snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/zulip/files/nginx/zulip-include-app.d/camo.conf

@@ -0,0 +1,11 @@
+# Proxies /external_content to a local installation of the camo image
+# proxy software.  Because camo serves its metrics at /metrics,
+# explicitly 404 that to external requests.
+location /external_content/metrics {
+    return 404;
+}
+location /external_content {
+    rewrite /external_content/(.*) /$1 break;
+    proxy_pass http://camo;
+    include /etc/nginx/zulip-include/proxy;
+}

puppet/zulip/files/nginx/zulip-include-app.d/external-sso.conf

@@ -0,0 +1,8 @@
+# Use this when you have a server listening on localhost that is serving Zulip
+# with some sort of authentication middleware installed. The proxied-to server
+# should pass REMOTE_USER to /accounts/login/sso/ once it has satisfactorily
+# identified the user.
+location /accounts/login/sso/ {
+    proxy_pass https://localhost_sso;
+    include /etc/nginx/zulip-include/proxy;
+}

puppet/zulip/files/nginx/zulip-include-app.d/keepalive-loadbalancer.conf

@@ -0,0 +1,17 @@
+# This file should be used if the nginx is behind a dedicated
+# loadbalancer.  This allows nginx to be configured for long
+# keep-alive timeouts, to keep connections open to the loadbalancer.
+#
+# All timeouts here should be _longer_ than those on the loadbalancer.
+# This ensures that there cannot be a race condition between nginx
+# deciding to shut down the connection, and the load-balancer sending
+# a request, resulting in a 502 from the loadbalancer.
+#
+# The timeouts on the loadbalancer are assumed to be 20min (1200s) or
+# less; these timeouts are hence for 21min.
+
+keepalive_timeout     1260;
+client_header_timeout 1260;
+client_body_timeout   1260;
+
+keepalive_requests     500;