144 lines
4.0 KiB
Plaintext
144 lines
4.0 KiB
Plaintext
# ServiceManager Nginx Configuration
|
|
|
|
upstream backend_api {
|
|
server backend:8000;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream client_frontend {
|
|
server frontend-client:3000;
|
|
keepalive 32;
|
|
}
|
|
|
|
upstream internal_frontend {
|
|
server frontend-internal:3000;
|
|
keepalive 32;
|
|
}
|
|
|
|
# Client Portal (clientes.servicemanager.local o puerto 3000)
|
|
server {
|
|
listen 80;
|
|
server_name clientes.servicemanager.local;
|
|
|
|
location / {
|
|
proxy_pass http://client_frontend;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection 'upgrade';
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_cache_bypass $http_upgrade;
|
|
proxy_read_timeout 86400;
|
|
}
|
|
}
|
|
|
|
# Internal Portal (admin.servicemanager.local o puerto 3001)
|
|
server {
|
|
listen 80;
|
|
server_name admin.servicemanager.local;
|
|
|
|
location / {
|
|
proxy_pass http://internal_frontend;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection 'upgrade';
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_cache_bypass $http_upgrade;
|
|
proxy_read_timeout 86400;
|
|
}
|
|
}
|
|
|
|
# API Backend (api.servicemanager.local o puerto 8000)
|
|
server {
|
|
listen 80;
|
|
server_name api.servicemanager.local;
|
|
|
|
# API endpoints con rate limiting
|
|
location /v1/ {
|
|
limit_req zone=api burst=20 nodelay;
|
|
|
|
proxy_pass http://backend_api;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 300;
|
|
proxy_connect_timeout 30;
|
|
proxy_send_timeout 300;
|
|
}
|
|
|
|
# Auth endpoints con rate limiting más estricto
|
|
location /v1/auth/ {
|
|
limit_req zone=login burst=10 nodelay;
|
|
|
|
proxy_pass http://backend_api;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# Health check
|
|
location /health {
|
|
proxy_pass http://backend_api;
|
|
access_log off;
|
|
}
|
|
|
|
# OpenAPI docs
|
|
location ~ ^/(docs|openapi\.json|redoc) {
|
|
proxy_pass http://backend_api;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# Static files (uploads)
|
|
location /uploads/ {
|
|
alias /var/www/uploads/;
|
|
expires 1h;
|
|
add_header Cache-Control "public, immutable";
|
|
|
|
# Validar que el usuario tenga permisos (implementar en backend)
|
|
auth_request /auth;
|
|
}
|
|
|
|
# Auth subrequest para archivos protegidos
|
|
location = /auth {
|
|
internal;
|
|
proxy_pass http://backend_api/v1/auth/validate;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
proxy_set_header X-Original-URI $request_uri;
|
|
}
|
|
}
|
|
|
|
# Default server (localhost - desarrollo)
|
|
server {
|
|
listen 80 default_server;
|
|
server_name _;
|
|
|
|
# Redirect to appropriate frontend based on path
|
|
location /admin {
|
|
return 301 http://localhost:3001/;
|
|
}
|
|
|
|
location /api/ {
|
|
proxy_pass http://backend_api/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location / {
|
|
return 301 http://localhost:3000/;
|
|
}
|
|
} |