93 lines
3.7 KiB
Text
93 lines
3.7 KiB
Text
# HTTP-only edge for «Контракт-чек» behind a front proxy (VPS layout).
|
|
# TLS is terminated by the host nginx (deploy/vps/front.conf); this edge only
|
|
# forwards to the api service. Same envsubst vars as the TLS template:
|
|
# NGINX_SERVER_NAME (expanded by the nginx Docker entrypoint).
|
|
|
|
# Dynamic DNS resolution: when the API container is recreated it gets a new
|
|
# IP. Using a variable with proxy_pass forces nginx to re-resolve `api`
|
|
# against Docker's embedded DNS every `valid=` interval instead of caching the
|
|
# address at startup.
|
|
resolver 127.0.0.11 valid=10s;
|
|
|
|
log_format contract_check '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for" '
|
|
'rt=$request_time cid=$http_x_correlation_id';
|
|
|
|
access_log /var/log/nginx/access.log contract_check;
|
|
|
|
client_max_body_size 50M;
|
|
|
|
server {
|
|
listen 80;
|
|
# IPv6 too — otherwise IPv6 clients fall through to nginx's stock
|
|
# default.conf server (static /usr/share/nginx/html → 404s).
|
|
listen [::]:80;
|
|
# `localhost` keeps the container healthcheck (Host: localhost) on this
|
|
# server instead of falling through to nginx's stock default.conf (404).
|
|
# conf.d loads contract-check.conf first, so this name wins the conflict.
|
|
server_name ${NGINX_SERVER_NAME} localhost;
|
|
|
|
location ~ ^/(healthz|readyz|metrics|api/|admin/|docs|openapi.json) {
|
|
# Variable forces dynamic DNS resolution for `api`.
|
|
set $api http://api:8000;
|
|
proxy_pass $api;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Correlation-Id $http_x_correlation_id;
|
|
|
|
proxy_connect_timeout 10s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 120s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location /webhook/ {
|
|
# Variable forces dynamic DNS resolution for `api`.
|
|
set $api http://api:8000;
|
|
proxy_pass $api/api/v1/webhooks/;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
|
|
|
proxy_connect_timeout 10s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 60s;
|
|
}
|
|
|
|
# Grafana / Loki: exposed under /grafana so everything lives on one domain.
|
|
# In production restrict access here or via firewall (basic auth / VPN / SSO).
|
|
location /grafana/ {
|
|
# Variable forces dynamic DNS resolution for `grafana`.
|
|
set $grafana http://grafana:3000;
|
|
proxy_pass $grafana;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Correlation-Id $http_x_correlation_id;
|
|
|
|
# Grafana needs the subpath so it can build correct links/redirects.
|
|
proxy_set_header X-Forwarded-Prefix /grafana;
|
|
|
|
proxy_connect_timeout 10s;
|
|
proxy_send_timeout 30s;
|
|
proxy_read_timeout 60s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|