74 lines
2.1 KiB
Nginx Configuration File
74 lines
2.1 KiB
Nginx Configuration File
user nginx;
|
|
worker_processes auto;
|
|
error_log /var/log/nginx/error.log warn;
|
|
pid /var/run/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 2048;
|
|
multi_accept on;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# `request_id` is generated here when the client did not supply one and is
|
|
# forwarded to the API, which echoes it back. One id ties the browser's
|
|
# network tab, this access log and the application log together.
|
|
log_format json_combined escape=json
|
|
'{'
|
|
'"time":"$time_iso8601",'
|
|
'"request_id":"$http_x_request_id",'
|
|
'"remote_addr":"$remote_addr",'
|
|
'"method":"$request_method",'
|
|
'"uri":"$request_uri",'
|
|
'"status":$status,'
|
|
'"bytes":$body_bytes_sent,'
|
|
'"duration":$request_time,'
|
|
'"upstream_time":"$upstream_response_time",'
|
|
'"referer":"$http_referer",'
|
|
'"user_agent":"$http_user_agent"'
|
|
'}';
|
|
|
|
access_log /var/log/nginx/access.log json_combined;
|
|
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
server_tokens off;
|
|
|
|
client_max_body_size 25m;
|
|
client_body_timeout 30s;
|
|
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_proxied any;
|
|
gzip_types
|
|
application/javascript
|
|
application/json
|
|
application/xml
|
|
image/svg+xml
|
|
text/css
|
|
text/plain
|
|
text/xml;
|
|
|
|
# Defence in depth. The API rate-limits per actor; this is a blunt
|
|
# per-IP ceiling that protects the app tier from ever seeing a flood.
|
|
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;
|
|
limit_req_zone $binary_remote_addr zone=web_limit:10m rate=60r/s;
|
|
limit_req_status 429;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Request-Id $request_id;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
include /etc/nginx/conf.d/*.conf;
|
|
}
|