Skip to main content

NGINX

LeakNGX is a native NGINX plugin to integrate LeakSignal.

Module Files​

All module files are available via https://leakproxy.s3.us-west-2.amazonaws.com/leakngx-$LEAKSIGNAL_VERSION-$NGINX_VERSION/libleakngx.so

Where $LEAKSIGNAL_VERSION is the version of LeakSignal (i.e. 0.11.2), and $NGINX_VERSION is a version between NGINX 1.21.6 and 1.25.2. Note that a special version is available for NGINX 1.21.6 supporting MUSL (for alpine linux used in ingress-nginx), with a version of $LEAKSIGNAL-VERSION-1.21.6-musl.

Configuring NGINX​

To load LeakNGX into NGINX, you'll want to add the following directive to your nginx.conf main configuration:

load_module modules/libleakngx.so;

Given that libleakngx.so is present at <NGINX PREFIX>/modules/libleakngx.so

Inside of your http configuration block, you can add in the LeakSignal configuration:

# takes form of API_KEY and Ingestion endpoint. Defaults to `https://ingestion.app.leaksignal.com`
leakngx $API_KEY https://ingestion.app.leaksignal.com;

Installing into NGINX Ingress Controller​

LeakSignal publishes alternative container images for NGINX Ingress Controller at leaksignal/ingress-nginx

Tags are of the form: $INGRESS_VERSION-$LEAKSIGNAL_VERSION, i.e. v1.8.1-0.11.2. Supported versions are 1.6.4 through 1.8.1.

Example helm configuration:

controller:
  image:
    registry: docker.io
    image: leaksignal/ingress-nginx
    tag: "v1.8.1-0.11.2"
    digest: null
  config:
    main-snippet:
        load_module modules/libleakngx.so;
    http-snippet:
        leakngx $API_KEY https://ingestion.app.leaksignal.com;

Getting Service Names from NGINX​

In your LeakSignal Policy, include the following snippet:

local_service_name:
  ns:
    attrs:
      ngx_namespace
  sa:
    attrs:
      ngx_service_name

This will extract the namespace and service name of upstreams as the service name for traffic from NGINX.