nginx.conf.template

worker_processes auto;

events {
    worker_connections 4096;
    multi_accept on;
}

http {
    resolver ${DNS_RESOLVER} valid=30s ipv6=off;
    resolver_timeout 5s;
    keepalive_timeout 65s;
    keepalive_requests 10000;

    # Extract the left-most X-Forwarded-For IP (original client) when present.
    map $http_x_forwarded_for $client_ip_for_security {
        default $remote_addr;
        "~^\s*([^,\s]+)" $1;
    }

    # Block common automated probing paths before they reach the upstream.
    map $request_uri $is_probe_request {
        default 0;
        ~*(?:^|/).*\.(?:php\d*|phtml|phar|asp|aspx|jsp|cgi|pl)(?:$|[/?]) 1;
        ~*(?:^|/)(?:wp-admin|wp-login\.php|xmlrpc\.php|wlwmanifest\.xml|phpmyadmin|pma|adminer|cgi-bin|vendor/phpunit)(?:$|[/?]) 1;
        ~*(?:^|/)wp-(?:content|includes)(?:$|[/?]) 1;
        ~*(?:^|/)\.(?:env|git|svn|hg|DS_Store)(?:$|[/?]) 1;
        ~*(?:\.\./|etc/passwd|proc/self/environ|php://|auto_prepend_file|allow_url_include|%00) 1;
    }

    # Generated at container startup from /logs/whitelist.txt (one IP per line).
    map $client_ip_for_security $is_whitelisted_ip {
        default 0;
        include /etc/nginx/whitelisted-ips*.map;
    }

    # Generated at container startup from /logs/blocked.txt (one IP per line).
    map $client_ip_for_security $is_blocked_ip {
        default 0;
        include /etc/nginx/blocked-ips*.map;
    }

    # Whitelist wins over blocklist and probe detection.
    map "$is_whitelisted_ip:$is_blocked_ip" $should_block_ip {
        default 0;
        "0:1" 1;
    }
    map "$is_whitelisted_ip:$is_probe_request" $should_block_probe {
        default 0;
        "0:1" 1;
    }

    log_format cache '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for" '
                        '$upstream_cache_status $request_time $upstream_response_time';
    log_format hack '$time_iso8601 client_ip="$client_ip_for_security" '
                    'remote_addr="$remote_addr" xff="$http_x_forwarded_for" '
                    'request="$request" status=$status host="$host" '
                    'ua="$http_user_agent"';

    access_log /dev/stdout cache;
    access_log /var/log/nginx/cache-access.log cache;
    access_log /logs/hacks/probes.log hack if=$should_block_probe;
    access_log /logs/hacks/blocked.log hack if=$should_block_ip;
    error_log /dev/stderr warn;

    proxy_cache_path /var/cache/nginx/owlery levels=1:2 keys_zone=owlery_cache:100m max_size=${CACHE_MAX_SIZE} inactive=5y use_temp_path=off;

    proxy_cache_key "$request_method$request_uri";
    proxy_cache_min_uses 1;
    proxy_cache_revalidate on;
    proxy_cache_methods GET HEAD;
    map $request_uri $force_refresh {
        default ${FORCE_CACHE_REFRESH_ON_REQUEST};
    }

    proxy_cache_valid 200 ${CACHE_STALE_TIME};
    proxy_cache_valid 400 ${CACHE_STALE_TIME};
    proxy_cache_valid 404 600s;

    proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504 http_404;
    proxy_cache_background_update on;
    proxy_cache_lock on;
    proxy_cache_lock_timeout 30s;
    proxy_cache_lock_age 120s;

    server {
        listen 80;

        if ($should_block_ip) {
            return 403;
        }

        if ($should_block_probe) {
            return 403;
        }

        location = /status {
            access_log off;
            default_type application/json;
            add_header Cache-Control "no-store" always;
            alias /var/run/nginx/status.json;
        }

        location = /__nginx_status {
            access_log off;
            stub_status;
            allow 127.0.0.1;
            allow ::1;
            deny all;
        }

        location /health {
            access_log off;
            return 200 "OK\n";
            add_header Content-Type text/plain;
        }

        location /blog/ {
            return 301 https://virtualflybrain.org$request_uri;
        }

        location / {
            set $backend "${UPSTREAM_SERVER}";
            proxy_pass http://$backend$request_uri;
            # Keep fetching from upstream even if the client/proxy in front disconnects.
            proxy_ignore_client_abort on;
            # Ensure full response buffering so completed upstream responses can be cached.
            proxy_buffering on;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            # Fail fast when the upstream is unreachable; long-running work is in read/send.
            proxy_connect_timeout 5s;
            proxy_read_timeout 6h;
            proxy_send_timeout 6h;
            proxy_socket_keepalive on;
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_next_upstream_timeout 20s;
            proxy_next_upstream_tries 3;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            add_header X-Cache-Status $upstream_cache_status;
            add_header X-Cache-Key "$request_method$request_uri";
            proxy_ignore_headers Cache-Control Expires Set-Cookie;
            proxy_cache_bypass $force_refresh;
            proxy_cache owlery_cache;
        }
    }

    server {
        listen 8080;

        if ($should_block_ip) {
            return 403;
        }

        if ($should_block_probe) {
            return 403;
        }

        location = /status {
            access_log off;
            default_type application/json;
            add_header Cache-Control "no-store" always;
            alias /var/run/nginx/status.json;
        }

        location = /__nginx_status {
            access_log off;
            stub_status;
            allow 127.0.0.1;
            allow ::1;
            deny all;
        }

        location /health {
            access_log off;
            return 200 "OK\n";
            add_header Content-Type text/plain;
        }

        location /blog/ {
            return 301 https://virtualflybrain.org$request_uri;
        }

        location / {
            set $backend "${UPSTREAM_SERVER}";
            proxy_pass http://$backend$request_uri;
            # Keep fetching from upstream even if the client/proxy in front disconnects.
            proxy_ignore_client_abort on;
            # Ensure full response buffering so completed upstream responses can be cached.
            proxy_buffering on;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            # Fail fast when the upstream is unreachable; long-running work is in read/send.
            proxy_connect_timeout 5s;
            proxy_read_timeout 6h;
            proxy_send_timeout 6h;
            proxy_socket_keepalive on;
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_next_upstream_timeout 20s;
            proxy_next_upstream_tries 3;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            add_header X-Cache-Status $upstream_cache_status;
            add_header X-Cache-Key "$request_method$request_uri";
            proxy_ignore_headers Cache-Control Expires Set-Cookie;
            proxy_cache_bypass $force_refresh;
            proxy_cache owlery_cache;
        }
    }
}