MCP Manager

events { worker_connections 1024; } http { # Basic HTTP settings sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; include /etc/nginx/mime.types; default_type application/octet-stream; # HTTP server - redirect to HTTPS server { listen 80 default_server; listen [::]:80 default_server; server_name _; # Redirect all HTTP traffic to HTTPS return 301 https://$server_name$request_uri; } # HTTPS server server { listen 443 ssl http2 default_server; listen [::]:443 ssl http2 default_server; server_name _; # SSL/TLS Configuration ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt; ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key; # Modern SSL configuration ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; ssl_session_cache shared:SSL:15m; ssl_session_timeout 1d; # Security headers add_header Strict-Transport-Security "max-age=63072000" always; add_header X-Frame-Options DENY always; add_header X-Content-Type-Options nosniff always; location / { # Bearer token check if ($http_authorization != "Bearer ${ACCESS_TOKEN}") { return 401 "Unauthorized: Invalid or missing bearer token"; } # Simple API key check # if ($http_x_api_key != "${ACCESS_TOKEN}") { # return 401 "Unauthorized: Invalid or missing API key"; # } # Streaming optimizations proxy_buffering off; proxy_request_buffering off; proxy_http_version 1.1; proxy_set_header Connection ""; # No timeouts for streaming proxy_connect_timeout 1d; proxy_send_timeout 1d; proxy_read_timeout 1d; # Proxy to backend (supergateway on port 8000) proxy_pass http://127.0.0.1:8000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } }