[feature] Configured nginx to serve precompressed files (gzip/brotli) #599

defaults/main.yml

@@ -163,6 +163,9 @@ openwisp2_nginx_ssl_config:
     - "font/opentype"
 openwisp2_nginx_access_log: "{{ openwisp2_path }}/log/nginx.access.log"
 openwisp2_nginx_error_log: "{{ openwisp2_path }}/log/nginx.error.log error"
+
+openwisp2_nginx_gzip_static: auto
+openwisp2_nginx_brotli_static: auto
 # internationalization
 openwisp2_internationalization: false
 openwisp2_users_auth_api: true

docs/user/role-variables.rst

@@ -167,6 +167,19 @@ take a look at `the default values of these variables
                 - "application/xml"
                 - "application/x-font-ttf"
                 - "font/opentype"
+        # Precompressed gzip files serving control
+        # - 'auto' (default): automatically enabled when nginx gzip_static module is detected
+        # - true: require nginx gzip_static module and fail if it is unavailable
+        # - false: explicitly disable even when module is available
+        openwisp2_nginx_gzip_static: auto
+        # Precompressed brotli files serving control
+        # - 'auto' (default): automatically enabled when nginx ngx_brotli module is detected
+        # - true: require nginx ngx_brotli module and fail if it is unavailable
+        # - false: explicitly disable even when module is available
+        # Note: brotli is not shipped with stock nginx. The role installs
+        # libnginx-mod-http-brotli-static when available. Debian 11 and
+        # Ubuntu 22.04 do not provide this package.
+        openwisp2_nginx_brotli_static: auto
         # nginx error log configuration
         openwisp2_nginx_access_log: "{{ openwisp2_path }}/log/nginx.access.log"
         openwisp2_nginx_error_log: "{{ openwisp2_path }}/log/nginx.error.log error"

molecule/resources/converge.yml

@@ -12,6 +12,9 @@
     openwisp2_uwsgi_extra_conf: |
       single-interpreter=True
     openwisp2_usage_metric_collection: false
+    # Test nginx static compression modules
+    openwisp2_nginx_gzip_static: auto
+    openwisp2_nginx_brotli_static: auto
     openwisp2_extra_django_settings:
       ACCOUNT_RATE_LIMITS: false
     freeradius_eap_orgs:
@@ -24,18 +27,18 @@
 
   pre_tasks:
     - name: Update apt cache
       apt:
         update_cache: true
         cache_valid_time: 600
       when: ansible_os_family == 'Debian'
 
     - name: Install net-tools
       apt:
         name:
           - net-tools
 
     - name: Remove the .dockerenv file
       file:
         path: /.dockerenv
         state: absent
 

molecule/resources/verify.yml

@@ -7,7 +7,7 @@
 
   tasks:
     - name: Run a specific subset of tests
       command: >
         /opt/openwisp2/env/bin/python /opt/openwisp2/manage.py test --keepdb --exclude skip_prod \
             openwisp_controller.pki.tests.test_admin \
             openwisp_controller.pki.tests.test_models \
@@ -38,22 +38,22 @@
       changed_when: false
 
     - name: Check if redis-server is running
       command: systemctl status redis-server
       changed_when: false
 
     - name: Chcke if redis is running
       command: systemctl status redis
       changed_when: false
 
     - name: Check Openwisp
       block:
         - name: Check if OpenWISP is running
           uri:
             url: "https://{{ inventory_hostname }}/admin/login/?next=/admin/"
             validate_certs: false
       rescue:
         - name: Get OpenWisp log
           command: "tail -n 500 {{ openwisp2_path }}/log/*.log"
           register: openwisp_log
 
         - name: Show OpenWisp log
@@ -65,3 +65,73 @@
       register: freeradius_eap_ports  # Register the output and return code
       failed_when: freeradius_eap_ports.rc | int != 0
       changed_when: false
+
+    - name: Test nginx compression configuration
+      block:
+        - name: Get nginx build configuration
+          ansible.builtin.command: nginx -V
+          register: nginx_build_config
+          changed_when: false
+
+        - name: Get nginx loaded configuration
+          ansible.builtin.command: nginx -T
+          register: nginx_loaded_config
+          changed_when: false
+
+        - name: Set nginx static compression module availability facts
+          ansible.builtin.set_fact:
+            nginx_gzip_static_module_available: >-
+              {{ 'http_gzip_static_module' in (nginx_build_config.stderr | default('')) }}
+            nginx_brotli_static_module_available: >-
+              {{ 'brotli_static_module' in (
+                   (nginx_build_config.stderr | default('')) ~
+                   (nginx_loaded_config.stdout | default('')) ~
+                   (nginx_loaded_config.stderr | default(''))
+                 ) }}
+
+        - name: Read nginx site configuration
+          ansible.builtin.slurp:
+            src: "/etc/nginx/sites-enabled/{{ inventory_hostname }}"
+          register: nginx_site_config
+
+        - name: Assert nginx static compression directives match module availability
+          ansible.builtin.assert:
+            that:
+              - >-
+                ('gzip_static on;' in (nginx_site_config.content | b64decode)) ==
+                nginx_gzip_static_module_available
+              - >-
+                ('brotli_static on;' in (nginx_site_config.content | b64decode)) ==
+                nginx_brotli_static_module_available
+            fail_msg: "Nginx static compression directives do not match available modules."
+
+        - name: Test nginx configuration syntax
+          ansible.builtin.command: nginx -t
+          changed_when: false
+
+        - name: Load role defaults for nginx static compression disabled test
+          ansible.builtin.include_vars:
+            file: "{{ playbook_dir }}/../../defaults/main.yml"
+
+        - name: Set nginx static compression facts with variables disabled
+          ansible.builtin.set_fact:
+            nginx_gzip_static_available: false
+            nginx_brotli_static_available: false
+
+        - name: Render nginx site configuration with static compression disabled
+          ansible.builtin.template:
+            src: "{{ playbook_dir }}/../../templates/nginx/site-conf.j2"
+            dest: /tmp/openwisp2-nginx-static-compression-disabled.conf
+            mode: "0644"
+
+        - name: Read nginx site configuration with static compression disabled
+          ansible.builtin.slurp:
+            src: /tmp/openwisp2-nginx-static-compression-disabled.conf
+          register: nginx_disabled_site_config
+
+        - name: Assert nginx static compression directives are disabled
+          ansible.builtin.assert:
+            that:
+              - "'gzip_static on;' not in (nginx_disabled_site_config.content | b64decode)"
+              - "'brotli_static on;' not in (nginx_disabled_site_config.content | b64decode)"
+            fail_msg: "Nginx static compression directives should be disabled."

tasks/apt.yml

@@ -39,6 +39,16 @@
     name: nginx
   when: openwisp2_nginx_install
 
+- name: Install nginx brotli static module
+  ansible.builtin.apt:
+    name: libnginx-mod-http-brotli-static
+  when:
+    - openwisp2_nginx_install
+    - (openwisp2_nginx_brotli_static | string | lower) in ['true', 'auto']
+    # brotli static package not available on old distros
+    - not (ansible_distribution == 'Debian' and ansible_distribution_major_version == '11')
+    - not (ansible_distribution == 'Ubuntu' and ansible_distribution_version == '22.04')
+
 - name: Install redis
   ansible.builtin.apt:
     name: redis-server

tasks/nginx.yml

@@ -5,6 +5,49 @@
     openwisp2_nginx_client_max_body_size: "{{ openwisp2_firmware_upgrader_max_file_size }}"
   when: openwisp2_firmware_upgrader
 
+- name: Configure nginx static compression
+  block:
+    - name: Get nginx build configuration
+      ansible.builtin.command: nginx -V
+      register: nginx_build_config
+      changed_when: false
+
+    - name: Get nginx loaded configuration
+      ansible.builtin.command: nginx -T
+      register: nginx_loaded_config
+      changed_when: false
+
+    - name: Set nginx static compression facts
+      ansible.builtin.set_fact:
+        nginx_gzip_static_module_available: >-
+          {{ 'http_gzip_static_module' in (nginx_build_config.stderr | default('')) }}
+        nginx_brotli_static_module_available: >-
+          {{ 'brotli_static_module' in (
+            (nginx_build_config.stderr | default('')) ~
+            (nginx_loaded_config.stdout | default('')) ~
+            (nginx_loaded_config.stderr | default(''))
+          ) }}
+
+    - name: Validate nginx static compression settings
+      ansible.builtin.assert:
+        that:
+          - >-
+            (openwisp2_nginx_gzip_static | string | lower) != 'true' or
+            nginx_gzip_static_module_available
+          - >-
+            (openwisp2_nginx_brotli_static | string | lower) != 'true' or
+            nginx_brotli_static_module_available
+        fail_msg: "A required nginx static compression module is not available."
+
+    - name: Set enabled nginx static compression facts
+      ansible.builtin.set_fact:
+        nginx_gzip_static_available: >-
+          {{ nginx_gzip_static_module_available and
+             (openwisp2_nginx_gzip_static | string | lower) in ['true', 'auto'] }}
+        nginx_brotli_static_available: >-
+          {{ nginx_brotli_static_module_available and
+             (openwisp2_nginx_brotli_static | string | lower) in ['true', 'auto'] }}
+
 - name: Create public_html directory
   ansible.builtin.file:
     path: "{{ openwisp2_path }}/public_html"

templates/nginx/site-conf.j2

@@ -80,6 +80,12 @@ server {
 
     location /static/ {
         alias {{ openwisp2_path }}/static/;
+        {% if nginx_gzip_static_available | default(false) %}
+        gzip_static on;
+        {% endif %}
+        {% if nginx_brotli_static_available | default(false) %}
+        brotli_static on;
+        {% endif %}
     }
 
     location /media/ {

templates/openwisp2/settings.py

@@ -531,9 +531,6 @@
         "BACKEND": "openwisp_utils.storage.CompressStaticFilesStorage",
     },
 }
-# GZIP compression is handled by nginx
-BROTLI_STATIC_COMPRESSION = False
-GZIP_STATIC_COMPRESSION = False
 
 {% if openwisp2_sentry.get("dsn") %}
 RAVEN_CONFIG = {{ openwisp2_sentry | to_nice_json }}