nginx.server.conf

server {
  # Listen to HTTP for Carto Builder requests and send 301 redirection to HTTPS.
  listen  80;
  server_name  carto.lan;
  return  301  https://$host$request_uri;
}

server {
  # The other server sends 301 redirects if HTTP, see above.
  listen  443  ssl;

  # The cert and key are "insecure" because they aren't password
  # protected and we push them into a GitHub hosted repo...
  # That's fine. We only use these certs for local dev work.
  ssl_certificate  /etc/ssl/insecure-self-signed-cert.carto.lan.pem;
  ssl_certificate_key  /etc/ssl/key.carto.lan.pem;

  server_name  carto.lan;

  # Note that your host machine won't resolve carto.lan unless
  # you add it to /etc/hosts. Run this command:
  #
  # echo "127.0.0.1 carto.lan" | sudo tee -a /etc/hosts

  location / {
    proxy_set_header  Host  $host;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  X-Real-IP  $remote_addr;

    # Carto Builder watches for this protocal header.
    proxy_set_header  X-Forwarded-Proto  $scheme;

    # Strict-Transport-Security prevents man-in-the-middle attacks.
    # We obviously don't need that in dev, but we'll be using it in
    # production and we want the same behavior.
    add_header  Strict-Transport-Security  "max-age=31536000; includeSubDomains;";

    # 1. We assume the Rails server is listening on port 3000.
    # 2. We use "carto_builder" as the hostname. This
    #    works because that's the name in docker-compose.yaml.
    #    Docker Compose will point "carto_builder" to whatever is
    #    the IP address of Carto Builder.
    proxy_pass  http://carto_builder:3000;

    # The response time needs to include cases where we attach
    # a debugger and spend several minutes on a breakpoint.
    # Having Nginx timeout during debug sessions would get annoying.
    proxy_read_timeout  600; # seconds
  }
}

server {
  # Listen to HTTP for Carto Builder requests and send 301 redirection to HTTPS.
  listen  80;
  server_name  *.carto.lan;
  return  301  https://$host$request_uri;
}

server {
  # The other server sends 301 redirects if HTTP, see above.
  listen  443  ssl;

  # The cert and key are "insecure" because they aren't password
  # protected and we push them into a GitHub hosted repo...
  # That's fine. We only use these certs for local dev work.
  ssl_certificate  /etc/ssl/insecure-self-signed-cert.wildcard.carto.lan.pem;
  ssl_certificate_key  /etc/ssl/key.wildcard.carto.lan.pem;

  # CartoDB Builder can generate and understand "subdomainless URLs" but
  # we don't use that feature because it bypasses some checks on
  # organizations, therefore paths will include a subdomain to declare
  # either the user or organization:
  #
  #   USER=bolt ORGANIZATION_NAME=starter
  # * https://starter.carto.lan/user/bolt/dashboard
  #
  #   USER=dev ORGANIZATION_NAME=[none]
  # * https://dev.carto.lan/user/dev/dashobard
  #
  server_name  *.carto.lan;

  # Note that your host machine won't resolve starter.carto.lan unless
  # you add it to /etc/hosts. Run this command:
  #
  # echo "127.0.0.1 starter.carto.lan" | sudo tee -a /etc/hosts
  #
  # Then go to https://starter.carto.lan/user/bolt/login
  #
  # Subdomain URLs are only an issue for the Rails app. Carto's Maps API
  # and SQL API authenticate by token and have no need for the user or
  # org to be embedded in the URL.

  location / {
    proxy_set_header  Host  $host;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  X-Real-IP  $remote_addr;

    # Carto Builder watches for this protocal header.
    proxy_set_header  X-Forwarded-Proto  $scheme;

    # Strict-Transport-Security prevents man-in-the-middle attacks.
    # We obviously don't need that in dev, but we'll be using it in
    # production and we want the same behavior.
    add_header  Strict-Transport-Security  "max-age=31536000; includeSubDomains;";

    # 1. We assume the Rails server is listening on port 3000.
    # 2. We use "carto_builder" as the hostname. This
    #    works because that's the name in docker-compose.yaml.
    #    Docker Compose will point "carto_builder" to whatever is
    #    the IP address of Carto Builder.
    proxy_pass  http://carto_builder:3000;

    # Increase max_body_size for /api/v1/imports (data uploads)
    client_max_body_size 5000M;

    # The response time needs to include cases where we attach
    # a debugger and spend several minutes on a breakpoint.
    # Having Nginx timeout during debug sessions would get annoying.
    proxy_read_timeout  600; # seconds
  }
}

server {
  listen  443  ssl;

  server_name  *.mapsapi.lan;

  # The cert and key are "insecure" because they aren't password
  # protected and we push them into a GitHub hosted repo...
  # That's fine. We only use these certs for local dev work.
  ssl_certificate  /etc/ssl/insecure-self-signed-cert.wildcard.mapsapi.lan.pem;
  ssl_certificate_key  /etc/ssl/key.wildcard.mapsapi.lan.pem;

  # Nginx cannot write to 'access.log' and 'error.log' when
  # Docker Compose starts the container. Recreating the files would fix
  # permissions [http://stackoverflow.com/a/39019195/23566], but it is
  # easier to just use different file names:
  access_log  /var/log/nginx/nginx-access.log  proxy;
  error_log  /var/log/nginx/nginx-error.log  notice;

  # Allow large requests and responses for CartoDB.
  # TODO: Move this into the specific locations that need it.
  client_max_body_size  100M;

  # Windstream-cartodb health check endpoint.
  location ~* /api/v1/map/health {
    proxy_set_header  Host  $host;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto  $scheme;
    proxy_set_header  X-Real-IP  $remote_addr;

    rewrite  ^/api/v1/map/health$  /health  break;
    proxy_pass  http://carto_mapsapi:8181;
  }

  # Windstream-cartodb version (used by Carto Builder /diagnosis page).
  location ~* /api/v1/version {
    proxy_set_header  Host  $host;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto  $scheme;
    proxy_set_header  X-Real-IP  $remote_addr;

    rewrite  ^/api/v1/version$  /version  break;
    proxy_pass  http://carto_mapsapi:8181;
  }

  # Reverse proxy the CartoDB Maps API (Windshaft)
  location ~* /api/v1/map {
    proxy_set_header  Host  $host;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto  $scheme;
    proxy_set_header  X-Real-IP  $remote_addr;

    proxy_pass  http://carto_mapsapi:8181;
  }
}

server {
  listen  443  ssl;

  server_name  *.sqlapi.lan;

  # The cert and key are "insecure" because they aren't password
  # protected and we push them into a GitHub hosted repo...
  # That's fine. We only use these certs for local dev work.
  ssl_certificate  /etc/ssl/insecure-self-signed-cert.wildcard.sqlapi.lan.pem;
  ssl_certificate_key  /etc/ssl/key.wildcard.sqlapi.lan.pem;

  # Nginx cannot write to 'access.log' and 'error.log' when
  # Docker Compose starts the container. Recreating the files would fix
  # permissions [http://stackoverflow.com/a/39019195/23566], but it is
  # easier to just use different file names:
  access_log  /var/log/nginx/nginx-access.log  proxy;
  error_log  /var/log/nginx/nginx-error.log  notice;

  # Allow large requests and responses for CartoDB.
  # TODO: Move this into the specific locations that need it.
  client_max_body_size  100M;

  # Reverse proxy the CartoDB SQL API
  location ~* /api/v2/sql {
    proxy_set_header  Host  $host;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto  $scheme;
    proxy_set_header  X-Real-IP  $remote_addr;

    proxy_pass  http://carto_sqlapi:8080;
  }
}