such file or directory
2020-08-22T21:40:46.793573+00:00 app[web.1]: ./
2020-08-22T21:40:46.797268+00:00 app[web.1]: cp: missing destination file operand after '/tmp/nginx-.tgz'
2020-08-22T21:40:46.797275+00:00 app[web.1]: Try 'cp --help' for more information.
2020-08-22T21:40:46.799339+00:00 app[web.1]: cp: missing destination file operand after '/tmp/nginx/sbin/nginx'
2020-08-22T21:40:46.799344+00:00 app[web.1]: Try 'cp --help' for more information.
2020-08-22T21:40:46.836898+00:00 heroku[web.1]: Process exited with status 0
2020-08-22T21:40:46.876657+00:00 heroku[web.1]: State changed from starting to crashed
2020-08-22T21:40:48.515167+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/" host=custom-nginx.herokuapp.com request_id=2ef22723-daf3-4645-96ab-c7cdc4ea47d2 fwd="97.77.198.5" dyno= connect= service= status=503 bytes= protocol=https
2020-08-22T21:40:49.319575+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/favicon.ico" host=custom-nginx.herokuapp.com request_id=9117a2eb-2bc6-4abe-bf9f-792e561313a9 fwd="97.77.198.5" dyno= connect= service= status=503 bytes= protocol=https

With everything else set per the solo config example, the following changes make Nginx log directly to stdout/stderr without intermediate filesystem writes & reads as well as no longer needing the multi-process handing in the start-up script:

error_log /dev/stdout info;

http {
  access_log /dev/stdout l2met;
}

This change would eliminate traffic-induced filesystem IO and eliminate filesystem consumption by logs.

Would these changes be welcome? To avoid breaking existing usages, we could offer them as a another option of start-up process, and example config/nginx.conf.erb.

I have the relevant areas of my nginx.conf.erb file below. I've tested something like this locally on my machine with nginx so I believe I'm using the directives properly. However when I add a CIDR group that contains my IP address and put this on my Heroku dyno I can still get through to my site.

Any ideas why this isn't being picked up properly or something I'm missing? Does this feature not work on Heroku?

http {
  geo $test_group {
    default 0;
    1.2.3.4/22 1; # this includes my local IP address
  }
  server {
    location / {
      if ($test_group) {
        return 418 "short AND stout";
      }
    }
  }
}

Any plan to add LUA support?

I find myself needing more capable regex engine for my proxy rules, and the old PCRE doesn't cut it.

Whilst attempting to configure this buildpack with the --with-http_auth_request_module build flag I noticed it currently fails to build due to ftp.pcre.org no longer being available.

I have worked around the issue by moving over to Sourceforge and am happy to submit a PR if one would be accepted?

Any chance we can get a push in the right direction for using this in front of node?

I couldn't find any information about implementing http 2 with this buildpack and I have tried to change my custom config files as per the normal Nginx documentation to no avail (my app just crashes).

Any guides or pointers ?

Is it possible to test the nginx config for errors with nginx -t before deploying? I've deployed a few bad builds of a proxy server (still in development, thankfully, so it didn't impact any production services) due to a bad config.

After upgrading Heroku stack from 20 to 22, the nginx buildpack cannot compile nginx.conf.erb. It cannot find the erb executable.

The reason is that I use heroku-buildpack-subdir so that my runtime directory of nginx buildpack is /app/nginx. But this buildpack's compile script adds /app/.heroku-buildpack-nginx/ruby/bin to PATH, assuming that buildpack always lives in /app.

So heroku-buildpack-nginx doesn't work on Heroku stack 22 if you change the buildpack runtime directory from /app.

Now the solution could be to calculate the buildpack runtime directory from BUILD_DIR.

Procfile
web: bin/nginx -p . -c config/nginx.conf & bundle exec puma -C config/puma.rb
worker: bundle exec sidekiqswarm -C config/sidekiq.yml

This buildpack currently doesn't validate whether it supports the current $STACK.

This means if someone pins to an old SHA of the buildpack or forks the buildpack, then later a new stack is introduced, they get an error like cp: cannot stat 'bin/nginx-heroku-18': No such file or directory (in the case of older releases), or more recently they'd get a tar error.

Example support ticket:
https://heroku.support/985441

Whilst nothing can be done about older releases now, it would be good to add an explicit stack check to make this failure mode more obvious in the future :-)

Is there a way to specify different config files for staging and production? Like for example I would like to have a basic auth in front of staging, but not in front of production.

Quoting the README:

To test the builds locally:

$ make shell
$ cp bin/nginx-$STACK bin/nginx
$ FORCE=1 bin/start-nginx

make shell
Opening heroku-18 shell...
Unable to find image 'heroku/heroku:18-build' locally
18-build: Pulling from heroku/heroku
171857c49d0f: Pull complete
419640447d26: Pull complete
61e52f862619: Pull complete
c97d646ce0ef: Pull complete
3776f40e285d: Pull complete
44ddde86f2fc: Pull complete
797d95067ecf: Pull complete
Digest: sha256:d3e1d46e2d255b41bec49cd88d9a6c07f7b46daf84298a29cf3333327e1e2ab1
Status: Downloaded newer image for heroku/heroku:18-build

root@3df6d35d05c1:/buildpack# echo $STACK
heroku-18

root@3df6d35d05c1:/buildpack# cp bin/nginx-$STACK bin/nginx
cp: cannot stat 'bin/nginx-heroku-18': No such file or directory

root@3df6d35d05c1:/buildpack# ls bin/
compile  detect  release  start-nginx  start-nginx-debug  start-nginx-solo

root@3df6d35d05c1:/buildpack# ls
Makefile  bin  changelog.md  config  nginx-cedar-14.tgz  nginx-heroku-16.tgz  nginx-heroku-18.tgz  nginx-heroku-20.tgz  readme.md  scripts

Perhaps someone with better knowledge of this buildpack might want to fix it.
HTH

We've been using this buildpack for a while now, and would like to transition from the Heroku-20 stack to the new Heroku-22 stack.

As per the heroku-22 stack documentation/release notes, Ruby is no longer included on the system level.

The Nginx buildpack uses erb to parse the Nginx configuration file, so it needs at least some parts of Ruby:

At first I thought we could use the heroku/ruby buildpack to make up for the now-missing erb binary. However, according to the documentation, since our app doesn't actually use Ruby we also don't have a Gemfile, and the build fails because of the failed check from the Ruby buildpack.

Adding empty Gemfile & Gemfile.lock files in our repo seems like quite a hack to include Ruby buildpack, only to be able to use the Nginx buildpack. It also feels quite odd to add such a large dependency ourselves, increasing slug size as well and forcing us to also update the ruby version whenever it reaches its own EOL. For reference, our slug size when using nginx-buildpack only is 191.4M. When adding the ruby buildpack, we're at 213.9M.

Now I know our current heroku-20 stack is nowhere near its end of life (scheduled April 2025), but I'd still like to be able to do a clean update to heroku-22 when able.

Could we somehow include erb in the nginx buildpack to avoid having to installing another buildpack just for the configuration parsing? Would it make sense to create a buildpack that would only include erb to use along nginx-buildpack, if that's even doable? Is the Ruby buildpack the "correct" approach here, even for non-ruby apps, with an empty Gemfile to please the validator?

Here's an excerpt from the app logs when starting on heroku-22 with only the Nginx buildpack.

2022-06-20T08:18:47.166786+00:00 heroku[web.1]: Starting process with command `bin/start-nginx yarn start`
2022-06-20T08:18:48.098961+00:00 app[web.1]: bin/start-nginx: line 8: erb: command not found
2022-06-20T08:18:48.108720+00:00 app[web.1]: buildpack=nginx at=logs-initialized
2022-06-20T08:18:48.109129+00:00 app[web.1]: buildpack=nginx at=app-initialization
2022-06-20T08:18:48.109435+00:00 app[web.1]: buildpack=nginx at=start-app cmd=yarn start
2022-06-20T08:18:50.117432+00:00 app[web.1]: buildpack=nginx at=app-initialized
2022-06-20T08:18:50.117779+00:00 app[web.1]: buildpack=nginx at=nginx-start
2022-06-20T08:18:50.206450+00:00 app[web.1]: nginx: [emerg] no "events" section in configuration
2022-06-20T08:18:50.208053+00:00 app[web.1]: buildpack=nginx at=exit process=nginx
2022-06-20T08:18:50.372744+00:00 heroku[web.1]: State changed from starting to crashed

For people needing to get nginx buildpack work on heroku-22 asap, you can use the following Gemfile and Gemfile.lock along with the Ruby buildpack:

Gemfile:

source "https://rubygems.org"
ruby "3.1.2"

Gemfile.lock:

GEM
  remote: https://rubygems.org/
  specs:

PLATFORMS
  ruby

DEPENDENCIES

RUBY VERSION
   ruby 3.1.2p20

BUNDLED WITH
   1.17.3

This buildpack currently has no CI testing at all.

Ideally issues like #101 would be caught prior to production.

The Heroku-16 stack reached end-of-life on May 1st, 2021, and in a few days (June 1st, 2021) the Heroku-16 build system will be decommissioned, meaning no further builds will be possible:
https://help.heroku.com/0S5P41DC/heroku-16-end-of-life-faq

As such, support for Heroku-16 can shortly be dropped:
https://github.com/heroku/heroku-buildpack-nginx/search?q=16

I'm using nginx-solo-sample.conf.erb with gzip_types application/json application/javascript text/css; added under gzip on;

$ curl -H "Accept-Encoding: gzip" -I https://mysterious-bayou-61009.herokuapp.com/hello.js
HTTP/1.1 200 OK
Connection: keep-alive
Server: nginx
Date: Sun, 27 Jun 2021 18:24:43 GMT
Content-Type: application/javascript
Content-Length: 3145731
Last-Modified: Sun, 27 Jun 2021 18:19:59 GMT
Etag: "60d8c14f-300003"
Accept-Ranges: bytes
Via: 1.1 vegur

Hello 👋, I'm having a little trouble making sure that my server restarts gracefully. I have my script waiting for SIGTERM but it doesn't seem like they get called, is there a way I can watch for them and pass them to my (node) app? 😄

Hello, I'm trying to setup the nginx so it works in solo mode and just redirects the requests to proper app. This is my config:

daemon off;
# Heroku dynos have at least 4 cores.
worker_processes <%= ENV['NGINX_WORKERS'] || 4 %>;

events {
  use epoll;
  accept_mutex on;
  worker_connections <%= ENV['NGINX_WORKER_CONNECTIONS'] || 1024 %>;
}

http {
  gzip on;
  gzip_comp_level 2;
  gzip_min_length 512;

  server_tokens off;

  # log_format l2met 'measure#nginx.service=$request_time request_id=$http_x_request_id';
  # access_log <%= ENV['NGINX_ACCESS_LOG_PATH'] || 'logs/nginx/access.log' %> l2met;
  # error_log <%= ENV['NGINX_ERROR_LOG_PATH'] || 'logs/nginx/error.log' %>;

  include mime.types;
  default_type application/octet-stream;
  sendfile on;

  # Must read the body in 5 seconds.
  client_body_timeout <%= ENV['NGINX_CLIENT_BODY_TIMEOUT'] || 5 %>;

  server {
    listen 80;

    location / {
      proxy_pass "main app url";
      proxy_redirect     off;

      proxy_set_header   Host             $host;
      proxy_set_header   X-Real-IP        $remote_addr;
      proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;

      proxy_connect_timeout      90;
      proxy_send_timeout         90;
      proxy_read_timeout         90;

      proxy_buffer_size          4k;
      proxy_buffers              4 32k;
      proxy_busy_buffers_size    64k;
      proxy_temp_file_write_size 64k;
    }

    location /test {
      proxy_pass "test_app_url";
      proxy_redirect     off;

      proxy_set_header   Host             $host;
      proxy_set_header   X-Real-IP        $remote_addr;
      proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;

      client_max_body_size       10m;
      client_body_buffer_size    128k;

      proxy_connect_timeout      90;
      proxy_send_timeout         90;
      proxy_read_timeout         90;

      proxy_buffer_size          4k;
      proxy_buffers              4 32k;
      proxy_busy_buffers_size    64k;
      proxy_temp_file_write_size 64k;

    }

    keepalive_timeout 5;
    client_max_body_size <%= ENV['NGINX_CLIENT_MAX_BODY_SIZE'] || 1 %>M;
  }
}

But when nginx starts I got an error:

nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied)

Any ideas what can be a problem here?

Hello,

Nginx published security advisory: "1-byte memory overwrite in resolver" [1]. This vulnerability affects Nginx versions 0.6.18-1.20.0. The latest version of Nginx in this build pack is 1.20.0. Does the version included in the build pack covers the vulnerability, and if not, would it be possible to update it to version 1.20.1?

Thank you!

[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23017
[2] #80

TLDR: If I created a PR that made the --with-http_stub_status_module module possible to include via an ENV var (e.g. NGINX_WITH_X, would you accept this?

Background:

We want to log the active number of worker connections in nginx in order to proactively keep on top of potential worker resource starvation. The --with-http_stub_status_module module makes the $number_connections variable available.

The suggested solution of going with a fork is not worth the risk of potentially missing critical upstream changes to the buildpack.

Obviously even better would be if this small module were included by default in the BuildPack (it's default in certain installations, e.g. via Homebrew on macos). But I understand if you would prefer not to add default modules.

The recommended way to use this buildpack is via the heroku-community/nginx buildpack-registry stable alias, rather than GitHub URL.

However it isn't mentioned in the README (either how to use, or instructions for maintainers for how to publish to it).

greetings, I would appreciate if you add instructions to configure this buildpack and deploy a Vue application since heroku (in Stack heroku-22), asks to use this buildpack with a configuration that are not clear to understand or are not easy.

I am trying to use nginx to whitelist the IPs allowing to access to my heroku app.

by https://serverfault.com/a/844504/506273, for test purpose, I setup the below config for file config/nginx.conf.erb

server {
		listen <%= ENV["PORT"] %>;
		server_name _;
		keepalive_timeout 5;

                deny all;
  
    location / {
                       deny all;

			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header Host $http_host;
			proxy_redirect off;
			proxy_pass http://app_server;
		}
	}

It does not work at all(for rejecting access to my heroku app from all ips).

Any suggestion? Is it due to my issue or something else?

BTW, heroku-buildpack-nginx seems good. My rails frontend is driven by Nginx, except it cannot whitelist the ips.