64 lines
2.0 KiB
Plaintext
64 lines
2.0 KiB
Plaintext
# Reverse proxy for the audit request endpoint.
|
|
#
|
|
# Deliberately a separate server block on its own hostname, so it does not
|
|
# touch the existing git / nextcloud vhosts on this machine. Reload nginx
|
|
# rather than restarting it, and the other services never drop a connection.
|
|
#
|
|
# Install to /etc/nginx/sites-available/api.sascha-bach.de and symlink into
|
|
# sites-enabled. certbot --nginx rewrites the TLS parts of this file.
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name api.sascha-bach.de;
|
|
|
|
# Needed once so certbot can answer the HTTP-01 challenge.
|
|
location /.well-known/acme-challenge/ {
|
|
root /var/www/html;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
http2 on;
|
|
server_name api.sascha-bach.de;
|
|
|
|
# certbot inserts ssl_certificate / ssl_certificate_key here.
|
|
|
|
# The Node process caps bodies at 10 kB. Reject oversized ones at the edge
|
|
# so they never reach it.
|
|
client_max_body_size 16k;
|
|
|
|
# Only these two paths exist. Everything else is refused rather than
|
|
# forwarded, which keeps the attack surface to what the form needs.
|
|
location = /api/audit-request {
|
|
proxy_pass http://127.0.0.1:3001;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
# Required: server.js runs with `trust proxy 1` and derives the
|
|
# rate-limit key from this header. Without it every visitor shares
|
|
# one bucket and three submissions lock out everyone for 15 minutes.
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 30s;
|
|
}
|
|
|
|
location = /health {
|
|
proxy_pass http://127.0.0.1:3001;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
access_log off;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|