flux-srl/nginx/conf.d/flux.conf

limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/s;
# Slow zone for media uploads: 5 requests per minute per IP.
limit_req_zone $binary_remote_addr zone=upload:10m rate=5r/m;

upstream nextjs {
    server app:3000;
    keepalive 32;
}

# ─────────────────────────────────────────────────────────────────────────
# CANONICAL-HOST GUARD (default_server for ports 80 + 443)
# Catches every request NOT addressed to rf-flux.com / www.rf-flux.com —
# raw-IP access (135.125.53.234), SSRF probes (Host: 169.254.169.254,
# localhost, metadata.google.internal) and the bulk of bot scans that hit
# the bare IP. Returns 444 (drop the connection, send nothing).
#
# Legitimate traffic is unaffected: the rf-flux.com server blocks below win
# because an exact server_name match always beats default_server.
# ─────────────────────────────────────────────────────────────────────────
server {
    listen 80 default_server;
    server_name _;

    # Keep ACME HTTP-01 working so certbot can still renew on any host.
    location /.well-known/acme-challenge/ { root /var/www/certbot; }

    location / { return 444; }
}

server {
    listen 443 ssl default_server;
    http2 on;
    server_name _;

    # A cert is required to complete the TLS handshake before the Host is
    # known; reuse the rf-flux.com cert, then drop. Bots hitting the IP get
    # a cert-name mismatch and a closed connection — nothing is proxied.
    ssl_certificate /etc/letsencrypt/live/rf-flux.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/rf-flux.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    return 444;
}

# Legacy domain redirect — anyone landing on lethepowerflux.com lands on
# the canonical https://www.rf-flux.com host instead. SEO-safe 301.
server {
    listen 80;
    server_name lethepowerflux.com www.lethepowerflux.com;

    return 301 https://www.rf-flux.com$request_uri;
}

server {
    listen 80;
    server_name rf-flux.com www.rf-flux.com;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    http2 on;
    client_max_body_size 500M;
    server_name rf-flux.com www.rf-flux.com;

    ssl_certificate /etc/letsencrypt/live/rf-flux.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/rf-flux.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    # ── Security headers ────────────────────────────────────────────────
    # 'unsafe-inline' / 'unsafe-eval' on script-src are required by Next.js
    # for hydration. Tightening to nonces is tracked as future work.
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; media-src 'self' blob: https:; font-src 'self' data:; connect-src 'self' https://api.openai.com https://*.upstash.io https://www.googletagmanager.com https://www.google-analytics.com https://*.google-analytics.com https://*.analytics.google.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

    # ── Scanner / exploit-probe blocking ────────────────────────────────
    # This is a Next.js app — it has no PHP, no .env/.git served over HTTP,
    # no wp-admin. Any request for those paths is a bot probing for secrets
    # or exploits. Drop them cheaply with 444 before they touch the app.
    # The patterns are scanner-specific and never match real assets
    # (.jpg/.png/.webp/.mp4/.glb/.pdf/.svg) or app routes.
    location ~* (?:\.(?:php|phtml|asp|aspx|jsp|cgi|env|sql|bak|ini|sh|yml|yaml|conf)$|/\.(?:git|env|aws|ssh|svn|hg|idea|vscode)|/(?:wp-admin|wp-login|wordpress|phpmyadmin|xmlrpc)) {
        return 444;
        access_log off;
    }

    # Next.js bundles use content hashing — safe to cache forever
    location /_next/static/ {
        proxy_pass http://nextjs;
        expires 365d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # Next.js image optimizer — short cache, browser revalidates
    location /_next/image {
        proxy_pass http://nextjs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
    }

    location /hq-command/login {
        limit_req zone=login burst=10 nodelay;
        proxy_pass http://nextjs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

# Asset uploads (large files, long timeout)
    location /api/assets {
        limit_req zone=upload burst=10 nodelay;
        client_max_body_size 500M;
        proxy_pass http://nextjs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        proxy_request_buffering off;
    }

    location /api/public-upload {
        limit_req zone=upload burst=10 nodelay;
        client_max_body_size 500M;
        proxy_pass http://nextjs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        proxy_request_buffering off;
    }   

    location /hq-command/ {
        proxy_pass http://nextjs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /api/chat {
        limit_req zone=api burst=20 nodelay;
        proxy_pass http://nextjs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection '';
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 120s;
    }

    location /api/health {
        proxy_pass http://nextjs;
        access_log off;
    }
    
    # ─────────────────────────────────────────────────────────────────
    # User-uploaded assets — served directly from disk (bypass Next.js)
    #
    # Cache strategy: short max-age + must-revalidate.
    # Browser caches for 5 minutes, then asks Nginx "did this change?"
    # via If-Modified-Since. Nginx auto-replies 304 (Not Modified) if the
    # file's mtime is unchanged, or serves the new file if it changed.
    # This means new CMS uploads appear within ~5 min without rebuild
    # AND saved bandwidth on unchanged files.
    # ─────────────────────────────────────────────────────────────────

    location /cases/ {
        alias /srv/cases/;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
        access_log off;
    }

    location /applications/ {
        alias /srv/applications/;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
        access_log off;
    }

    location /news/ {
        alias /srv/news/;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
        access_log off;
    }

    location /parts/ {
        alias /srv/parts/;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
        access_log off;
    }

    location /operations-inbox/ {
        alias /srv/operations-inbox/;
        add_header Cache-Control "private, max-age=60, must-revalidate" always;
        access_log off;
    }

    location /footage/ {
        alias /srv/footage/;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
        access_log off;
    }

    location /branding/ {
        alias /srv/branding/;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
        access_log off;
    }

    location /team/ {
        alias /srv/team/;
        add_header Cache-Control "public, max-age=300, must-revalidate" always;
        access_log off;
    }

    location / {
        proxy_pass http://nextjs;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Public-facing host + port so Next.js builds correct absolute
        # redirect URLs (without leaking the internal container port 3000).
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port 443;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Strip any leaked container port from upstream redirects, just in
        # case Next.js still builds Location headers with :3000.
        proxy_redirect ~^https?://[^/:]+:3000(/.*)$ https://$host$1;

        # ── Shared HTML cache ───────────────────────────────────────────
        # Caches GET responses that come back with a Cache-Control header
        # from Next.js (the proxy at src/proxy.ts sets s-maxage=60 on
        # public marketing pages). Authenticated requests skip the cache
        # entirely. While a cached entry is being refreshed, other
        # visitors keep getting the stale copy — no thundering herd.
        proxy_cache flux_html;
        proxy_cache_revalidate on;
        proxy_cache_min_uses 1;
        proxy_cache_lock on;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        proxy_cache_background_update on;
        proxy_cache_methods GET HEAD;
        proxy_cache_valid 200 60s;

        # Tell Nginx to ignore upstream headers that would otherwise
        # disable caching:
        # - Set-Cookie: next-intl writes a NEXT_LOCALE cookie even on
        #   public pages. Without ignoring it, Nginx refuses to cache
        #   anything that contains Set-Cookie (default behaviour).
        # - Cache-Control / Expires from upstream-internal mechanisms
        #   would compete with our s-maxage=60 logic.
        proxy_ignore_headers Set-Cookie X-Accel-Expires Expires;
        proxy_hide_header Set-Cookie;

        # Bypass cache for authenticated sessions (admin CMS or B2B portal)
        # so logged-in users always get a fresh per-account render.
        proxy_cache_bypass $cookie_flux_session $cookie_flux_b2b_session $http_pragma;
        proxy_no_cache    $cookie_flux_session $cookie_flux_b2b_session $http_pragma;

        # Surface cache status in response headers for debugging.
        # X-Cache-Status: HIT | MISS | EXPIRED | STALE | UPDATING | BYPASS
        add_header X-Cache-Status $upstream_cache_status always;
    }
}