63 lines
2.3 KiB
Text
63 lines
2.3 KiB
Text
# HTTP-only edge for «Контракт-чек» behind a front proxy (VPS layout).
|
|
# TLS is terminated by the host nginx (deploy/vps/front.conf); this edge only
|
|
# forwards to the api service. Same envsubst vars as the TLS template:
|
|
# NGINX_SERVER_NAME (expanded by the nginx Docker entrypoint).
|
|
|
|
upstream api {
|
|
server api:8000;
|
|
}
|
|
|
|
log_format contract_check '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for" '
|
|
'rt=$request_time cid=$http_x_correlation_id';
|
|
|
|
access_log /var/log/nginx/access.log contract_check;
|
|
|
|
client_max_body_size 50M;
|
|
|
|
server {
|
|
listen 80;
|
|
# IPv6 too — otherwise IPv6 clients fall through to nginx's stock
|
|
# default.conf server (static /usr/share/nginx/html → 404s).
|
|
listen [::]:80;
|
|
# `localhost` keeps the container healthcheck (Host: localhost) on this
|
|
# server instead of falling through to nginx's stock default.conf (404).
|
|
# conf.d loads contract-check.conf first, so this name wins the conflict.
|
|
server_name ${NGINX_SERVER_NAME} localhost;
|
|
|
|
location ~ ^/(healthz|readyz|metrics|api/|admin/|docs|openapi.json) {
|
|
proxy_pass http://api;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Correlation-Id $http_x_correlation_id;
|
|
|
|
proxy_connect_timeout 10s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 120s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /webhook/ {
|
|
proxy_pass http://api/api/v1/webhooks/;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
|
|
|
proxy_connect_timeout 10s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 60s;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|