Nova-Rewards/deployment/nginx/nginx.conf at main · ghzhost/Nova-Rewards · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
worker_processes auto;
error_log /var/log/nginx/error.log warn;
events {
    worker_connections 1024;
    multi_accept on;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    tcp_nopush     on;
    tcp_nodelay    on;
    keepalive_timeout 65;
    client_max_body_size 20m;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    gzip_proxied any;
    gzip_min_length 256;
    gzip_comp_level 5;

    proxy_connect_timeout 5s;
    proxy_send_timeout 30s;
    proxy_read_timeout 30s;
    proxy_buffer_size 16k;
    proxy_buffers 4 32k;
    proxy_busy_buffers_size 64k;
    client_body_buffer_size 16k;

    limit_conn_zone $binary_remote_addr zone=addr:10m;

    upstream auth_service {
        server auth:4001;
    }
    upstream users_service {
        server users:4002;
    }
    upstream rewards_service {
        server rewards:4003;
    }
    upstream leaderboard_service {
        server leaderboard:4004;
    }

    server {
        listen 80 http2;
        server_name _;
        limit_conn addr 20;

        resolver 127.0.0.11 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none';" always;
        add_header X-Frame-Options "DENY" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

        location /auth/ {
            proxy_pass http://auth_service;
        }

        location /users/ {
            proxy_pass http://users_service;
        }

        location /rewards/ {
            proxy_pass http://rewards_service;
        }

        location /leaderboard/ {
            proxy_pass http://leaderboard_service;
        }

        location / {
            return 404;
        }
    }
}