nginx.conf

# /etc/nginx/sites-available/sync-backend
# Symlink: sudo ln -s /etc/nginx/sites-available/sync-backend /etc/nginx/sites-enabled/

# Rate limiting zone — 10 req/sec per IP, burst of 20
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    listen 80;
    server_name YOUR_DOMAIN_OR_IP;   # <-- replace this

    # Redirect all HTTP to HTTPS once you have SSL set up
    # Comment this block out until you run certbot
    # return 301 https://$host$request_uri;

    # ── Proxy to Node.js ──────────────────────────────────────────────────────
    location / {
        limit_req zone=api burst=20 nodelay;

        proxy_pass         http://127.0.0.1:8000;
        proxy_http_version 1.1;

        # Required for Express to see the real client IP
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;

        # Timeouts — gives Node enough time for slow DB queries without hanging forever
        proxy_connect_timeout 10s;
        proxy_send_timeout    30s;
        proxy_read_timeout    30s;

        # Buffer responses so slow clients don't hold Node connections open
        proxy_buffering    on;
        proxy_buffer_size  8k;
        proxy_buffers      8 8k;
    }

    # Block common scanner paths to save request budget
    location ~* ^/(wp-admin|\.env|\.git|phpinfo) {
        return 404;
    }

    # Nginx-level gzip (catches anything the Node compression middleware might miss)
    gzip on;
    gzip_types application/json text/plain application/javascript;
    gzip_min_length 1024;
}

# ── HTTPS block — uncomment after running certbot ─────────────────────────────
# server {
#     listen 443 ssl http2;
#     server_name YOUR_DOMAIN;
#
#     ssl_certificate     /etc/letsencrypt/live/YOUR_DOMAIN/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/YOUR_DOMAIN/privkey.pem;
#     ssl_protocols       TLSv1.2 TLSv1.3;
#     ssl_ciphers         HIGH:!aNULL:!MD5;
#
#     location / {
#         limit_req zone=api burst=20 nodelay;
#         proxy_pass         http://127.0.0.1:8000;
#         proxy_http_version 1.1;
#         proxy_set_header   Host              $host;
#         proxy_set_header   X-Real-IP         $remote_addr;
#         proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
#         proxy_set_header   X-Forwarded-Proto $scheme;
#         proxy_connect_timeout 10s;
#         proxy_send_timeout    30s;
#         proxy_read_timeout    30s;
#         proxy_buffering    on;
#         proxy_buffer_size  8k;
#         proxy_buffers      8 8k;
#     }
#
#     gzip on;
#     gzip_types application/json text/plain application/javascript;
#     gzip_min_length 1024;
#
#     location ~* ^/(wp-admin|\.env|\.git|phpinfo) {
#         return 404;
#     }
# }