deploy/nginx-cf.conf · gabriel/musehub

ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;

100

ssl_prefer_server_ciphers off; # TLS 1.3 ignores this; keep off for 1.2 forward secrecy

101

102

client_max_body_size 500m;

gzip on;

gzip_comp_level 5;

gzip_vary on;

# Binary types (msgpack) are excluded: already compressed, gzip adds CPU with no size gain.

108

gzip_types text/plain text/css text/javascript application/javascript

109

application/json;

110

111

# Security headers — applied to all responses from this server block.

112

# 'always' ensures they are sent on error responses (4xx, 5xx) too.

113

# Wire location blocks that define their own add_header (MCP, SSE) break

114

# inheritance intentionally — programmatic clients don't need these.

115

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

116

add_header X-Content-Type-Options "nosniff" always;

117

add_header X-Frame-Options "SAMEORIGIN" always;

118

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

119

120

# ── Healthz — dedicated fast-path, short timeout, no interference ────────────

121

location = /healthz {

122

proxy_pass http://musehub_backend;

123

proxy_http_version 1.1;

124

proxy_set_header Connection "";

125

proxy_set_header Host $host;

126

proxy_set_header X-Real-IP $remote_addr;

127

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

128

proxy_set_header X-Forwarded-Proto $scheme;

129

proxy_read_timeout 5s;

130

proxy_send_timeout 5s;

131

}

132

133

# ── MCP — bidirectional Streamable HTTP, long-lived, never buffer ──────────

134

location ~ ^/mcp(/|$) {

135

proxy_pass http://musehub_backend;

136

proxy_http_version 1.1;

137

proxy_set_header Connection "";

138

proxy_set_header Host $host;

139

proxy_set_header X-Real-IP $remote_addr;

140

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

141

proxy_set_header X-Forwarded-Proto $scheme;

142

proxy_read_timeout 3600s;

143

proxy_send_timeout 3600s;

144

proxy_request_buffering off;

145

proxy_buffering off;

146

add_header X-Accel-Buffering no always;

147

}

148

149

# ── SSE — Server-Sent Events (social feed), long-lived, never buffer ───────

150

location ~ ^/api/social/[^/]+/stream$ {

151

proxy_pass http://musehub_backend;

152

proxy_http_version 1.1;

153

proxy_set_header Connection "";

154

proxy_set_header Host $host;

155

proxy_set_header X-Real-IP $remote_addr;

156

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

157

proxy_set_header X-Forwarded-Proto $scheme;

158

proxy_read_timeout 3600s;

159

proxy_send_timeout 3600s;

160

proxy_request_buffering off;

161

proxy_buffering off;

162

add_header X-Accel-Buffering no always;

163

}

164

165

# ── Wire push — large uploads, never buffer ───────────────────────────────

166

# /push/mpack-presign — negotiate S3 presigned upload URL

167

# /push/unpack-mpack — trigger S3→uvicorn unpack

168

location ~ ^/[^/]+/[^/]+/push(/mpack-presign|/unpack-mpack)?$ {

169

proxy_pass http://musehub_backend;

170

proxy_http_version 1.1;

171

proxy_set_header Connection "";

172

proxy_set_header Host $host;

173

proxy_set_header X-Real-IP $remote_addr;

174

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

175

proxy_set_header X-Forwarded-Proto $scheme;

176

proxy_read_timeout 300s;

177

proxy_send_timeout 300s;

178

proxy_request_buffering off;

179

proxy_buffering off;

180

client_max_body_size 0;

gzip off;

}

# ── Wire fetch — responses may be large, never buffer ─────────────────────

185

# /fetch/mpack — mpack download (inline bytes or presigned S3 URL)

186

# /fetch/objects — raw object bytes

187

# /fetch/presign — negotiate S3 presigned download URL

188

location ~ ^/[^/]+/[^/]+/fetch(/mpack|/objects|/presign)?$ {

189

proxy_pass http://musehub_backend;

190

proxy_http_version 1.1;

191

proxy_set_header Connection "";

192

proxy_set_header Host $host;

193

proxy_set_header X-Real-IP $remote_addr;

194

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

195

proxy_set_header X-Forwarded-Proto $scheme;

196

proxy_read_timeout 300s;

197

proxy_send_timeout 300s;

198

proxy_request_buffering off;

199

proxy_buffering off;

200

client_max_body_size 0;

gzip off;

}

# ── Wire misc — short-lived wire ops and raw object downloads ─────────────

205

# These are authenticated wire endpoints that need more than 60s: refs,

206

# repair, tags, releases, branches, coord, and the raw object download path /o/.

207

location ~ ^(/[^/]+/[^/]+/(refs|repair-object|repair-snapshot|repair-commit|tags|releases|branches|coord)|/o/) {

208

proxy_pass http://musehub_backend;

209

proxy_http_version 1.1;

210

proxy_set_header Connection "";

211

proxy_set_header Host $host;

212

proxy_set_header X-Real-IP $remote_addr;

213

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

214

proxy_set_header X-Forwarded-Proto $scheme;

215

proxy_read_timeout 120s;

216

proxy_send_timeout 120s;

gzip off;

}

# ── Default catch-all — UI pages and JSON API ─────────────────────────────

221

# All /api/*, /{owner}/{repo_slug} UI routes, /musehub/*, /explore, etc.

222

# Standard request/response, small payloads, 60s is ample.

223

# Rate-limited: unauthenticated endpoints here are the primary abuse surface.

224

# burst=20 nodelay: absorb short bursts without queuing; excess → 429 immediately.

225

location / {

226

limit_req zone=api burst=20 nodelay;

227

proxy_pass http://musehub_backend;

228

proxy_http_version 1.1;

229

proxy_set_header Connection "";

230

proxy_set_header Host $host;

231

proxy_set_header X-Real-IP $remote_addr;

232

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

233

proxy_set_header X-Forwarded-Proto $scheme;

234

proxy_read_timeout 60s;

235

}

236

}