Merge pull request #216 from coreruleset/move-mutex

fix: rearranged ENV variables in strict 'sort' order

apache/Dockerfile

@@ -64,38 +64,38 @@ ARG LUA_MODULES
 
 LABEL maintainer="Felipe Zipitria <[email protected]>"
 
-ENV APACHE_ALWAYS_TLS_REDIRECT=off \
-    APACHE_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
+ENV \
+    ACCESSLOG=/var/log/apache2/access.log \
+    APACHE_ALWAYS_TLS_REDIRECT=off \
     APACHE_ERRORLOG_FORMAT='"[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"' \
+    APACHE_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
     APACHE_METRICS_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
-    ACCESSLOG=/var/log/apache2/access.log \
     BACKEND=http://localhost:80 \
     BACKEND_WS=ws://localhost:8080 \
     ERRORLOG='/proc/self/fd/2' \
     H2_PROTOCOLS='h2 http/1.1' \
     LOGLEVEL=warn \
     METRICS_ALLOW_FROM='127.0.0.0/255.0.0.0 ::1/128' \
     METRICS_DENY_FROM='All' \
-    MUTEX='default' \
     METRICSLOG='/dev/null' \
     MODSEC_AUDIT_ENGINE="RelevantOnly" \
-    MODSEC_AUDIT_LOG_FORMAT=JSON \
-    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_LOG=/dev/stdout \
+    MODSEC_AUDIT_LOG_FORMAT=JSON \
     MODSEC_AUDIT_LOG_PARTS='ABIJDEFHZ' \
+    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_STORAGE=/var/log/modsecurity/audit/ \
     MODSEC_DATA_DIR=/tmp/modsecurity/data \
     MODSEC_DEBUG_LOG=/dev/null \
     MODSEC_DEBUG_LOGLEVEL=0 \
     MODSEC_DEFAULT_PHASE1_ACTION="phase:1,pass,log,tag:'\${MODSEC_TAG}'" \
     MODSEC_DEFAULT_PHASE2_ACTION="phase:2,pass,log,tag:'\${MODSEC_TAG}'" \
     MODSEC_DISABLE_BACKEND_COMPRESSION="On" \
-    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_PCRE_MATCH_LIMIT=100000 \
+    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_REQ_BODY_ACCESS=on \
+    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_LIMIT=13107200 \
     MODSEC_REQ_BODY_LIMIT_ACTION="Reject" \
-    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_NOFILES_LIMIT=131072 \
     MODSEC_RESP_BODY_ACCESS=on \
     MODSEC_RESP_BODY_LIMIT=1048576 \
@@ -108,15 +108,16 @@ ENV APACHE_ALWAYS_TLS_REDIRECT=off \
     MODSEC_TMP_DIR=/tmp/modsecurity/tmp \
     MODSEC_TMP_SAVE_UPLOADED_FILES="on" \
     MODSEC_UPLOAD_DIR=/tmp/modsecurity/upload \
+    MUTEX='default' \
     PORT=80 \
     PROXY_ERROR_OVERRIDE=on \
     PROXY_PRESERVE_HOST=on \
-    PROXY_SSL=off \
     PROXY_SSL_CA_CERT=/etc/ssl/certs/ca-certificates.crt \
-    PROXY_SSL_CERT=/usr/local/apache2/conf/proxy.crt \
     PROXY_SSL_CERT_KEY=/usr/local/apache2/conf/proxy.key \
+    PROXY_SSL_CERT=/usr/local/apache2/conf/proxy.crt \
     PROXY_SSL_CHECK_PEER_NAME=off \
     PROXY_SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
+    PROXY_SSL=off \
     PROXY_SSL_PROTOCOLS="all -SSLv3 -TLSv1 -TLSv1.1" \
     PROXY_SSL_VERIFY=none \
     PROXY_TIMEOUT=60 \
@@ -126,15 +127,15 @@ ENV APACHE_ALWAYS_TLS_REDIRECT=off \
     SERVER_NAME=localhost \
     SERVER_SIGNATURE=Off \
     SERVER_TOKENS=Full \
-    SSL_CERT=/usr/local/apache2/conf/server.crt \
     SSL_CERT_KEY=/usr/local/apache2/conf/server.key \
+    SSL_CERT=/usr/local/apache2/conf/server.crt \
     SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
     SSL_ENGINE=on \
     SSL_HONOR_CIPHER_ORDER=off \
+    SSL_OCSP_STAPLING=On \
     SSL_PORT=443 \
     SSL_PROTOCOLS="all -SSLv3 -TLSv1 -TLSv1.1" \
     SSL_SESSION_TICKETS=off \
-    SSL_OCSP_STAPLING=On \
     TIMEOUT=60 \
     WORKER_CONNECTIONS=400 \
     # CRS specific variables

apache/Dockerfile-alpine

@@ -74,38 +74,38 @@ ARG LUA_MODULES
 
 LABEL maintainer="Felipe Zipitria <[email protected]>"
 
-ENV APACHE_ALWAYS_TLS_REDIRECT=off \
-    APACHE_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
+ENV \
+    ACCESSLOG=/var/log/apache2/access.log \
+    APACHE_ALWAYS_TLS_REDIRECT=off \
     APACHE_ERRORLOG_FORMAT='"[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"' \
+    APACHE_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
     APACHE_METRICS_LOGFORMAT='"%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""' \
-    ACCESSLOG=/var/log/apache2/access.log \
     BACKEND=http://localhost:80 \
     BACKEND_WS=ws://localhost:8080 \
     ERRORLOG='/proc/self/fd/2' \
     H2_PROTOCOLS='h2 http/1.1' \
     LOGLEVEL=warn \
     METRICS_ALLOW_FROM='127.0.0.0/255.0.0.0 ::1/128' \
     METRICS_DENY_FROM='All' \
-    MUTEX='default' \
     METRICSLOG='/dev/null' \
     MODSEC_AUDIT_ENGINE="RelevantOnly" \
-    MODSEC_AUDIT_LOG_FORMAT=JSON \
-    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_LOG=/dev/stdout \
+    MODSEC_AUDIT_LOG_FORMAT=JSON \
     MODSEC_AUDIT_LOG_PARTS='ABIJDEFHZ' \
+    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_STORAGE=/var/log/modsecurity/audit/ \
     MODSEC_DATA_DIR=/tmp/modsecurity/data \
     MODSEC_DEBUG_LOG=/dev/null \
     MODSEC_DEBUG_LOGLEVEL=0 \
     MODSEC_DEFAULT_PHASE1_ACTION="phase:1,pass,log,tag:'\${MODSEC_TAG}'" \
     MODSEC_DEFAULT_PHASE2_ACTION="phase:2,pass,log,tag:'\${MODSEC_TAG}'" \
     MODSEC_DISABLE_BACKEND_COMPRESSION="On" \
-    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_PCRE_MATCH_LIMIT=100000 \
+    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_REQ_BODY_ACCESS=on \
+    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_LIMIT=13107200 \
     MODSEC_REQ_BODY_LIMIT_ACTION="Reject" \
-    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_NOFILES_LIMIT=131072 \
     MODSEC_RESP_BODY_ACCESS=on \
     MODSEC_RESP_BODY_LIMIT=1048576 \
@@ -118,15 +118,16 @@ ENV APACHE_ALWAYS_TLS_REDIRECT=off \
     MODSEC_TMP_DIR=/tmp/modsecurity/tmp \
     MODSEC_TMP_SAVE_UPLOADED_FILES="on" \
     MODSEC_UPLOAD_DIR=/tmp/modsecurity/upload \
+    MUTEX='default' \
     PORT=80 \
     PROXY_ERROR_OVERRIDE=on \
     PROXY_PRESERVE_HOST=on \
-    PROXY_SSL=off \
     PROXY_SSL_CA_CERT=/etc/ssl/certs/ca-certificates.crt \
-    PROXY_SSL_CERT=/usr/local/apache2/conf/proxy.crt \
     PROXY_SSL_CERT_KEY=/usr/local/apache2/conf/proxy.key \
+    PROXY_SSL_CERT=/usr/local/apache2/conf/proxy.crt \
     PROXY_SSL_CHECK_PEER_NAME=off \
     PROXY_SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
+    PROXY_SSL=off \
     PROXY_SSL_PROTOCOLS="all -SSLv3 -TLSv1 -TLSv1.1" \
     PROXY_SSL_VERIFY=none \
     PROXY_TIMEOUT=60 \
@@ -136,15 +137,15 @@ ENV APACHE_ALWAYS_TLS_REDIRECT=off \
     SERVER_NAME=localhost \
     SERVER_SIGNATURE=Off \
     SERVER_TOKENS=Full \
-    SSL_CERT=/usr/local/apache2/conf/server.crt \
     SSL_CERT_KEY=/usr/local/apache2/conf/server.key \
+    SSL_CERT=/usr/local/apache2/conf/server.crt \
     SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
     SSL_ENGINE=on \
     SSL_HONOR_CIPHER_ORDER=off \
+    SSL_OCSP_STAPLING=On \
     SSL_PORT=443 \
     SSL_PROTOCOLS="all -SSLv3 -TLSv1 -TLSv1.1" \
     SSL_SESSION_TICKETS=off \
-    SSL_OCSP_STAPLING=On \
     TIMEOUT=60 \
     WORKER_CONNECTIONS=400 \
     # CRS specific variables

nginx/Dockerfile

@@ -113,32 +113,34 @@ ARG LUA_MODULES
 
 LABEL maintainer="Felipe Zipitria <[email protected]>"
 
-ENV ACCESSLOG=/var/log/nginx/access.log \
+ENV \
+    ACCESSLOG=/var/log/nginx/access.log \
     BACKEND=http://localhost:80 \
     DNS_SERVER= \
     ERRORLOG=/var/log/nginx/error.log \
     KEEPALIVE_TIMEOUT=60s \
+    LD_LIBRARY_PATH=/lib:/usr/lib:/usr/local/lib \
     LOGLEVEL=warn \
     METRICS_ALLOW_FROM='127.0.0.0/24' \
     METRICS_DENY_FROM='all' \
     METRICSLOG=/dev/null \
     MODSEC_AUDIT_ENGINE="RelevantOnly" \
-    MODSEC_AUDIT_LOG_FORMAT=JSON \
-    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_LOG=/dev/stdout \
+    MODSEC_AUDIT_LOG_FORMAT=JSON \
     MODSEC_AUDIT_LOG_PARTS='ABIJDEFHZ' \
+    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_STORAGE=/var/log/modsecurity/audit/ \
     MODSEC_DATA_DIR=/tmp/modsecurity/data \
     MODSEC_DEBUG_LOG=/dev/null \
     MODSEC_DEBUG_LOGLEVEL=0 \
     MODSEC_DEFAULT_PHASE1_ACTION="phase:1,pass,log,tag:'\${MODSEC_TAG}'" \
     MODSEC_DEFAULT_PHASE2_ACTION="phase:2,pass,log,tag:'\${MODSEC_TAG}'" \
-    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_PCRE_MATCH_LIMIT=100000 \
+    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_REQ_BODY_ACCESS=on \
+    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_LIMIT=13107200 \
     MODSEC_REQ_BODY_LIMIT_ACTION="Reject" \
-    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_NOFILES_LIMIT=131072 \
     MODSEC_RESP_BODY_ACCESS=on \
     MODSEC_RESP_BODY_LIMIT=1048576 \
@@ -150,22 +152,23 @@ ENV ACCESSLOG=/var/log/nginx/access.log \
     MODSEC_TMP_DIR=/tmp/modsecurity/tmp \
     MODSEC_TMP_SAVE_UPLOADED_FILES="on" \
     MODSEC_UPLOAD_DIR=/tmp/modsecurity/upload \
-    PORT=8080 \
     NGINX_ALWAYS_TLS_REDIRECT=off \
-    SET_REAL_IP_FROM="127.0.0.1" \
-    REAL_IP_HEADER="X-REAL-IP" \
-    REAL_IP_PROXY_HEADER="X-REAL-IP" \
-    REAL_IP_RECURSIVE="on" \
-    PROXY_SSL=off \
+    NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx \
+    PORT=8080 \
     PROXY_SSL_CERT=/etc/nginx/conf/proxy.crt \
     PROXY_SSL_CERT_KEY=/etc/nginx/conf/proxy.key \
     PROXY_SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
+    PROXY_SSL=off \
     PROXY_SSL_PROTOCOLS="TLSv1.2 TLSv1.3" \
-    PROXY_SSL_VERIFY=off \
     PROXY_SSL_VERIFY_DEPTH=1 \
+    PROXY_SSL_VERIFY=off \
     PROXY_TIMEOUT=60s \
+    REAL_IP_HEADER="X-REAL-IP" \
+    REAL_IP_PROXY_HEADER="X-REAL-IP" \
+    REAL_IP_RECURSIVE="on" \
     SERVER_NAME=localhost \
     SERVER_TOKENS=off \
+    SET_REAL_IP_FROM="127.0.0.1" \
     SSL_CERT=/etc/nginx/conf/server.crt \
     SSL_CERT_KEY=/etc/nginx/conf/server.key \
     SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
@@ -174,11 +177,9 @@ ENV ACCESSLOG=/var/log/nginx/access.log \
     SSL_PORT=8443 \
     SSL_PREFER_CIPHERS=off \
     SSL_PROTOCOLS="TLSv1.2 TLSv1.3" \
-    SSL_VERIFY=off \
     SSL_VERIFY_DEPTH=1 \
+    SSL_VERIFY=off \
     WORKER_CONNECTIONS=1024 \
-    LD_LIBRARY_PATH=/lib:/usr/lib:/usr/local/lib \
-    NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx \
     # CRS specific variables
     PARANOIA=1 \
     ANOMALY_INBOUND=5 \

nginx/Dockerfile-alpine

@@ -108,31 +108,34 @@ ARG LUA_MODULES
 
 LABEL maintainer="Felipe Zipitria <[email protected]>"
 
-ENV ACCESSLOG=/var/log/nginx/access.log \
+ENV \
+    ACCESSLOG=/var/log/nginx/access.log \
     BACKEND=http://localhost:80 \
     DNS_SERVER= \
     ERRORLOG=/var/log/nginx/error.log \
+    KEEPALIVE_TIMEOUT=60s \
+    LD_LIBRARY_PATH=/lib:/usr/lib:/usr/local/lib \
     LOGLEVEL=warn \
     METRICS_ALLOW_FROM='127.0.0.0/24' \
     METRICS_DENY_FROM='all' \
     METRICSLOG=/dev/null \
     MODSEC_AUDIT_ENGINE="RelevantOnly" \
-    MODSEC_AUDIT_LOG_FORMAT=JSON \
-    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_LOG=/dev/stdout \
+    MODSEC_AUDIT_LOG_FORMAT=JSON \
     MODSEC_AUDIT_LOG_PARTS='ABIJDEFHZ' \
+    MODSEC_AUDIT_LOG_TYPE=Serial \
     MODSEC_AUDIT_STORAGE=/var/log/modsecurity/audit/ \
     MODSEC_DATA_DIR=/tmp/modsecurity/data \
     MODSEC_DEBUG_LOG=/dev/null \
     MODSEC_DEBUG_LOGLEVEL=0 \
     MODSEC_DEFAULT_PHASE1_ACTION="phase:1,pass,log,tag:'\${MODSEC_TAG}'" \
     MODSEC_DEFAULT_PHASE2_ACTION="phase:2,pass,log,tag:'\${MODSEC_TAG}'" \
-    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_PCRE_MATCH_LIMIT=100000 \
+    MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 \
     MODSEC_REQ_BODY_ACCESS=on \
+    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_LIMIT=13107200 \
     MODSEC_REQ_BODY_LIMIT_ACTION="Reject" \
-    MODSEC_REQ_BODY_JSON_DEPTH_LIMIT=512 \
     MODSEC_REQ_BODY_NOFILES_LIMIT=131072 \
     MODSEC_RESP_BODY_ACCESS=on \
     MODSEC_RESP_BODY_LIMIT=1048576 \
@@ -144,22 +147,23 @@ ENV ACCESSLOG=/var/log/nginx/access.log \
     MODSEC_TMP_DIR=/tmp/modsecurity/tmp \
     MODSEC_TMP_SAVE_UPLOADED_FILES="on" \
     MODSEC_UPLOAD_DIR=/tmp/modsecurity/upload \
-    PORT=8080 \
     NGINX_ALWAYS_TLS_REDIRECT=off \
-    SET_REAL_IP_FROM="127.0.0.1" \
-    REAL_IP_HEADER="X-REAL-IP" \
-    REAL_IP_PROXY_HEADER="X-REAL-IP" \
-    REAL_IP_RECURSIVE="on" \
-    PROXY_SSL=off \
+    NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx \
+    PORT=8080 \
     PROXY_SSL_CERT=/etc/nginx/conf/proxy.crt \
     PROXY_SSL_CERT_KEY=/etc/nginx/conf/proxy.key \
     PROXY_SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
+    PROXY_SSL=off \
     PROXY_SSL_PROTOCOLS="TLSv1.2 TLSv1.3" \
-    PROXY_SSL_VERIFY=off \
     PROXY_SSL_VERIFY_DEPTH=1 \
+    PROXY_SSL_VERIFY=off \
     PROXY_TIMEOUT=60s \
+    REAL_IP_HEADER="X-REAL-IP" \
+    REAL_IP_PROXY_HEADER="X-REAL-IP" \
+    REAL_IP_RECURSIVE="on" \
     SERVER_NAME=localhost \
     SERVER_TOKENS=off \
+    SET_REAL_IP_FROM="127.0.0.1" \
     SSL_CERT=/etc/nginx/conf/server.crt \
     SSL_CERT_KEY=/etc/nginx/conf/server.key \
     SSL_CIPHERS="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" \
@@ -170,10 +174,7 @@ ENV ACCESSLOG=/var/log/nginx/access.log \
     SSL_PROTOCOLS="TLSv1.2 TLSv1.3" \
     SSL_VERIFY_DEPTH=1 \
     SSL_VERIFY=off \
-    KEEPALIVE_TIMEOUT=60s \
     WORKER_CONNECTIONS=1024 \
-    LD_LIBRARY_PATH=/lib:/usr/lib:/usr/local/lib \
-    NGINX_ENVSUBST_OUTPUT_DIR=/etc/nginx \
     # CRS specific variables
     PARANOIA=1 \
     ANOMALY_INBOUND=5 \