blog-nest/infra/nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
  worker_connections 2048;
  use epoll;
}

http {
  include /etc/nginx/mime.types;
  default_type application/octet-stream;

  # Logging
  log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';

  access_log /var/log/nginx/access.log main;

  # Performance
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;
  keepalive_timeout 65;
  types_hash_max_size 2048;
  client_max_body_size 20M;

  # Gzip compression
  gzip on;
  gzip_vary on;
  gzip_min_length 1000;
  gzip_proxied any;
  gzip_types text/plain text/css text/xml text/javascript 
             application/x-javascript application/xml+rss 
             application/javascript application/json;

  # Cache
  proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=blog_cache:10m max_size=1g inactive=60m;
  proxy_cache_key "$scheme$request_method$host$request_uri";

  # Security headers
  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header X-XSS-Protection "1; mode=block" always;
  add_header Referrer-Policy "no-referrer-when-downgrade" always;
  add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

  # Rate limiting
  limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;
  limit_req_zone $binary_remote_addr zone=web_limit:10m rate=50r/s;

  # Upstream services
  upstream api_backend {
    least_conn;
    server api:3000 max_fails=3 fail_timeout=30s;
    keepalive 32;
  }

  upstream frontend_server {
    least_conn;
    server frontend:3001 max_fails=3 fail_timeout=30s;
    keepalive 32;
  }

  # Health check endpoint
  server {
    listen 8080;
    location /health {
      access_log off;
      return 200 "healthy\n";
      add_header Content-Type text/plain;
    }
  }

  # HTTP to HTTPS redirect
  server {
    listen 80;
    server_name _;
    
    # Let's Encrypt ACME challenge
    location /.well-known/acme-challenge/ {
      root /var/www/certbot;
    }

    # Redirect all other traffic to HTTPS
    location / {
      return 301 https://$host$request_uri;
    }
  }

  # HTTPS server
  server {
    listen 443 ssl http2;
    server_name _;

    # SSL certificates (replace with your domain)
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;

    # SSL security
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_stapling on;
    ssl_stapling_verify on;

    # Root location - frontend
    location / {
      limit_req zone=web_limit burst=20 nodelay;
      proxy_pass http://frontend_server;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_redirect off;
      proxy_buffering off;
    }

    # Next.js static assets - cache aggressively
    location /_next/static/ {
      proxy_pass http://frontend_server;
      proxy_cache blog_cache;
      proxy_cache_valid 200 365d;
      proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
      add_header Cache-Control "public, max-age=31536000, immutable";
    }

    # Public assets - cache for long time
    location /public/ {
      proxy_pass http://frontend_server;
      proxy_cache blog_cache;
      proxy_cache_valid 200 1d;
      add_header Cache-Control "public, max-age=86400";
    }

    # API endpoints
    location /api/ {
      limit_req zone=api_limit burst=50 nodelay;
      proxy_pass http://api_backend;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Connection "";
      proxy_buffering off;
      
      # API caching (optional - exclude for dynamic content)
      proxy_cache blog_cache;
      proxy_cache_valid 200 5m;
      proxy_cache_methods GET HEAD;
      add_header X-Cache-Status $upstream_cache_status;
    }

    # Health check endpoint (internal only)
    location /health {
      access_log off;
      return 200 "healthy\n";
      add_header Content-Type text/plain;
    }
  }
}