Update gixy nginx config checker

[aequitas]

No description provided.

[bwbroersma]

The include below both have add_headers, therefore the default behaviour seems okay:

There could be several add_header directives. These directives are inherited from the previous configuration level if and only if there are no add_header directives defined on the current level. Inheritance rules can be redefined with the add_header_inherit directive (1.29.3).

Is the additional add_header_inherit really needed?

[aequitas]

The new gixy-ng (https://github.com/dvershinin/gixy) fails on the current config because of the double headers https://github.com/internetstandards/Internet.nl/actions/runs/27760088839/job/82132454086#step:14:107. Maybe we can mark them so they are ignored (https://github.com/dvershinin/gixy/blob/master/docs/en/configuration.md)?. The only other issue found was a HSTS age of 0 which we also want to ignore. So the newer gixy didn't find anything interesting, maybe in future changes it might?

[bwbroersma]

Problem: [add_header_redefinition] Nested "add_header" drops parent headers.

Which is all by design, and the first time you work with nginx will find this out. I don't really get the warning, but I think we could add change:

Internet.nl/Makefile

Lines 313 to 315 in a5f620d

	check-gixy: env=test
	check-gixy: ## run nginx config check
	${DOCKER_COMPOSE_CMD} exec webserver /opt/gixy/bin/gixy /etc/nginx/nginx.conf

To add -skips:

 	${DOCKER_COMPOSE_CMD} exec webserver /opt/gixy/bin/gixy -skips hsts_header,add_header_redefinition /etc/nginx/nginx.conf 

Another question, shouldn't it be better if this would move to lint/check? (although it's way easier to integrate here I guess).

[aequitas]

I don't like disabling tests all out because then we might miss valid issues in the future. But then again, we don't have these checks at all with the current gixy.

I think I put it into integrationtest originally because it needs the container to render the config from the templates at runtime and lint/test is more for static tests.

[bwbroersma]

I pushed the code just a few minutes before your comment. I agree, but is it possible on line level?
Does it still complain if add_header_inherit on; is set on http level (the highest level)?
Then maybe only HSTS can be skipped, until #324 is fixed.

[bwbroersma]

@aequitas gixy also complains about nginx .. and this is the original/default nginx.conf:

Problem: [worker_rlimit_nofile_vs_connections] The worker_rlimit_nofile should be at least twice than worker_connections.
Severity: MEDIUM
Description: The worker_rlimit_nofile should be at least twice than worker_connections.
Additional info: https://gixy.getpagespeed.com/checks/worker-rlimit-nofile-vs-connections/
Reason: Missing worker_rlimit_nofile with at least twice the value of worker_connections
Pseudo config:

events  {
	worker_connections 1024;
}

Ignore another one?

[aequitas]

It kind of weird, because we do not set worker_connections, but upstream does. But if this is a common issue they should know better and have it set properly right? But then again, upstream doesn't set worker_rlimit_nofile so it defaults to the OS setting (20480) which is enough. So yes, i think we can ignore it.