Merge branch 'main' into update-agent-v2-installation-docs

ADubhlaoich · web-flow · commit 99c7e0ebafb2 · 2025-07-23T14:56:01.000+01:00
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -41,6 +41,7 @@ To understand how we use Git in this repository, read our [Git conventions](/doc
 The broad workflow is as follows:
 
 - Fork the NGINX repository
+  - If you're an F5/NGINX user, you can work from a clone
 - Create a branch
 - Implement your changes in your branch
 - Submit a pull request (PR) when your changes are ready for review
diff --git a/content/includes/licensing-and-reporting/apply-jwt.md b/content/includes/licensing-and-reporting/apply-jwt.md
@@ -1,12 +1,15 @@
 ---
-docs:
 file:
   - content/solutions/about-subscription-licenses.md
   - content/nap-waf/v5/admin-guide/install.md
 ---
 
-1. Copy the license file to `/etc/nginx/license.jwt` on Linux or `/usr/local/etc/nginx/license.jwt` on FreeBSD for each NGINX Plus instance.
-2. Reload NGINX:
+1. Copy the license file to:
+
+   - `/etc/nginx/license.jwt` on Linux
+   - `/usr/local/etc/nginx/license.jwt` on FreeBSD
+
+1. Reload NGINX:
 
    ```shell
    systemctl reload nginx
diff --git a/content/includes/licensing-and-reporting/deploy-jwt-with-csgs.md b/content/includes/licensing-and-reporting/deploy-jwt-with-csgs.md
@@ -0,0 +1,16 @@
+---
+file:
+  - content/solutions/about-subscription-licenses.md
+---
+
+1. In the NGINX One Console, go to **Manage > Config Sync Groups**, then select your group.
+   
+   If you haven't created a Config Sync Group yet, see [Manage Config Sync Groups]({{< ref "/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md" >}}) for setup instructions.
+2. Select the **Configuration** tab, then choose **Edit Configuration**.
+3. Select **Add File**, then choose **New Configuration File**.
+4. In the **File name** field, enter:
+   - On Linux: `/etc/nginx/license.jwt`  
+   - On FreeBSD: `/usr/local/etc/nginx/license.jwt`  
+   The name must be exact.
+5. Paste the contents of your JWT license file into the editor.
+6. Select **Next** to preview the diff, then **Save and Publish** to apply the update.
diff --git a/content/includes/nginx-plus/nginx-openid-repo-note.md b/content/includes/nginx-plus/nginx-openid-repo-note.md
diff --git a/content/includes/nim/tech-specs/supported-distros.md b/content/includes/nim/tech-specs/supported-distros.md
@@ -8,14 +8,12 @@ The following table lists the Linux distributions supported by NGINX Instance Ma
 
 {{<bootstrap-table "table table-striped table-bordered">}}
 
-| Distribution    | Version                                | Architecture     | NGINX Instance Manager Support                    | NGINX App Protect Support                          |
-|-----------------|----------------------------------------|------------------|---------------------------------------------------|----------------------------------------------------|
-| Amazon Linux    | 2 LTS                                  | x86_64           | Supported                                         | **Support discontinued as of 2.18.0**              |
-| CentOS          | 7.4 and later in the 7.x family        | x86_64           | **Support discontinued as of 2.17.0**             | **Support discontinued as of 2.17.0**              |
-| Debian          | 11<hr>12                               | x86_64<hr>x86_64 | Supported<hr>Supported on 2.13.0+                 | Supported<hr>Supported                             |
-| Oracle Linux    | 7.4 and later in the 7.x family<hr>8.0 and later in the 8.x family | x86_64<hr>x86_64 | **Support discontinued as of 2.17.0**<hr>Supported on 2.6.0+                 | **Support discontinued as of 2.17.0**<hr>Supported                             |
-| RHEL            | 7.4 and later in the 7.x family<hr>8.x and later in the 8.x family<hr>9.x and later in the 9.x family | x86_64<hr>x86_64<hr>x86_64 | **Support discontinued as of 2.17.0**<hr>Supported<hr>Supported on 2.6.0+ | **Support discontinued as of 2.17.0**<hr>Supported<hr>Supported |
-| Ubuntu          | 20.04<hr>22.04<hr>24.04                | x86_64<hr>x86_64<hr>x86_64 | Supported<hr>Supported on 2.3.0+<hr>Supported on 2.18.0+                 | **Support discontinued as of NAP 4.15.0/5.7.0**<hr>Supported<hr>Supported                             |
+| Distribution    | Version                                | Architecture     | NGINX Instance Manager Support                      | NGINX App Protect Support                          |
+|-----------------|----------------------------------------|------------------|-----------------------------------------------------|----------------------------------------------------|
+| Debian          | 11<hr>12                               | x86_64<hr>x86_64 | Supported<hr>Supported                              | Supported<hr>Supported                             |
+| Oracle Linux    | 8.0 and later in the 8.x family        | x86_64           | Supported                                           | Supported                                          |
+| RHEL            | 8.0 and later in the 8.x family<hr>9.0 and later in the 9.x family  | x86_64<hr>x86_64 | Supported<hr>Supported | Supported<hr>Supported                             |
+| Ubuntu          | 22.04<hr>24.04                         | x86_64<hr>x86_64 | Supported<hr>Supported on 2.18.0+                   | Supported<hr>Supported                             |
 
 {{</bootstrap-table>}}
 
diff --git a/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md b/content/nginx-one/connect-instances/set-up-nginx-proxy-for-nginx-one.md
@@ -69,19 +69,38 @@ To set up your other NGINX instances to use the proxy instance to connect to NGI
 2. Open the NGINX Agent configuration file (**/etc/nginx-agent/nginx-agent.conf**) with a text editor.
 3. Add the following configuration. Replace `YOUR_DATA_PLANE_KEY_HERE` with your actual data plane key and `YOUR_PROXY_IP_ADDRESS_HERE` with the IP address of the NGINX proxy instance.
 
-    ```yaml
+   {{< tabs name="Configure NGINX Agent to use the proxy" >}}
+
+   {{%tab name="NGINX Agent 3.x"%}}
+
+   ```yaml
+    command:
+      server:
+        # Replace YOUR_PROXY_IP_ADDRESS_HERE with the IP address of the NGINX proxy instance.
+        host: YOUR_PROXY_IP_ADDRESS_HERE
+        port: 5000
+      auth:
+        # Replace YOUR_DATA_PLANE_KEY_HERE with your NGINX One Console data plane key.
+        token: "YOUR_DATA_PLANE_KEY_HERE"
+      tls:
+        skip_verify: False
+   ```
+
+   {{%/tab%}}
+   {{%tab name="NGINX Agent 2.x"%}}
+   ```yaml
     server:
       # Replace YOUR_DATA_PLANE_KEY_HERE with your NGINX One Data Plane Key.
       token: "YOUR_DATA_PLANE_KEY_HERE"
       # Replace YOUR_PROXY_IP_ADDRESS_HERE with the IP address of the NGINX proxy instance.
       host: YOUR_PROXY_IP_ADDRESS_HERE
       grpcPort: 5000
-      command: agent.connect.nginx.com
-      metrics: agent.connect.nginx.com
     tls:
-      enable: true
-      skip_verify: false
-    ```
+      enable: True
+      skip_verify: False
+   ```
+   {{%/tab%}}
+   {{%/tabs%}}
 
 4. Restart NGINX Agent:
 
diff --git a/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md b/content/nginx/admin-guide/installing-nginx/installing-nginx-plus-amazon-web-services.md
@@ -38,7 +38,7 @@ To quickly set up an NGINX Plus environment on AWS:
 	/etc/init.d/nginx status
 	```
 
-See [NGINX Plus on the AWS Cloud Quick Start](https://aws.amazon.com/quickstart/architecture/nginx-plus/) deployment guide for details.
+See [NGINX Plus on the AWS Cloud Quick Start](https://aws.amazon.com/blogs/apn/introducing-a-new-aws-quick-start-nginx-plus-on-the-aws-cloud-in-15-minutes/) deployment guide for details.
 
 ## What If I Need Help?
 
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/active-directory-federation-services.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/active-directory-federation-services.md
@@ -16,7 +16,7 @@ See [Single Sign-On With Microsoft AD FS]({{< ref "nginx/deployment-guides/singl
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Microsoft Active Directory Federation Services](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) (AD FS) as the identity provider (IdP) and NGINX Plus as the relying party.
 
-{{< see-also >}}{{< readfile file="includes/nginx-openid-repo-note.txt" markdown="true" >}}{{< /see-also >}}
+{{< see-also >}}{{<include "nginx-plus/nginx-openid-repo-note">}}{{< /see-also >}}
 
 <span id="prereqs"></span>
 ## Prerequisites
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/auth0.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/auth0.md
@@ -16,7 +16,7 @@ See [Single Sign-On With Auth0]({{< ref "nginx/deployment-guides/single-sign-on/
 
 You can use F5 NGINX Plus with [Auth0](https://auth0.com/) and OpenID Connect to enable single sign-on (SSO) for your proxied applications. By following the steps in this guide, you will learn how to set up SSO using OpenID Connect as the authentication mechanism, with Auth0 as the identity provider (IdP), and NGINX Plus as the relying party.
 
-{{< see-also >}}{{< readfile file="includes/nginx-openid-repo-note.txt" markdown="true" >}}{{< /see-also >}}
+{{< see-also >}}{{<include "nginx-plus/nginx-openid-repo-note">}}{{< /see-also >}}
 
 ## Prerequisites
 
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/cognito.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/cognito.md
@@ -16,7 +16,7 @@ See [Single Sign-On With Amazon Cognito]({{< ref "nginx/deployment-guides/single
 
 This guide explains how to enable single sign‑on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Amazon Cognito](https://aws.amazon.com/cognito/) as the identity provider (IdP), and NGINX Plus as the relying party.
 
-{{< see-also >}}{{< readfile file="includes/nginx-openid-repo-note.txt" markdown="true" >}}{{< /see-also >}}
+{{< see-also >}}{{<include "nginx-plus/nginx-openid-repo-note">}}{{< /see-also >}}
 
 
 <span id="prereqs"></span>
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/keycloak.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/keycloak.md
@@ -16,7 +16,7 @@ See [Single Sign-On With Keycloak]({{< ref "nginx/deployment-guides/single-sign-
 
 This guide explains how to enable single sign-on (SSO) for applications being proxied by F5 NGINX Plus. The solution uses OpenID Connect as the authentication mechanism, with [Keycloak](https://www.keycloak.org/) as the identity provider (IdP), and NGINX Plus as the relying party.
 
-{{< see-also >}}{{< readfile file="includes/nginx-openid-repo-note.txt" markdown="true" >}}{{< /see-also >}}
+{{< see-also >}}{{<include "nginx-plus/nginx-openid-repo-note">}}{{< /see-also >}}
 
 
 <span id="prereqs"></span>
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/okta.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/okta.md
@@ -16,7 +16,7 @@ See [Single Sign-On With Okta]({{< ref "nginx/deployment-guides/single-sign-on/o
 
 You can use NGINX Plus with Okta and OpenID Connect to enable single sign-on (SSO) for your proxied applications. By following the steps in this guide, you will learn how to set up SSO using OpenID Connect as the authentication mechanism, with Okta as the identity provider (IdP), and NGINX Plus as the relying party.
 
-{{< see-also >}}{{< readfile file="includes/nginx-openid-repo-note.txt" markdown="true" >}}{{< /see-also >}}
+{{< see-also >}}{{<include "nginx-plus/nginx-openid-repo-note">}}{{< /see-also >}}
 
 ## Prerequisites
 
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/onelogin.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/onelogin.md
@@ -16,7 +16,7 @@ See [Single Sign-On With OneLogin]({{< ref "nginx/deployment-guides/single-sign-
 
 You can use NGINX Plus with [OneLogin](https://www.onelogin.com/) and the OpenID Connect protocol to enable single sign-on (SSO) for your proxied applications. By following the steps in this guide, you will learn how to set up SSO using OpenID Connect as the authentication mechanism, with OneLogin as the identity provider (IdP) and NGINX Plus as the relying party.
 
-{{< see-also >}}{{< readfile file="includes/nginx-openid-repo-note.txt" markdown="true" >}}{{< /see-also >}}
+{{< see-also >}}{{<include "nginx-plus/nginx-openid-repo-note">}}{{< /see-also >}}
 
 ## Prerequisites
 
diff --git a/content/nginx/deployment-guides/single-sign-on/oidc-njs/ping-identity.md b/content/nginx/deployment-guides/single-sign-on/oidc-njs/ping-identity.md
@@ -18,7 +18,7 @@ This guide explains how to enable single sign-on (SSO) for applications being pr
 
 The instructions in this document apply to both Ping Identity's on‑premises and cloud products, PingFederate and PingOne for Enterprise.
 
-{{< see-also >}}{{< readfile file="includes/nginx-openid-repo-note.txt" markdown="true" >}}{{< /see-also >}}
+{{< see-also >}}{{<include "nginx-plus/nginx-openid-repo-note">}}{{< /see-also >}}
 
 <span id="prereqs"></span>
 ## Prerequisites
diff --git a/content/nginxaas-azure/_index.md b/content/nginxaas-azure/_index.md
@@ -1,11 +1,67 @@
 ---
 title: NGINXaaS for Azure
-description: 'NGINX as a Service for Azure is an IaaS offering that is tightly integrated
-  into Microsoft Azure public cloud and its ecosystem, making applications fast, efficient,
-  and reliable with full lifecycle management of advanced NGINX traffic services.
-
-  '
+nd-subtitle: Infrastructure-as-a-Service (IaaS) version of NGINX Plus for your Microsoft Azure application stack
 url: /nginxaas/azure/
+nd-landing-page: true
 cascade:
   logo: NGINX-for-Azure-icon.svg
+nd-content-type: landing-page
+nd-product: N4Azure
 ---
+
+
+## About
+
+NGINX as a Service for Azure is an IaaS offering that is tightly integrated
+into Microsoft Azure public cloud and its ecosystem, making applications fast, efficient,
+and reliable with full lifecycle management of advanced NGINX traffic services.
+
+## Featured content
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" isFeaturedSection="true">}}
+    {{<card title="Getting started" titleUrl="/nginxaas/azure/getting-started/" icon="power">}}
+      Deploy NGINX as a Service for Azure using the Azure portal, Azure CLI, or Terraform
+    {{</card>}}
+    {{<card title="Quickstart guides" titleUrl="/nginxaas/azure/quickstart/" icon="square-play">}}
+      Step-by-step guides for several common use cases, including scaling guidance, security controls, and more
+    {{</card>}}
+    {{<card title="Logging and monitoring" titleUrl="/nginxaas/azure/monitoring/" icon="eye">}}
+      Collect, correlate, and analyze metrics for a thorough understanding of your application's health and behavior
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
+
+### Billing
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" >}}
+
+    {{<card title="Marketplace billing" titleUrl="/nginxaas/azure/billing/overview/" icon="wallet">}}
+      See the pricing plans and learn about NGINX Capacity Units (NCUs)
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
+
+### Certificates
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" >}}
+    {{<card title="Add certificates using the Azure portal" titleUrl="/nginxaas/azure/getting-started/ssl-tls-certificates/ssl-tls-certificates-portal/" icon="shield-check">}}
+      Learn to manage SSL/TSL certificates using the Azure portal
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
+
+### More information
+
+{{<card-layout>}}
+  {{<card-section showAsCards="true" >}}
+    {{<card title="Feature comparison" titleUrl="/nginxaas/azure/overview/feature-comparison/" icon="git-compare-arrows">}}
+      Learn about the differences between NGINX as a Service for Azure and NGINX Plus
+    {{</card>}}
+    {{<card title="Changelog" titleUrl="/nginxaas/azure/changelog/" icon="file-clock">}}
+      See the latest updates: New features, improvements, and bug fixes
+    {{</card>}}
+  {{</card-section>}}
+{{</card-layout>}}
diff --git a/content/nic/configuration/policy-resource.md b/content/nic/configuration/policy-resource.md
@@ -793,7 +793,7 @@ waf:
 |``securityLog.enable`` | Enables security log. | ``bool`` | No |
 |``securityLog.apLogConf`` | The [App Protect WAF log conf]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-logs" >}}) resource. Accepts an optional namespace. Only works with ``apPolicy``. | ``string`` | No |
 |``securityLog.apLogBundle`` | The [App Protect WAF log bundle]({{< ref "/nic/installation/integrations/app-protect-waf/configuration.md#waf-bundles" >}}) resource. Only works with ``apBundle``. | ``string`` | No |
-|``securityLog.logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=<ip-address &#124; localhost; fqdn>:<port>``, ``stderr``, ``<absolute path to file>``. | ``string`` | No |
+|``securityLog.logDest`` | The log destination for the security log. Only accepted variables are ``syslog:server=<ip-address>; localhost; fqdn>:<port>``, ``stderr``, ``<absolute path to file>``. | ``string`` | No |
 {{% /table %}}
 
 #### WAF Merging Behavior
diff --git a/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md b/content/nim/nginx-app-protect/security-monitoring/set-up-app-protect-instances.md
@@ -211,7 +211,6 @@ Take the steps below to update your NGINX App Protect WAF configurations by usin
 1. Next, edit the desired configuration file. You will add directives that reference the security policies bundle and enable the NGINX App Protect WAF logs required by the Security Monitoring dashboards. An example configuration is provided below.
 
    ```nginx
-      app_protect_enable on;
       app_protect_enable on;
       app_protect_policy_file "/etc/nms/NginxDefaultPolicy.tgz";
       app_protect_security_log_enable on;
diff --git a/content/solutions/about-subscription-licenses.md b/content/solutions/about-subscription-licenses.md
@@ -14,14 +14,18 @@ We’re updating NGINX Plus to align with F5’s entitlement and visibility poli
 
 Starting with NGINX Plus R33, all **NGINX Plus instances require a valid JSON Web Token (JWT) license**. This license is tied to your subscription (not individual instances) and is used to validate your subscription and automatically send usage reports to F5's licensing endpoint (`product.connect.nginx.com`), as required by your subscription agreement. In offline environments, usage reporting is [routed through NGINX Instance Manager]({{< ref "nim/disconnected/report-usage-disconnected-deployment.md" >}}).
 
-### Important changes
+## Important changes
 
-##### NGINX Plus won't start if:
+If you have multiple subscriptions, you’ll also have multiple JWT licenses. You can assign each NGINX Plus instance to the license you prefer. NGINX combines usage reporting across all licensed instances.
+
+This feature is available in NGINX Instance Manager 2.20 and later.
+
+### NGINX Plus won't start if:
 
 - The JWT license is missing or invalid.
 - The JWT license expired over 90 days ago.
 
-##### NGINX Plus will **stop processing traffic** if:
+### NGINX Plus will **stop processing traffic** if:
 
 - It can't submit an initial usage report to F5's licensing endpoint or NGINX Instance Manager.
 
@@ -41,17 +45,48 @@ When installing or upgrading to NGINX Plus R33 or later, take the following step
 
 ---
 
-## Add the JWT license {#add-jwt}
+## Download the license from MyF5 {#download-jwt}
 
-Before you install or upgrade to NGINX Plus R33 or later, make sure to:
+{{< include "licensing-and-reporting/download-jwt-from-myf5.md" >}}
 
-### Download the license from MyF5 {#download-jwt}
+---
 
-{{< include "licensing-and-reporting/download-jwt-from-myf5.md" >}}
+## Deploy the JWT license
+
+After you download the JWT license, you can deploy it to your NGINX Plus instances using either of the following methods:
+
+- Use a **Config Sync Group** if you're managing instances with the NGINX One Console (recommended)
+- Copy the license manually to each instance
+
+Each method ensures your NGINX Plus instances have access to the required license file.
+
+### Deploy with a Config Sync Group (Recommended)
+
+If you're using the [NGINX One Console]({{< ref "/nginx-one/getting-started.md" >}}), the easiest way to manage your JWT license is with a [Config Sync Group]({{< ref "/nginx-one/nginx-configs/config-sync-groups/manage-config-sync-groups.md" >}}). This method lets you:
+
+- Avoid manual file copying
+- Keep your fleet consistent
+- Automatically apply updates to new NGINX Plus instances
+
+To deploy the JWT license with a Config Sync Group:
+
+{{< include "/licensing-and-reporting/deploy-jwt-with-csgs.md" >}}
+
+Your JWT license now syncs to all NGINX Plus instances in the group.
+
+When your subscription renews and a new JWT license is issued, update the file in the Config Sync Group to apply the change across your fleet.  
+
+New instances added to the group automatically inherit the license.
+
+{{< call-out "note" "If you’re using NGINX Instance Manager" "" >}}
+If you're using NGINX Instance Manager instead of the NGINX One Console, the equivalent feature is called an *instance group*. You can manage your JWT license in the same way by adding or updating the file in the instance group. For details, see [Manage instance groups]({{< ref "/nim/nginx-instances/manage-instance-groups.md" >}}).
+{{< /call-out >}}
+
+### Copy the license manually
 
-### Copy the license to each NGINX Plus instance
+If you're not using the NGINX One Console, copy the JWT license file to each NGINX Plus instance manually.
 
-{{< include "licensing-and-reporting/apply-jwt.md" >}}
+{{< include "/licensing-and-reporting/apply-jwt.md" >}}
 
 ### Custom paths {#custom-paths}
 
diff --git a/content/unit/_index.md b/content/unit/_index.md
diff --git a/layouts/shortcodes/nic-operator-version.html b/layouts/shortcodes/nic-operator-version.html
diff --git a/static/nginx-one/api/one.json b/static/nginx-one/api/one.json
