83 lines
2.7 KiB
Plaintext
83 lines
2.7 KiB
Plaintext
# Nginx Configuration for Hermes Service
|
|
# This configuration provides reverse proxy with IP and API key validation
|
|
|
|
upstream hermes_service {
|
|
server 127.0.0.1:9120;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name your-domain.com; # Replace with your actual domain or IP
|
|
|
|
# Security headers
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header X-Frame-Options DENY;
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
|
|
# Health check endpoint (no authentication required)
|
|
location = /health {
|
|
proxy_pass http://hermes_service;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# Status endpoint (no authentication required, optional)
|
|
location = /api/v1/status {
|
|
proxy_pass http://hermes_service;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# All other API endpoints require authentication
|
|
location /api/v1/ {
|
|
# IP restriction at Nginx level (optional, can also be handled by hermes-service)
|
|
# allow 192.168.1.0/24;
|
|
# allow 10.0.0.0/8;
|
|
# deny all;
|
|
|
|
# API Key validation at Nginx level (optional, can also be handled by hermes-service)
|
|
# if ($http_x_api_key != "your-api-key-here") {
|
|
# return 401 "Invalid API key";
|
|
# }
|
|
|
|
proxy_pass http://hermes_service;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Timeout settings
|
|
proxy_connect_timeout 60s;
|
|
proxy_send_timeout 300s;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
# Root location - you might want to serve a web UI here
|
|
location / {
|
|
# If you have a web UI, serve it here
|
|
# root /path/to/web/ui;
|
|
# index index.html;
|
|
|
|
# Or redirect to API documentation
|
|
return 404 "Hermes Service API - use /api/v1 endpoints";
|
|
}
|
|
|
|
# Logging
|
|
access_log /var/log/nginx/hermes-service-access.log;
|
|
error_log /var/log/nginx/hermes-service-error.log;
|
|
}
|
|
|
|
# SSL Configuration (recommended for production)
|
|
# server {
|
|
# listen 443 ssl http2;
|
|
# server_name your-domain.com;
|
|
#
|
|
# ssl_certificate /path/to/certificate.crt;
|
|
# ssl_certificate_key /path/to/private.key;
|
|
#
|
|
# # ... rest of the configuration same as above ...
|
|
# } |