# /etc/nginx/vhosts.d/rekopub.monoexp.com.conf
#
# ReKoPub's website and downloads, published by the deploy pipeline
# (bajdev/devops, kind "cli") on every merge into bajdev/ReKoPub main.
# The converter form's requests (/api/) and the books it makes (/books/) go
# to rekopub-web (goapp@rekopub-web, 127.0.0.1:8004), which runs the
# rekopub command. Port 80 (ACME challenges and the HTTP->HTTPS redirect)
# is handled by the `.monoexp.com` block in 00-default.conf.

# A first line of defence for the converter: per client address, at most
# 6 conversion requests a minute, with a burst of 5. rekopub-web has the
# real limits (50 for everyone and 10 per visitor in 15 minutes).
limit_req_zone $binary_remote_addr zone=rekopub_convert:1m rate=6r/m;
limit_req_zone $binary_remote_addr zone=rekopub_api:1m rate=60r/m;

server {
    listen 443 ssl; listen [::]:443 ssl;
    server_name rekopub.monoexp.com;
    ssl_certificate     /etc/letsencrypt/live/rekopub.monoexp.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/rekopub.monoexp.com/privkey.pem;
    include snippets/tls-common.conf;

    root /srv/www/vhosts/rekopub.monoexp.com;
    index index.html;

    location / { try_files $uri $uri/ =404; }

    # The download names stay the same from one version to the next, so
    # browsers must check for a newer file every time.
    location /download/ { expires -1; }

    # Short cache for the stylesheet, script and icon; HTML keeps nginx's
    # defaults.
    location ~* \.(css|js|svg)$ { expires 1h; }

    # The converter. The form is a few hundred bytes; a conversion can take
    # a few minutes (two runs of up to 2 minutes each for "Both", plus up to
    # a minute waiting for a free slot).
    location = /api/convert {
        limit_req zone=rekopub_convert burst=5 nodelay;
        limit_req_status 429;
        client_max_body_size 8k;
        proxy_read_timeout 330s;
        include snippets/proxy.conf;
        proxy_pass http://127.0.0.1:8004;
    }
    location = /api/status {
        limit_req zone=rekopub_api burst=20 nodelay;
        limit_req_status 429;
        include snippets/proxy.conf;
        proxy_pass http://127.0.0.1:8004;
    }
    location /api/ { return 404; }

    # Finished books: random 128-bit folder names, deleted after 24 hours.
    location /books/ {
        limit_req zone=rekopub_api burst=20 nodelay;
        limit_req_status 429;
        include snippets/proxy.conf;
        proxy_pass http://127.0.0.1:8004;
    }
}