nginx.confā¢6.77 kB
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 4096;
use epoll;
multi_accept on;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
# Logging format
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for" '
'rt=$request_time uct="$upstream_connect_time" '
'uht="$upstream_header_time" urt="$upstream_response_time"';
access_log /var/log/nginx/access.log main;
# Performance settings
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
keepalive_requests 1000;
types_hash_max_size 2048;
client_max_body_size 100m;
client_body_buffer_size 10m;
client_header_buffer_size 1k;
large_client_header_buffers 4 4k;
# Gzip compression
gzip on;
gzip_vary on;
gzip_min_length 1024;
gzip_proxied any;
gzip_comp_level 6;
gzip_types
text/plain
text/css
text/xml
text/javascript
application/json
application/javascript
application/xml+rss
application/atom+xml
image/svg+xml;
# Connection pooling and load balancing
upstream mermaid_backend {
least_conn;
keepalive 64;
keepalive_requests 1000;
keepalive_timeout 60s;
# Kubernetes service endpoints
server mermaid-validator-api:80 max_fails=3 fail_timeout=30s;
# Add more backend servers as needed
}
# Rate limiting zones
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/m;
limit_req_zone $binary_remote_addr zone=upload_limit:10m rate=50r/m;
limit_req_zone $binary_remote_addr zone=validate_limit:10m rate=200r/m;
# Connection limiting
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
limit_conn_zone $server_name zone=conn_limit_per_server:10m;
server {
listen 80;
server_name _;
# Connection limits
limit_conn conn_limit_per_ip 50;
limit_conn conn_limit_per_server 1000;
# Security headers
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Health check endpoint (no rate limiting)
location /api/v1/health {
proxy_pass http://mermaid_backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
# Short timeouts for health checks
proxy_connect_timeout 5s;
proxy_send_timeout 5s;
proxy_read_timeout 5s;
}
# File upload endpoint (stricter limits)
location /api/v1/upload {
limit_req zone=upload_limit burst=10 nodelay;
client_max_body_size 100m;
client_body_timeout 60s;
client_header_timeout 60s;
proxy_pass http://mermaid_backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
# Extended timeouts for file processing
proxy_connect_timeout 10s;
proxy_send_timeout 120s;
proxy_read_timeout 120s;
proxy_request_buffering off;
}
# Validation endpoint (moderate limits)
location /api/v1/validate {
limit_req zone=validate_limit burst=20 nodelay;
proxy_pass http://mermaid_backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
# Standard timeouts for validation
proxy_connect_timeout 10s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
# All other API endpoints
location /api/ {
limit_req zone=api_limit burst=50 nodelay;
proxy_pass http://mermaid_backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
# Standard timeouts
proxy_connect_timeout 10s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
}
# Root endpoint
location / {
limit_req zone=api_limit burst=10 nodelay;
proxy_pass http://mermaid_backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
}
# Error pages
error_page 429 /429.html;
location = /429.html {
return 429 '{"error":"Rate limit exceeded","message":"Too many requests, please try again later","retryAfter":60}';
add_header Content-Type application/json;
}
error_page 502 503 504 /50x.html;
location = /50x.html {
return 502 '{"error":"Service unavailable","message":"Backend servers are temporarily unavailable"}';
add_header Content-Type application/json;
}
}
}
