just-remove/nginx.conf at main · CharlesQueiroz/just-remove · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
events {
    worker_connections 1024;
}

http {
    # Configurações de upstream
    upstream whatsapp_calculator {
        server whatsapp-calculator:8080;
        keepalive 32;
    }

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

    # Cache de respostas
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=api_cache:10m max_size=100m inactive=60m;

    # Configuração do servidor
    server {
        listen 80;
        server_name _;

        # Configurações de segurança
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;

        # Logs
        access_log /var/log/nginx/whatsapp-calculator-access.log;
        error_log /var/log/nginx/whatsapp-calculator-error.log;

        # Configuração de proxy
        location / {
            # Rate limiting
            limit_req zone=api_limit burst=20 nodelay;

            # Proxy headers
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Proxy para o container
            proxy_pass http://whatsapp_calculator;

            # Timeouts
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;

            # Buffering
            proxy_buffering on;
            proxy_buffer_size 4k;
            proxy_buffers 8 4k;

            # Keep-alive
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        # Cache para recursos estáticos
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            proxy_pass http://whatsapp_calculator;
            proxy_cache api_cache;
            proxy_cache_valid 200 1d;
            add_header Cache-Control "public, max-age=86400";
        }

        # Health check endpoint sem rate limit
        location /q/health {
            proxy_pass http://whatsapp_calculator/q/health;
            access_log off;
        }

        # Metrics endpoint com restrição de IP
        location /q/metrics {
            # Permitir apenas IPs específicos (ajuste conforme necessário)
            # allow 10.0.0.0/8;
            # deny all;

            proxy_pass http://whatsapp_calculator/q/metrics;
        }
    }

    # Configuração HTTPS (descomente quando tiver certificado SSL)
    # server {
    #     listen 443 ssl http2;
    #     server_name seu-dominio.com;
    #
    #     ssl_certificate /etc/letsencrypt/live/seu-dominio.com/fullchain.pem;
    #     ssl_certificate_key /etc/letsencrypt/live/seu-dominio.com/privkey.pem;
    #
    #     # Configurações SSL modernas
    #     ssl_protocols TLSv1.2 TLSv1.3;
    #     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    #     ssl_prefer_server_ciphers off;
    #
    #     # HSTS
    #     add_header Strict-Transport-Security "max-age=63072000" always;
    #
    #     # Mesmas configurações de location do servidor HTTP
    #     # ...
    # }
}