Bangalore BMTC Mobility Connectivity Platform

# NGINX configuration for BMTC MCP API server { listen 80; server_name api.mybmtc.karnataka.gov.in; # Redirect HTTP to HTTPS location / { return 301 https://$host$request_uri; } } server { listen 443 ssl; server_name api.mybmtc.karnataka.gov.in; # SSL certificate configuration ssl_certificate /etc/nginx/ssl/server.crt; ssl_certificate_key /etc/nginx/ssl/server.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; # Security headers add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-XSS-Protection "1; mode=block" always; add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; # Proxy settings location / { proxy_pass http://bmtc-mcp-api:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_buffering on; proxy_buffer_size 128k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; proxy_read_timeout 300s; proxy_connect_timeout 300s; proxy_send_timeout 300s; } # Monitoring endpoints location /metrics { proxy_pass http://bmtc-mcp-api:3000/metrics; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; # Restrict access to internal networks allow 127.0.0.1; allow 10.0.0.0/8; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; } # Custom error pages error_page 404 /404.html; error_page 500 502 503 504 /50x.html; # Static error pages location = /404.html { root /usr/share/nginx/html; } location = /50x.html { root /usr/share/nginx/html; } # Logging configuration access_log /var/log/nginx/api.access.log; error_log /var/log/nginx/api.error.log; }