pokeapi/Resources/nginx/nginx.conf

worker_processes  1;

events {
    worker_connections  1024;
    multi_accept on;
    accept_mutex off;
    use epoll;
}

http {
    access_log off;
    log_format pokeapilogformat
        '$remote_addr '
        '"$request" $status cs:$upstream_cache_status s:$bytes_sent '
        'r:"$http_referer"';
    error_log /dev/stdout warn;
    include mime.types;
    default_type application/octet-stream;

    server_tokens off;

    add_header X-XSS-Protection "1; mode=block";

    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 8m;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;

    keepalive_timeout 5;

    gzip on;
    gzip_disable "msi6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 4;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_min_length 256;
    gzip_types application/atom+xml application/geo+json application/javascript application/x-javascript application/json application/ld+json application/manifest+json application/rdf+xml application/rss+xml application/xhtml+xml application/xml font/eot font/otf font/ttf image/svg+xml text/css text/javascript text/plain text/xml;

    resolver 127.0.0.11 valid=30s;

    upstream graphql_upstream {
        server graphql-engine:8080 fail_timeout=0;
    }

    geo $limit {
        default 1;
        10.0.0.0/8 0;
        192.168.0.0/24 0;
    }

    map $http_user_agent $exclude_ua {
        "~*monitoring*"  0;
        default     1;
    }

    map $request_method $only_post {
        default 0;
        POST $exclude_ua;
    }

    map $limit $limit_key {
        0 "";
        1 $binary_remote_addr;
    }

    limit_req_zone $limit_key zone=graphqlDefaultLimit:50m rate=1r/m;
    limit_conn_zone $binary_remote_addr zone=addr:20m;
    proxy_cache_path /tmp/cache levels=1:2 keys_zone=small:40m inactive=10d max_size=2g use_temp_path=off;

    server {
        listen 80 deferred;
        server_name _;
        root /code;

        include /ssl/ssl.conf*;

        client_body_timeout 5s;
        client_header_timeout 5s;
        limit_conn addr 10;

        # Admin console
        location /graphql/admin/ {
            expires 1m;
            add_header Cache-Control "public";
            add_header Pragma public;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_pass http://graphql_upstream/;
        }

        location /graphql/console {
            alias /public-console;
            index index.html;
            try_files $uri $uri/ /index.html =405;
        }

        location /graphql/v1beta {
            access_log /dev/stdout pokeapilogformat if=$only_post;
            include /ssl/cache.conf*;
            limit_req zone=graphqlDefaultLimit burst=100 nodelay;
            limit_req_status 429;
            expires 30m;
            add_header Cache-Control "public";
            add_header Pragma public;
            proxy_hide_header Access-Control-Allow-Origin;
            add_header Access-Control-Allow-Origin *;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_pass http://graphql_upstream/v1/graphql;
        }

        location /api/ {
            expires 1m;
            add_header Cache-Control "public";
            add_header Pragma public;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            set $upstream app;
            proxy_pass http://$upstream:80;
        }

        location / {
            return 404;
        }
    }
}