diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/dev.nginx b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/dev.nginx new file mode 100644 index 00000000..931b599f --- /dev/null +++ b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/dev.nginx @@ -0,0 +1,66 @@ +# ©AngelaMos | 2026 +# dev.nginx + +server { + listen 80; + listen [::]:80; + server_name _; + + add_header Cache-Control "no-store, no-cache, must-revalidate" always; + + location /healthz { + access_log off; + return 200 "ok\n"; + add_header Content-Type text/plain; + } + + location /api/v1/ws { + proxy_pass http://backend; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_cache off; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + chunked_transfer_encoding off; + } + + location /api/ { + limit_req zone=api_limit burst=50 nodelay; + limit_conn conn_limit 20; + + proxy_pass http://backend/; + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_request_buffering off; + + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + } + + location / { + proxy_pass http://frontend_dev; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + + proxy_read_timeout 60s; + proxy_buffering off; + } +} diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/nginx.conf b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/nginx.conf new file mode 100644 index 00000000..d3250f70 --- /dev/null +++ b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/nginx.conf @@ -0,0 +1,72 @@ +# ©AngelaMos | 2026 +# nginx.conf + +worker_processes auto; +worker_rlimit_nofile 4096; + +events { + worker_connections 2048; + multi_accept on; + use epoll; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + log_format main_timed '$remote_addr - $remote_user [$time_iso8601] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" ' + 'rt=$request_time uct="$upstream_connect_time" ' + 'uht="$upstream_header_time" urt="$upstream_response_time"'; + + access_log /var/log/nginx/access.log main_timed; + error_log /var/log/nginx/error.log info; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + server_tokens off; + + client_max_body_size 2m; + client_body_buffer_size 16k; + client_header_buffer_size 4k; + large_client_header_buffers 4 16k; + + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_min_length 256; + gzip_types + application/javascript + application/json + application/manifest+json + application/xml + font/woff2 + text/css + text/plain + text/xml; + + limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/s; + limit_conn_zone $binary_remote_addr zone=conn_limit:10m; + + upstream backend { + server backend:8080; + keepalive 32; + } + + upstream frontend_dev { + server frontend:5173; + keepalive 16; + } + + include /etc/nginx/conf.d/*.conf; +} diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/nginx.prod.conf b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/nginx.prod.conf new file mode 100644 index 00000000..cee366f2 --- /dev/null +++ b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/nginx.prod.conf @@ -0,0 +1,64 @@ +# ©AngelaMos | 2026 +# nginx.prod.conf + +worker_processes auto; +worker_rlimit_nofile 8192; + +events { + worker_connections 4096; + multi_accept on; + use epoll; +} + +http { + include /etc/nginx/mime.types; + default_type application/octet-stream; + + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + log_format main_timed '$remote_addr - $remote_user [$time_iso8601] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" ' + 'rt=$request_time uct="$upstream_connect_time" ' + 'uht="$upstream_header_time" urt="$upstream_response_time"'; + + access_log /var/log/nginx/access.log main_timed buffer=32k flush=5s; + error_log /var/log/nginx/error.log warn; + + sendfile on; + tcp_nopush on; + tcp_nodelay on; + keepalive_timeout 65; + types_hash_max_size 2048; + server_tokens off; + + client_max_body_size 2m; + + gzip on; + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_min_length 256; + gzip_types + application/javascript + application/json + application/manifest+json + application/xml + font/woff2 + text/css + text/plain + text/xml; + + limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s; + limit_conn_zone $binary_remote_addr zone=conn_limit:10m; + + upstream backend { + server backend:8080; + keepalive 64; + } + + include /etc/nginx/conf.d/*.conf; +} diff --git a/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/prod.nginx b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/prod.nginx new file mode 100644 index 00000000..8a80556f --- /dev/null +++ b/PROJECTS/advanced/monitor-the-situation-dashboard/conf/nginx/prod.nginx @@ -0,0 +1,85 @@ +# ©AngelaMos | 2026 +# prod.nginx + +server { + listen 80; + listen [::]:80; + server_name _; + + root /usr/share/nginx/html; + index index.html; + + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always; + + location /healthz { + access_log off; + return 200 "ok\n"; + add_header Content-Type text/plain; + } + + location /api/v1/ws { + proxy_pass http://backend; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering off; + proxy_cache off; + proxy_read_timeout 3600s; + proxy_send_timeout 3600s; + chunked_transfer_encoding off; + } + + location /api/ { + limit_req zone=api_limit burst=20 nodelay; + limit_conn conn_limit 50; + + proxy_pass http://backend/; + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_buffering on; + proxy_buffers 8 32k; + proxy_buffer_size 4k; + + proxy_connect_timeout 60s; + proxy_send_timeout 30s; + proxy_read_timeout 30s; + } + + location /assets/ { + expires 1y; + add_header Cache-Control "public, immutable"; + access_log off; + try_files $uri =404; + } + + location ~* \.(jpg|jpeg|png|gif|ico|svg|webp|avif|woff|woff2|ttf|eot|otf)$ { + expires 1y; + add_header Cache-Control "public, immutable"; + access_log off; + } + + location / { + add_header Cache-Control "no-cache, must-revalidate"; + try_files $uri $uri/ /index.html; + } + + location ~ /\. { + deny all; + access_log off; + log_not_found off; + } +}