worker_processes  1;

events {
    worker_connections  1024;
    multi_accept on; # accept each connection as soon as you can
    accept_mutex off;
    use epoll;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    server_tokens off; # dont send unnecessary server info (like version)

    add_header X-XSS-Protection "1; mode=block"; # prevent XSS

    client_body_buffer_size 10K; # raise the threshold by which requests are written to HDD instead of RAM
    client_header_buffer_size 2k;
    client_max_body_size 8m; # we dont accept requests larger that 8mb

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;

    keepalive_timeout 5;

    gzip on;
    gzip_disable "msi6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 4;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_min_length 256;
    gzip_types application/atom+xml application/geo+json application/javascript application/x-javascript application/json application/ld+json application/manifest+json application/rdf+xml application/rss+xml application/xhtml+xml application/xml font/eot font/otf font/ttf image/svg+xml text/css text/javascript text/plain text/xml;

    resolver 127.0.0.11 valid=30s;

    upstream graphql_upstream {
        server graphql-engine:8080 fail_timeout=0;
    }

    geo $limit {
        default 1;
        10.0.0.0/8 0;
        192.168.0.0/24 0;
    }

    map $limit $limit_key {
        0 "";
        1 $binary_remote_addr;
    }

    limit_req_zone $limit_key zone=graphqlDefaultLimit:50m rate=1r/m;
    limit_conn_zone $binary_remote_addr zone=addr:20m;
    proxy_cache_path /tmp/cache levels=1:2 keys_zone=small:40m inactive=10d max_size=2g use_temp_path=off;

    server {
        listen 80 deferred;
        server_name _;
        root /code;

        include /ssl/ssl.conf*;

        client_body_timeout 5s;
        client_header_timeout 5s;
        limit_conn addr 10;

        # Admin console
        location /graphql/admin/ {
            expires 1m; # client-side caching, one minute for each API resource
            add_header Cache-Control "public";
            add_header Pragma public;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_pass http://graphql_upstream/;
        }

        location /graphql/console {
            alias /public-console;
            index index.html;
            try_files $uri $uri/ /index.html =405;
        }

        location /graphql/v1beta {
            # proxy_cache small;
            # proxy_cache_valid 200 10d;
            # proxy_cache_valid any 0;
            # proxy_cache_methods POST;
            # proxy_cache_key "$request_method$request_uri$request_body";
            limit_req zone=graphqlDefaultLimit burst=100 nodelay;
            limit_req_status 429;
            expires 30m; # client-side caching, one minute for each API resource
            add_header Cache-Control "public";
            add_header Pragma public;
            # add_header X-Proxy-Cache $upstream_cache_status;
            proxy_hide_header Access-Control-Allow-Origin;
            add_header Access-Control-Allow-Origin *;
            # add_header X-Cache-Date $upstream_http_date;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_pass http://graphql_upstream/v1/graphql;
        }

        location /api/ {
            expires 1m; # client-side caching, one minute for each API resource
            add_header Cache-Control "public";
            add_header Pragma public;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            set $upstream app;
            proxy_pass http://$upstream:80;
        }

        location / {
            return 404;
        }
    }
}