One API gateway. Anywhere your services run.

1user www-data;2worker_processes auto;3pid /run/nginx.pid;4include /etc/nginx/modules-enabled/*.conf;5worker_rlimit_nofile 65536;6 7events {8    worker_connections 4096;9    multi_accept on;10    use epoll;11    accept_mutex off;12}13 14http {15    # Anti-indexing and security headers16    add_header X-Robots-Tag "noindex, nofollow, noarchive, nosnippet" always;17    add_header X-Frame-Options "DENY" always;18    add_header X-Environment "production" always;19 20    # Basic settings - production optimized21    sendfile on;22    tcp_nopush on;23    tcp_nodelay on;24 25    # Hash table sizes26    types_hash_max_size 4096;27    types_hash_bucket_size 128;28    server_names_hash_bucket_size 128;29    server_names_hash_max_size 2048;30 31    server_tokens off;32 33    # Memory optimizations34    open_file_cache max=10000 inactive=20s;35    open_file_cache_valid 30s;36    open_file_cache_min_uses 2;37    open_file_cache_errors on;38 39    # Client buffers and timeouts40    client_body_buffer_size 128k;41    client_header_buffer_size 4k;42    client_max_body_size 100m;43    large_client_header_buffers 8 32k;44    client_body_timeout 60;45    client_header_timeout 60;46    keepalive_timeout 120;47    send_timeout 60;48    include /etc/nginx/mime.types;49    default_type application/octet-stream;50 51    # Enhanced logging format52    log_format main '$remote_addr - $remote_user [$time_local] "$request" '53                    '$status $body_bytes_sent "$http_referer" '54                    '"$http_user_agent" "$http_x_forwarded_for" '55                    'rt=$request_time uct="$upstream_connect_time" '56                    'uht="$upstream_header_time" urt="$upstream_response_time"';57    access_log /var/log/nginx/access.log main buffer=512k flush=1m;58    error_log /var/log/nginx/error.log warn;59 60    # Gzip compression61    gzip on;62    gzip_comp_level 6;63    gzip_min_length 1024;64    gzip_proxied any;65    gzip_vary on;66    gzip_disable "msie6";67    gzip_types application/json application/xml text/css68               text/javascript image/svg+xml font/ttf;69 70    include /etc/nginx/conf.d/*.conf;71    include /etc/nginx/sites-enabled/*;72}73 74# /etc/nginx/sites-enabled/api.example.com75upstream backend_api {76    server 127.0.0.1:3000;77    keepalive 32;78}79 80server {81    server_name api.example.com;82    listen 443 ssl http2;83 84    # TLS managed by Certbot85    ssl_certificate     /etc/letsencrypt/live/api.example.com/fullchain.pem;86    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;87    include /etc/letsencrypt/options-ssl-nginx.conf;88    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;89    ssl_stapling on;90    ssl_stapling_verify on;91 92    # Security headers93    add_header Strict-Transport-Security "max-age=31536000; preload" always;94    add_header X-Content-Type-Options nosniff always;95    add_header X-XSS-Protection "1; mode=block" always;96    add_header Referrer-Policy "strict-origin-when-cross-origin" always;97 98    # Main proxy99    location / {100        proxy_pass http://backend_api;101        proxy_set_header Host $host;102        proxy_set_header X-Real-IP $remote_addr;103        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;104        proxy_set_header X-Forwarded-Proto $scheme;105        proxy_http_version 1.1;106        proxy_set_header Upgrade $http_upgrade;107        proxy_set_header Connection "upgrade";108 109        # Proxy timeouts and buffering110        proxy_connect_timeout 120s;111        proxy_send_timeout 180s;112        proxy_read_timeout 300s;113        proxy_buffering on;114        proxy_buffer_size 4k;115        proxy_buffers 8 4k;116        proxy_busy_buffers_size 8k;117 118        # Upstream resilience119        proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;120        proxy_next_upstream_timeout 120s;121        proxy_next_upstream_tries 3;122    }123 124    # Static asset caching125    location ~* \.(jpg|jpeg|png|gif|ico|css|js|pdf|txt)$ {126        expires 1y;127        add_header Cache-Control "public, immutable";128        proxy_pass http://backend_api;129    }130 131    # Health check132    location /health {133        access_log off;134        proxy_pass http://backend_api;135        proxy_connect_timeout 10s;136        proxy_send_timeout 10s;137        proxy_read_timeout 10s;138    }139 140    # Block hidden files141    location ~ /\. {142        deny all;143        access_log off;144        log_not_found off;145    }146}147 148# HTTP -> HTTPS redirect (managed by Certbot)149server {150    if ($host = api.example.com) {⋯151        return 301 https://$host$request_uri;152    }153    listen 80;154    server_name api.example.com;155    return 404;156}