53 lines
1.6 KiB
Plaintext
53 lines
1.6 KiB
Plaintext
# Host nginx for chess: browsers (web and WASM clients) call
|
|
# <origin>/chess/api/... and <origin>/chess/health, which map to the server's
|
|
# /api/... and /health. Replace <jail-address> and <port> (chessd_port,
|
|
# default 8080).
|
|
#
|
|
# chess-server keys rate limits on X-Real-IP, trusted only from the addresses
|
|
# in chessd_trusted_proxies: the address this nginx uses to reach the jail.
|
|
# $remote_addr must be the real client: with PROXY protocol in front of nginx,
|
|
# set real_ip_header proxy_protocol and set_real_ip_from for that hop.
|
|
|
|
# --- http {} context ---
|
|
upstream chess_api {
|
|
server <jail-address>:<port>;
|
|
keepalive 16;
|
|
}
|
|
|
|
# --- TLS server {} context ---
|
|
location /chess/api/ {
|
|
proxy_pass http://chess_api/api/;
|
|
proxy_http_version 1.1;
|
|
# Empty Connection header lets nginx reuse upstream keepalive connections.
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
|
|
# Long-polling holds a request up to 30 seconds.
|
|
proxy_buffering off;
|
|
proxy_read_timeout 60s;
|
|
proxy_send_timeout 60s;
|
|
|
|
# API payloads are small JSON documents.
|
|
client_max_body_size 16k;
|
|
}
|
|
|
|
location = /chess/health {
|
|
proxy_pass http://chess_api/health;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_read_timeout 10s;
|
|
}
|
|
|
|
# Everything else under /chess is not served by the API.
|
|
location = /chess {
|
|
return 404;
|
|
}
|
|
location /chess/ {
|
|
return 404;
|
|
}
|