worker_processes auto;

events {
    worker_connections 4096;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    limit_req_zone $binary_remote_addr zone=api:10m rate=60r/m;

    upstream sentinel_app {
        server sentinel-app:7000;
        keepalive 128;
    }

    server {
        listen 80;
        server_name _;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl http2;
        server_name _;

        ssl_certificate     /etc/nginx/ssl/server.crt;
        ssl_certificate_key /etc/nginx/ssl/server.key;
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers off;

        client_max_body_size 32m;
        proxy_http_version 1.1;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        proxy_buffering off;

        location ^~ /admin/ui/ {
            allow 10.0.0.0/8;
            allow 192.168.0.0/16;
            allow 172.16.0.0/12;
            deny all;

            root /etc/nginx/html;
            try_files $uri $uri/ /admin/ui/index.html;
        }

        location ^~ /admin/api/ {
            allow 10.0.0.0/8;
            allow 192.168.0.0/16;
            allow 172.16.0.0/12;
            deny all;

            limit_req zone=api burst=30 nodelay;
            proxy_pass http://sentinel_app;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Connection "";
        }

        location = /health {
            proxy_pass http://sentinel_app/health;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
        }

        location / {
            limit_req zone=api burst=60 nodelay;
            proxy_pass http://sentinel_app;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Connection "";
        }
    }
}