Basic Architecture of Sport Web

2026-08-11 13:37:25 +07:00
commit 8032fff6ac
262 changed files with 20348 additions and 0 deletions
@@ -0,0 +1,81 @@
+# ---------------------------------------------------------------------------
+# Edge routing.
+#
+# In production Cloudflare terminates TLS and sits in front of this; Nginx
+# handles routing, buffering, compression and the per-IP rate ceiling. TLS
+# config is intentionally absent here because the local stack is plain HTTP.
+# ---------------------------------------------------------------------------
+
+upstream storefront_upstream {
+    server storefront:3000;
+    keepalive 32;
+}
+
+upstream admin_upstream {
+    server admin:3001;
+    keepalive 32;
+}
+
+upstream api_upstream {
+    server api:4000;
+    keepalive 32;
+}
+
+# --- Admin dashboard: separate hostname ------------------------------------
+# A distinct origin means an XSS on the storefront cannot reach admin cookies,
+# and the whole host can be IP-restricted or put behind Cloudflare Access.
+server {
+    listen 80;
+    server_name admin.localhost;
+
+    add_header X-Robots-Tag "noindex, nofollow" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+
+    location /api/ {
+        limit_req zone=api_limit burst=20 nodelay;
+        proxy_pass http://api_upstream;
+    }
+
+    location / {
+        limit_req zone=web_limit burst=40 nodelay;
+        proxy_pass http://admin_upstream;
+    }
+}
+
+# --- Storefront + public API -----------------------------------------------
+server {
+    listen 80 default_server;
+    server_name localhost _;
+
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    location /api/ {
+        limit_req zone=api_limit burst=20 nodelay;
+        proxy_pass http://api_upstream;
+
+        # Payment webhooks and image uploads must not be truncated by a short
+        # read timeout; everything else here is fast anyway.
+        proxy_read_timeout 60s;
+        proxy_buffering off;
+    }
+
+    location = /health {
+        access_log off;
+        proxy_pass http://api_upstream/api/v1/health/live;
+    }
+
+    # Next.js build output is content-hashed and therefore immutable.
+    location /_next/static/ {
+        proxy_pass http://storefront_upstream;
+        proxy_cache_valid 200 365d;
+        add_header Cache-Control "public, max-age=31536000, immutable";
+    }
+
+    location / {
+        limit_req zone=web_limit burst=40 nodelay;
+        proxy_pass http://storefront_upstream;
+    }
+}