nginx-proxy.conf

events {
    worker_connections 1024;
}

http {
    # Rate limiting zones
    limit_req_zone $binary_remote_addr zone=nominatim:10m rate=30r/m;
    limit_req_zone $binary_remote_addr zone=tileserver_styles:10m rate=100r/s;
    limit_req_zone $binary_remote_addr zone=osrm_route:10m rate=1r/s;

    # Proxy cache configuration
    proxy_cache_path /var/cache/nginx/tiles levels=1:2 keys_zone=tiles_cache:100m max_size=10g inactive=7d use_temp_path=off;
    proxy_cache_path /var/cache/nginx/osrm levels=1:2 keys_zone=osrm_cache:50m max_size=1g inactive=1h use_temp_path=off;

    # Security headers
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    server_tokens off;

    upstream nominatim_backend {
        server nominatim:8080;
    }

    upstream tileserver_backend {
        server tileserver-gl:8082;
    }

    upstream osrm_backend {
        server osrm:8083;
    }

    upstream codepush_backend {
        server codepush-server:3000;
    }

    # Nominatim proxy on port 8080
    server {
        listen 8080;
        server_name localhost;

        location / {
            # Rate limiting: 30 requests per minute
            limit_req zone=nominatim burst=5 nodelay;
            limit_req_status 429;

            # Rate limit headers
            add_header X-RateLimit-Limit "30/minute" always;

            proxy_pass http://nominatim_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Nominatim specific settings
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;

            # Cache geocoding results briefly
            proxy_cache osrm_cache;
            proxy_cache_valid 200 5m;
            proxy_cache_valid 404 1m;
            proxy_cache_key $scheme$request_method$host$request_uri;
            add_header X-Cache-Status $upstream_cache_status always;
        }
    }

    # Tileserver proxy on port 8082
    server {
        listen 8082;
        server_name localhost;

        # High-frequency endpoints (styles, sprites, fonts)
        location /styles/ {
            # Rate limiting: 100 requests per second for styles
            limit_req zone=tileserver_styles burst=50 nodelay;
            limit_req_status 429;

            # Rate limit headers
            add_header X-RateLimit-Limit "100/second" always;

            proxy_pass http://tileserver_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Tileserver specific settings
            proxy_connect_timeout 10s;
            proxy_send_timeout 10s;
            proxy_read_timeout 10s;

            # Long-term caching for tiles - 1 week
            proxy_cache tiles_cache;
            proxy_cache_valid 200 7d;
            proxy_cache_valid 404 1h;
            proxy_cache_key $scheme$request_method$host$request_uri;
            add_header X-Cache-Status $upstream_cache_status always;

            # Cache control headers
            add_header Cache-Control "public, max-age=604800" always; # 1 week
        }

        # Tile endpoints (z/x/y.png, z/x/y.pbf, etc.)
        location ~ ^/.+/(\d+)/(\d+)/(\d+)\.(png|jpg|jpeg|webp|pbf)$ {
            # More permissive rate limiting for individual tiles
            limit_req zone=tileserver_styles burst=100 nodelay;
            limit_req_status 429;

            proxy_pass http://tileserver_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Tileserver specific settings
            proxy_connect_timeout 10s;
            proxy_send_timeout 10s;
            proxy_read_timeout 10s;

            # Very long caching for individual tiles - 1 week
            proxy_cache tiles_cache;
            proxy_cache_valid 200 7d;
            proxy_cache_valid 404 1h;
            proxy_cache_key $scheme$request_method$host$request_uri;
            add_header X-Cache-Status $upstream_cache_status always;

            # Cache control headers
            add_header Cache-Control "public, max-age=604800, immutable" always; # 1 week, immutable
        }

        # Other endpoints (metadata, fonts, sprites)
        location / {
            # Standard rate limiting for other endpoints
            limit_req zone=tileserver_styles burst=20 nodelay;
            limit_req_status 429;

            proxy_pass http://tileserver_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Tileserver specific settings
            proxy_connect_timeout 10s;
            proxy_send_timeout 10s;
            proxy_read_timeout 10s;

            # Medium-term caching for metadata
            proxy_cache tiles_cache;
            proxy_cache_valid 200 1d;
            proxy_cache_valid 404 1h;
            proxy_cache_key $scheme$request_method$host$request_uri;
            add_header X-Cache-Status $upstream_cache_status always;
        }
    }

    # OSRM proxy on port 8083
    server {
        listen 8083;
        server_name localhost;

        # Routing endpoints - very expensive operations
        location /route/ {
            # Strict rate limiting: 1 request per second per IP
            limit_req zone=osrm_route burst=2 nodelay;
            limit_req_status 429;

            # Rate limit headers
            add_header X-RateLimit-Limit "1/second" always;

            proxy_pass http://osrm_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # OSRM specific settings
            proxy_connect_timeout 10s;
            proxy_send_timeout 10s;
            proxy_read_timeout 30s;

            # Cache routing responses
            proxy_cache osrm_cache;
            proxy_cache_valid 200 15m;  # Cache successful routes for 15 minutes
            proxy_cache_valid 404 5m;   # Cache not found for 5 minutes
            proxy_cache_key $scheme$request_method$host$request_uri;
            add_header X-Cache-Status $upstream_cache_status always;
        }

        # Other OSRM endpoints (table, match, nearest, etc.)
        location / {
            # Slightly more permissive for non-routing endpoints
            limit_req zone=osrm_route burst=5 delay=3;
            limit_req_status 429;

            # Rate limit headers
            add_header X-RateLimit-Limit "1/second" always;

            proxy_pass http://osrm_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # OSRM specific settings
            proxy_connect_timeout 10s;
            proxy_send_timeout 10s;
            proxy_read_timeout 30s;

            # Cache other responses
            proxy_cache osrm_cache;
            proxy_cache_valid 200 10m;
            proxy_cache_valid 404 2m;
            proxy_cache_key $scheme$request_method$host$request_uri;
            add_header X-Cache-Status $upstream_cache_status always;
        }
    }

    # CodePush API-only proxy on port 8084 (public access)
    server {
        listen 8084;
        server_name localhost;

        # Increase client body size for app bundles
        client_max_body_size 100M;

        # Block admin panel access - return 404 to hide existence
        location ~ ^/(auth|users|apps|deployments|collaborators|sessions)/ {
            return 404;
        }

        # Block web interface static files
        location ~ \.(html|css|js|png|jpg|jpeg|gif|ico|svg)$ {
            return 404;
        }

        # Allow API endpoints for mobile clients
        location ~ ^/(updateCheck|reportStatus|reportDeploy|reportDownload) {
            proxy_pass http://codepush_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # CodePush specific settings
            proxy_connect_timeout 30s;
            proxy_send_timeout 300s;   # Large uploads
            proxy_read_timeout 300s;   # Large downloads
            proxy_request_buffering off; # Stream large uploads

            # Handle WebSocket connections for real-time updates
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            # Disable caching for API responses
            proxy_cache off;
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            add_header Expires "0";
        }

        # Allow download endpoints (can be cached)
        location /download {
            proxy_pass http://codepush_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Cache downloads for better performance
            proxy_cache_valid 200 1h;
            proxy_cache_valid 404 1m;

            # Longer timeouts for downloads
            proxy_connect_timeout 30s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
        }

        # Default deny for all other paths
        location / {
            return 404;
        }
    }

    # CodePush full access proxy on port 8085 (admin access)
    server {
        listen 8085;
        server_name localhost;

        # Increase client body size for app bundles
        client_max_body_size 100M;

        # Allow all endpoints - full CodePush server access
        location / {
            proxy_pass http://codepush_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # CodePush specific settings
            proxy_connect_timeout 30s;
            proxy_send_timeout 300s;   # Large uploads
            proxy_read_timeout 300s;   # Large downloads
            proxy_request_buffering off; # Stream large uploads

            # Handle WebSocket connections for real-time updates
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            # Disable caching for API responses
            proxy_cache off;
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            add_header Expires "0";
        }

        # Special handling for download endpoints (can be cached)
        location /download {
            proxy_pass http://codepush_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Cache downloads for better performance
            proxy_cache_valid 200 1h;
            proxy_cache_valid 404 1m;

            # Longer timeouts for downloads
            proxy_connect_timeout 30s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
        }
    }
}