webwallet-api-server/api.example_nginx at master · bitweb-project/webwallet-api-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
limit_req_zone $binary_remote_addr zone=bitweb_api:10m rate=300r/m;
limit_req_zone $binary_remote_addr zone=bitweb_broadcast:10m rate=20r/m;
limit_req_zone $binary_remote_addr zone=bitweb_ws:10m rate=10r/m;

server {
    server_name api.example.com;
    listen 443 ssl;

    ssl_certificate     /etc/letsencrypt/live/api.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    server_tokens off;

    if ($blocked_agent) { return 444; }
    if ($blocked_args)  { return 444; }

    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; font-src 'self' data:; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;

    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), bluetooth=()" always;

    add_header Cross-Origin-Resource-Policy "cross-origin" always;

    location = / {
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 10s;
    }

    location /static/ {
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 10s;
        expires 1d;
        access_log off;
    }

    location = /info {
        limit_req zone=bitweb_api burst=200 nodelay;
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 20s;
    }

    location = /fee {
        limit_req zone=bitweb_api burst=200 nodelay;
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 10s;
    }

    location ~ "^/balance/[a-zA-Z0-9]{25,90}$" {
        limit_req zone=bitweb_api burst=200 nodelay;
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 20s;
    }

    location ~ "^/unspent/[a-zA-Z0-9]{25,90}$" {
        limit_req zone=bitweb_api burst=200 nodelay;
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 20s;
    }

    location ~ "^/history/[a-zA-Z0-9]{25,90}$" {
        limit_req zone=bitweb_api burst=200 nodelay;
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 20s;
    }

    location ~ "^/tx/[0-9a-fA-F]{64}$" {
        limit_req zone=bitweb_api burst=200 nodelay;
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 20s;
    }

    location ~ "^/rawtx/[0-9a-fA-F]{64}$" {
        limit_req zone=bitweb_api burst=200 nodelay;
        proxy_pass         http://127.0.0.1:21223;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   Host $host;
        proxy_read_timeout 20s;
    }

    location = /broadcast {
        limit_req zone=bitweb_broadcast burst=10 nodelay;
        client_max_body_size 100k;
        proxy_pass           http://127.0.0.1:21223;
        proxy_set_header     X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header     Host $host;
        proxy_read_timeout   30s;
    }

    location /socket.io/ {
        limit_req zone=bitweb_ws burst=20 nodelay;
        proxy_pass             http://127.0.0.1:21223;
        proxy_http_version     1.1;
        proxy_set_header       Upgrade    $http_upgrade;
        proxy_set_header       Connection "upgrade";
        proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header       Host $host;
        proxy_read_timeout     3600s;
    }

    location / {
        return 444;
    }
}

server {
    listen 80;
    server_name api.example.com;
    return 301 https://$host$request_uri;
}