fec-proxy/nginx.conf at develop · fecgov/fec-proxy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
worker_processes auto;
daemon off;

error_log stderr;
events { worker_connections 1024; }

http {
  log_format cloudfoundry '$http_x_forwarded_for - $http_referer - [$time_local] "$request" $status $body_bytes_sent';
  access_log /dev/stdout cloudfoundry;
  default_type application/octet-stream;
  include mime.types;
  sendfile on;

  gzip on;
  gzip_disable "msie6";
  gzip_comp_level 6;
  gzip_min_length 1100;
  gzip_buffers 16 8k;
  gzip_proxied any;
  gzip_types text/plain text/css text/js text/xml text/javascript application/javascript application/x-javascript application/json application/xml application/xml+rss;

  map $http_x_forwarded_for $client_ip {
    ~^(?<first_forwarded_ip>[^,\s]+) $first_forwarded_ip;
    default $remote_addr;
  }

  geo $client_ip $rate_limited_client {
    default 0;
    include ratelimitedips.conf;
  }

  map "$rate_limited_client:$uri" $limited_route_key {
    default "";
    include ratelimitedroutes.conf;
  }

  limit_req_status 429;

  tcp_nopush on;
  include proxysettings.conf;
  # Ensure that redirects don't include the internal container PORT - {{port}}
  port_in_redirect off;
  server_tokens off;

  server {
    listen {{port}};
    server_name localhost;

    # Restrict IPs
    include blockips.conf;

    client_max_body_size 100M;
    include redirects-www.conf;
    include redirects-e-regs.conf;

    # Redirect for bulk-downloads bucket (needed this redirect here in order to access environment variable)
    rewrite ^/files/bulk-downloads/(?<bulk_download_path>.*)$ {{env "S3_LEGAL_AND_DOWNLOADS_URL"}}/bulk-downloads/$bulk_download_path redirect;

    location / {
      resolver {{nameservers}} ipv6=off valid=1s;
      set $backend "{{env "CMS_PROXY"}}";
      proxy_pass $backend;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Script-Name "/";
    }

    location ~ ^/resources/(?<resource_path>.*) {
      resolver 8.8.8.8;
      proxy_pass_request_headers off;
      proxy_pass {{env "S3_BUCKET_URL"}}/$resource_path;
    }

    location ~ ^/files/legal/rulemakings/(?<rulemaking_file_path>.*) {
      resolver 8.8.8.8;
      keepalive_timeout 180;
      proxy_pass_request_headers off;
      proxy_pass {{env "S3_LEGAL_AND_DOWNLOADS_URL"}}/legal/rulemakings/$rulemaking_file_path;
      add_header X-Frame-Options "SAMEORIGIN" always;
      add_header X-Content-Type-Options "nosniff" always;
      add_header Cache-Control "public, max-age=300" always;
    }

    location ~ ^/files/(?<file_path>.*) {
      resolver 8.8.8.8;
      keepalive_timeout 180;
      proxy_pass_request_headers off;
      proxy_pass {{env "S3_LEGAL_AND_DOWNLOADS_URL"}}/$file_path;
    }
  }

  server {
    listen {{port}};
    server_name beta.fec.gov;
    rewrite ^/(.*)$ https://www.fec.gov/$1 permanent;
  }

  server {
    listen {{port}};
    server_name transition.fec.gov;
    include redirects-transition.conf;
    location / {
      rewrite ^/(.*)$ https://www.fec.gov/$1 permanent;
    }
  }

  server {
    listen {{port}};
    server_name test-eqs.fec.gov;
    include redirects-eqs.conf;
  }

  server {
    listen {{port}};
    server_name eqs.fec.gov;
    include redirects-eqs.conf;
  }

  server {
    listen {{port}};
    server_name saos.fec.gov;
    include redirects-saos.conf;
  }

  server {
    listen {{port}};
    server_name sers.fec.gov;
    include redirects-sers.conf;
  }
}