RomanNum3ral
/
Cybersecurity-Projects
mirror of https://github.com/CarterPerez-dev/Cybersecurity-Projects.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(canary): prod nginx proxy_pass /api/, /c/, /k/ to canary upstream 

Audit F1: prod.nginx had only the SPA fallback so all API requests, trigger
requests, and kubeconfig requests returned index.html, breaking the prod
deployment end-to-end. Added an upstream canary block to nginx.prod.conf and
three proxy_pass location blocks mirroring dev.nginx (plus CF-Connecting-IP
header since prod sits behind Cloudflare Tunnel).
This commit is contained in:
CarterPerez-dev 2026-05-17 19:07:32 -04:00
parent 5884349336
commit 20b6fc86ce
2 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
PROJECTS/beginner/canary-token-generator/infra/nginx/nginx.prod.conf
View File

@ -18,6 +18,11 @@ http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
upstream canary {
server canary:8080;
keepalive 16;
}
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
limit_req_status 429;

34
PROJECTS/beginner/canary-token-generator/infra/nginx/prod.nginx
View File

@ -28,6 +28,40 @@ server {
add_header Content-Type text/plain;
}
location /api/ {
proxy_pass http://canary;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
proxy_read_timeout 30s;
limit_req zone=api_limit burst=20 nodelay;
}
location /c/ {
proxy_pass http://canary;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
proxy_read_timeout 30s;
}
location /k/ {
proxy_pass http://canary;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
proxy_read_timeout 30s;
}
location /assets/ {
expires 1y;
add_header Cache-Control "public, immutable";