M48: harden demo operations and offsite recovery

2026-08-21 22:17:49 +02:00
parent a24098c583
commit 00191e9b54
28 changed files with 1136 additions and 332 deletions
@@ -0,0 +1,58 @@
+resolver 127.0.0.11 valid=2s ipv6=off;
+limit_req_zone $binary_remote_addr zone=demo_login:10m rate=600r/m;
+
+upstream fleet_ops_web {
+  zone fleet_ops_web 64k;
+  server web:80 resolve max_fails=1 fail_timeout=2s;
+  keepalive 32;
+}
+
+upstream fleet_ops_api {
+  zone fleet_ops_api 64k;
+  server api:8000 resolve max_fails=1 fail_timeout=2s;
+  keepalive 32;
+}
+
+server {
+  listen 80;
+  server_name _;
+  server_tokens off;
+
+  location = /api/v1/demo/login {
+    limit_req zone=demo_login burst=100 nodelay;
+    proxy_pass http://fleet_ops_api;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
+  location /api/ {
+    proxy_pass http://fleet_ops_api;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+
+  location /health {
+    proxy_pass http://fleet_ops_api/health;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+  }
+
+  location / {
+    proxy_pass http://fleet_ops_web;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_next_upstream error timeout http_502 http_503 http_504;
+    proxy_next_upstream_tries 3;
+    proxy_next_upstream_timeout 3s;
+    proxy_connect_timeout 1s;
+  }
+}