Every NGINX config encodes intent — is this a reverse proxy? an API gateway? an SSL terminator? — but that intent is never written down. At fleet scale, nobody can tell you what your configs actually do. This session shows how we taught a machine to read them.
We classify NGINX server configs into eight canonical roles using a three-stage pipeline: parse the raw config into a structured directive tree with CrossPlane, then run two complementary classifiers against it — a precision-tuned rule engine that abstains when signatures are ambiguous, and an ML model that generalizes to configs the rules don't cover. A confidence-fusion layer blends them, auto-accepting confident calls and routing borderline ones to expert review.
The counterintuitive lesson: we deliberately didn't just throw an LLM at this. The hybrid beats either approach alone — keeping rule-level precision while recovering the coverage rules lack. You'll see why "negative evidence" (the absence of a directive) is often the strongest signal, how an LLM-as-judge eval validated the design, and how a closed expert-feedback loop turns review hours into measurable accuracy gains. Live, against real configs — including yours, if you bring one.