nginx.conf

worker_processes 3;

events { worker_connections 1024; }

daemon off;

# NOTE: use only absolute redirects and host part $http_host,
# because nginx doesn't copy port to redirects but always adds :8080

http {

  log_format custom '$remote_addr - $remote_user [$time_local] '
                      '"$request" $status $body_bytes_sent '
                      '"$http_user_agent" $host $request_time';

  access_log /var/log/nginx/access.log custom;

  sendfile on;

  gzip              on;
  gzip_http_version 1.0;
  gzip_proxied      any;
  gzip_min_length   500;
  gzip_disable      "MSIE [1-6]\.";
  gzip_types        text/plain
                    text/xml
                    text/css
                    text/comma-separated-values
                    text/javascript
                    application/javascript
                    application/json
                    application/x-javascript
                    application/atom+xml;

  proxy_temp_path /opt/nginx/temp-cache;
  proxy_cache_path /opt/nginx/cache levels=1:2 keys_zone=tiles:10m max_size=4g inactive=7d use_temp_path=off;
  proxy_cache_path /opt/nginx/geocache levels=1:2 keys_zone=geocoding:10m max_size=4g inactive=7d use_temp_path=off;
  proxy_cache_path /opt/nginx/external-cache levels=1:2 keys_zone=ext_cache:10m max_size=1g inactive=60m use_temp_path=off;
  proxy_cache_path /opt/nginx/common levels=1:2 keys_zone=common:10m max_size=4g inactive=60m use_temp_path=off;
  proxy_cache_path /opt/nginx/sw levels=1:2 keys_zone=sw:10m max_size=200m inactive=1m use_temp_path=off;

  # in order to make it harder to crawl all the URLs  we limit the redirects endpoint to 10 requests per minute
  # https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-http/

  limit_req_zone $binary_remote_addr zone=redirect:10m rate=10r/m;

  # use the docker custom networks resolver
  # NOTE: this only works on raw docker, with custom network
  # NOTE: this does NOT work on kubernetes! _remove before kube_
  resolver 127.0.0.11 valid=30s ipv6=off;

  # API endpoints
  # These domains handle only api calls, not UI
  server {
    server_name "~^api\..*$";

    # To enable debug logging to analyse rewrite issues... uncomment next two lines
    # error_log /var/log/nginx/digitransit-error.log debug;
    # rewrite_log on;

    listen 8080;
    proxy_connect_timeout 10s;
    proxy_send_timeout 10s;
    proxy_read_timeout 20s;
    include common.conf;

    # Health check
    location / {
      root /opt/nginx/www;
      index index.html;
    }
  }

  server {
    server_name "";
    listen 8080 default_server;

    set $backend_ui "http://digitransit-ui:8080";

    location = /sw.js {
      proxy_pass         $backend_ui;
      proxy_redirect     off;
      proxy_set_header   X-Real-IP $remote_addr;
      proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header   X-Forwarded-Host $host;
      proxy_cache sw;
      proxy_cache_valid 200 30s;
      proxy_cache_lock on;
      proxy_cache_key "$host$request_uri";
      add_header X-Proxy-Cache $upstream_cache_status;
      proxy_ignore_headers X-Accel-Expires Expires Cache-Control Set-Cookie;
      proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
    }

    location / {
      proxy_pass         $backend_ui;
      proxy_redirect     off;
      proxy_set_header   X-Real-IP $remote_addr;
      proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header   X-Forwarded-Host $host;
    }
  }

  # generic www redirect rule, redirects www.site to site
  server {
    listen 8080;
    server_name "~^www\.(.*)$" ;
    return 301 $scheme://$1$request_uri ;
  }
}