From 40bbd805b63a570af6258c36cabf8afdee538bde Mon Sep 17 00:00:00 2001
From: Daniel Nelson <daniel.nelson@influxdb.com>
Date: Wed, 21 Aug 2019 18:04:51 -0700
Subject: [PATCH] Add TLS support to nginx_plus, nginx_plus_api and nginx_vts
 (#6300)

---
 plugins/inputs/nginx_plus/nginx_plus.go       | 26 +++++++++++++----
 .../inputs/nginx_plus_api/nginx_plus_api.go   | 28 ++++++++++++++-----
 plugins/inputs/nginx_vts/nginx_vts.go         | 25 +++++++++++++----
 3 files changed, 61 insertions(+), 18 deletions(-)

diff --git a/plugins/inputs/nginx_plus/nginx_plus.go b/plugins/inputs/nginx_plus/nginx_plus.go
index 089ba7d93..ea3aeb28b 100644
--- a/plugins/inputs/nginx_plus/nginx_plus.go
+++ b/plugins/inputs/nginx_plus/nginx_plus.go
@@ -14,15 +14,16 @@ import (
 
 	"github.com/influxdata/telegraf"
 	"github.com/influxdata/telegraf/internal"
+	"github.com/influxdata/telegraf/internal/tls"
 	"github.com/influxdata/telegraf/plugins/inputs"
 )
 
 type NginxPlus struct {
-	Urls []string
+	Urls            []string          `toml:"urls"`
+	ResponseTimeout internal.Duration `toml:"response_timeout"`
+	tls.ClientConfig
 
 	client *http.Client
-
-	ResponseTimeout internal.Duration
 }
 
 var sampleConfig = `
@@ -31,6 +32,13 @@ var sampleConfig = `
 
   # HTTP response timeout (default: 5s)
   response_timeout = "5s"
+
+  ## Optional TLS Config
+  # tls_ca = "/etc/telegraf/ca.pem"
+  # tls_cert = "/etc/telegraf/cert.pem"
+  # tls_key = "/etc/telegraf/key.pem"
+  ## Use TLS but skip chain & host verification
+  # insecure_skip_verify = false
 `
 
 func (n *NginxPlus) SampleConfig() string {
@@ -74,14 +82,20 @@ func (n *NginxPlus) Gather(acc telegraf.Accumulator) error {
 }
 
 func (n *NginxPlus) createHttpClient() (*http.Client, error) {
-
 	if n.ResponseTimeout.Duration < time.Second {
 		n.ResponseTimeout.Duration = time.Second * 5
 	}
 
+	tlsConfig, err := n.ClientConfig.TLSConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	client := &http.Client{
-		Transport: &http.Transport{},
-		Timeout:   n.ResponseTimeout.Duration,
+		Transport: &http.Transport{
+			TLSClientConfig: tlsConfig,
+		},
+		Timeout: n.ResponseTimeout.Duration,
 	}
 
 	return client, nil
diff --git a/plugins/inputs/nginx_plus_api/nginx_plus_api.go b/plugins/inputs/nginx_plus_api/nginx_plus_api.go
index d44f793f1..3487dd512 100644
--- a/plugins/inputs/nginx_plus_api/nginx_plus_api.go
+++ b/plugins/inputs/nginx_plus_api/nginx_plus_api.go
@@ -9,17 +9,17 @@ import (
 
 	"github.com/influxdata/telegraf"
 	"github.com/influxdata/telegraf/internal"
+	"github.com/influxdata/telegraf/internal/tls"
 	"github.com/influxdata/telegraf/plugins/inputs"
 )
 
 type NginxPlusApi struct {
-	Urls []string
-
-	ApiVersion int64
+	Urls            []string          `toml:"urls"`
+	ApiVersion      int64             `toml:"api_version"`
+	ResponseTimeout internal.Duration `toml:"response_timeout"`
+	tls.ClientConfig
 
 	client *http.Client
-
-	ResponseTimeout internal.Duration
 }
 
 const (
@@ -49,6 +49,13 @@ var sampleConfig = `
 
   # HTTP response timeout (default: 5s)
   response_timeout = "5s"
+
+  ## Optional TLS Config
+  # tls_ca = "/etc/telegraf/ca.pem"
+  # tls_cert = "/etc/telegraf/cert.pem"
+  # tls_key = "/etc/telegraf/key.pem"
+  ## Use TLS but skip chain & host verification
+  # insecure_skip_verify = false
 `
 
 func (n *NginxPlusApi) SampleConfig() string {
@@ -100,9 +107,16 @@ func (n *NginxPlusApi) createHttpClient() (*http.Client, error) {
 		n.ResponseTimeout.Duration = time.Second * 5
 	}
 
+	tlsConfig, err := n.ClientConfig.TLSConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	client := &http.Client{
-		Transport: &http.Transport{},
-		Timeout:   n.ResponseTimeout.Duration,
+		Transport: &http.Transport{
+			TLSClientConfig: tlsConfig,
+		},
+		Timeout: n.ResponseTimeout.Duration,
 	}
 
 	return client, nil
diff --git a/plugins/inputs/nginx_vts/nginx_vts.go b/plugins/inputs/nginx_vts/nginx_vts.go
index 66a16e6c1..f9372eabd 100644
--- a/plugins/inputs/nginx_vts/nginx_vts.go
+++ b/plugins/inputs/nginx_vts/nginx_vts.go
@@ -13,15 +13,16 @@ import (
 
 	"github.com/influxdata/telegraf"
 	"github.com/influxdata/telegraf/internal"
+	"github.com/influxdata/telegraf/internal/tls"
 	"github.com/influxdata/telegraf/plugins/inputs"
 )
 
 type NginxVTS struct {
-	Urls []string
+	Urls            []string          `toml:"urls"`
+	ResponseTimeout internal.Duration `toml:"response_timeout"`
+	tls.ClientConfig
 
 	client *http.Client
-
-	ResponseTimeout internal.Duration
 }
 
 var sampleConfig = `
@@ -30,6 +31,13 @@ var sampleConfig = `
 
   ## HTTP response timeout (default: 5s)
   response_timeout = "5s"
+
+  ## Optional TLS Config
+  # tls_ca = "/etc/telegraf/ca.pem"
+  # tls_cert = "/etc/telegraf/cert.pem"
+  # tls_key = "/etc/telegraf/key.pem"
+  ## Use TLS but skip chain & host verification
+  # insecure_skip_verify = false
 `
 
 func (n *NginxVTS) SampleConfig() string {
@@ -77,9 +85,16 @@ func (n *NginxVTS) createHTTPClient() (*http.Client, error) {
 		n.ResponseTimeout.Duration = time.Second * 5
 	}
 
+	tlsConfig, err := n.ClientConfig.TLSConfig()
+	if err != nil {
+		return nil, err
+	}
+
 	client := &http.Client{
-		Transport: &http.Transport{},
-		Timeout:   n.ResponseTimeout.Duration,
+		Transport: &http.Transport{
+			TLSClientConfig: tlsConfig,
+		},
+		Timeout: n.ResponseTimeout.Duration,
 	}
 
 	return client, nil