82 lines
2.4 KiB
Plaintext
82 lines
2.4 KiB
Plaintext
# ---------------------------------------------------------------------------
|
|
# Edge routing.
|
|
#
|
|
# In production Cloudflare terminates TLS and sits in front of this; Nginx
|
|
# handles routing, buffering, compression and the per-IP rate ceiling. TLS
|
|
# config is intentionally absent here because the local stack is plain HTTP.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
upstream storefront_upstream {
|
|
server storefront:3000;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream admin_upstream {
|
|
server admin:3001;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream api_upstream {
|
|
server api:4000;
|
|
keepalive 32;
|
|
}
|
|
|
|
# --- Admin dashboard: separate hostname ------------------------------------
|
|
# A distinct origin means an XSS on the storefront cannot reach admin cookies,
|
|
# and the whole host can be IP-restricted or put behind Cloudflare Access.
|
|
server {
|
|
listen 80;
|
|
server_name admin.localhost;
|
|
|
|
add_header X-Robots-Tag "noindex, nofollow" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
|
|
location /api/ {
|
|
limit_req zone=api_limit burst=20 nodelay;
|
|
proxy_pass http://api_upstream;
|
|
}
|
|
|
|
location / {
|
|
limit_req zone=web_limit burst=40 nodelay;
|
|
proxy_pass http://admin_upstream;
|
|
}
|
|
}
|
|
|
|
# --- Storefront + public API -----------------------------------------------
|
|
server {
|
|
listen 80 default_server;
|
|
server_name localhost _;
|
|
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
location /api/ {
|
|
limit_req zone=api_limit burst=20 nodelay;
|
|
proxy_pass http://api_upstream;
|
|
|
|
# Payment webhooks and image uploads must not be truncated by a short
|
|
# read timeout; everything else here is fast anyway.
|
|
proxy_read_timeout 60s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location = /health {
|
|
access_log off;
|
|
proxy_pass http://api_upstream/api/v1/health/live;
|
|
}
|
|
|
|
# Next.js build output is content-hashed and therefore immutable.
|
|
location /_next/static/ {
|
|
proxy_pass http://storefront_upstream;
|
|
proxy_cache_valid 200 365d;
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
}
|
|
|
|
location / {
|
|
limit_req zone=web_limit burst=40 nodelay;
|
|
proxy_pass http://storefront_upstream;
|
|
}
|
|
}
|