MediaCrawler MCP Server

# Nginx Reverse Proxy Configuration for MCP Tools Service # This configuration provides load balancing, SSL termination, and security headers user nginx; worker_processes auto; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { worker_connections 1024; use epoll; multi_accept on; } http { include /etc/nginx/mime.types; default_type application/octet-stream; # Logging log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; # Performance sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; client_max_body_size 100M; # Gzip compression gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml; # Security headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; # Upstream backend servers upstream mcp_backend { least_conn; server mcp-tools-service:9090 max_fails=3 fail_timeout=30s; keepalive 32; } upstream admin_backend { least_conn; server mcp-tools-service:9091 max_fails=3 fail_timeout=30s; keepalive 32; } # Rate limiting limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s; limit_req_zone $binary_remote_addr zone=api:10m rate=30r/s; # HTTP to HTTPS redirect (uncomment when SSL is configured) # server { # listen 80; # server_name your-domain.com; # return 301 https://$server_name$request_uri; # } # Main HTTP server server { listen 80; server_name _; # Health check endpoint (no rate limiting) location /health { access_log off; proxy_pass http://mcp_backend/health; proxy_http_version 1.1; proxy_set_header Connection ""; } # MCP SSE endpoint location /sse { limit_req zone=api burst=20 nodelay; proxy_pass http://mcp_backend/sse; proxy_http_version 1.1; # SSE-specific headers proxy_set_header Connection ''; proxy_set_header Cache-Control 'no-cache'; proxy_set_header X-Accel-Buffering 'no'; chunked_transfer_encoding on; # Standard proxy headers proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Timeouts for SSE proxy_connect_timeout 60s; proxy_send_timeout 300s; proxy_read_timeout 300s; } # MCP Messages endpoint location /messages/ { limit_req zone=api burst=30 nodelay; proxy_pass http://mcp_backend/messages/; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; } # API endpoints location /api/ { limit_req zone=api burst=30 nodelay; proxy_pass http://mcp_backend/api/; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # Admin interface location /admin/ { limit_req zone=general burst=10 nodelay; # Optional: Restrict admin access by IP # allow 192.168.1.0/24; # allow 10.0.0.0/8; # deny all; proxy_pass http://admin_backend/; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # Root path location / { limit_req zone=general burst=10 nodelay; proxy_pass http://mcp_backend/; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # Deny access to hidden files location ~ /\. { deny all; access_log off; log_not_found off; } } # HTTPS server (uncomment and configure when SSL certificates are ready) # server { # listen 443 ssl http2; # server_name your-domain.com; # # # SSL configuration # ssl_certificate /etc/nginx/ssl/cert.pem; # ssl_certificate_key /etc/nginx/ssl/key.pem; # ssl_protocols TLSv1.2 TLSv1.3; # ssl_ciphers HIGH:!aNULL:!MD5; # ssl_prefer_server_ciphers on; # ssl_session_cache shared:SSL:10m; # ssl_session_timeout 10m; # # # Additional security headers for HTTPS # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # # # Include all location blocks from the HTTP server above # } }