nginx: prevent ddos main page

nginx.conf: add resolver

config/http/nginx.conf

@@ -15,6 +15,13 @@ http {
     include                    /etc/nginx/mime.types;
     default_type               application/octet-stream;
 
+
+    limit_req_zone             $binary_remote_addr zone=req_limit_per_ip:10m rate=10r/s;
+    limit_conn_zone            $binary_remote_addr zone=conn_limit_per_ip:20m;
+    limit_conn_status          429;
+    
+    limit_req_zone             $binary_remote_addr zone=req_limit_page:5m rate=1r/s;
+
     log_format                 main '$remote_addr - $remote_user [$time_local] "$request" '
     '$status                   $body_bytes_sent "$http_referer" '
     '"$http_user_agent"        "$http_x_forwarded_for"';

config/include/csp.conf

@@ -1,10 +0,0 @@
-set $CSP_UPGRADE_INSECURE_REQUESTS "upgrade-insecure-requests;";
-set $CSP_DEFAULT_SRC "default-src https: wss: data: blob: 'self';";
-set $CSP_BASE_URI "base-uri 'self';";
-set $CSP_CONNECT_SRC "connect-src 'self' *.evoleasing.ru wss:;";
-set $CSP_WORKER_SRC "worker-src 'self' blob:;";
-set $CSP_FONT_SRC "font-src 'self' fonts.gstatic.com fonts.googleapis.com;";
-set $CSP_SCRIPT_SRC "script-src 'self';";
-set $CSP_STYLE_SRC "style-src 'self' 'unsafe-inline' fonts.googleapis.com;";
-set $CSP_OBJECT_SRC "object-src 'none';";
-set $CSP_FRAME_ANCESTORS "frame-ancestors 'none';";

config/include/headers.conf

@@ -1,5 +0,0 @@
- proxy_http_version 1.1;
- proxy_set_header   Upgrade $http_upgrade;
- proxy_set_header   Connection 'upgrade';
- proxy_set_header   Host $host;
- proxy_cache_bypass $http_upgrade;

config/include/robots.conf

@@ -1,4 +0,0 @@
-location /robots.txt {
-    default_type  text/plain;
-    return        200 "User-agent: *\nDisallow: /";
-}

config/include/security-headers.conf

@@ -1,5 +0,0 @@
- add_header Content-Security-Policy "$CSP_UPGRADE_INSECURE_REQUESTS $CSP_DEFAULT_SRC $CSP_BASE_URI $CSP_CONNECT_SRC $CSP_WORKER_SRC $CSP_FONT_SRC $CSP_SCRIPT_SRC $CSP_STYLE_SRC $CSP_OBJECT_SRC $CSP_FRAME_ANCESTORS";
- add_header X-Frame-Options SAMEORIGIN;
- add_header X-Content-Type-Options nosniff;
- add_header Referrer-Policy no-referrer-when-downgrade;
- add_header Strict-Transport-Security "max-age=31536000; includeSubDomains;";

config/nginx.auth.conf

@@ -21,11 +21,13 @@ upstream app {
 server {
     listen                       80;
     include                      /etc/nginx/mime.types;
-    include                      /etc/nginx/include/csp.conf;
-    proxy_set_header             auth-mode $AUTH_MODE;
-    proxy_set_header             refresh-token $REFRESH_TOKEN;
 
-    error_page                   401 /login/$AUTH_MODE;
+
+    limit_req                    zone=req_limit_per_ip burst=30;
+    limit_conn                   conn_limit_per_ip 30;
+
+
+    error_page                   401 /login;
 
 
     location = /auth {
@@ -35,39 +37,44 @@ server {
 
         proxy_pass_request_body  off;
         proxy_set_header         Content-Length "";
-        proxy_set_header         X-Original-URI $request_uri;
-        proxy_intercept_errors   on;
-
-        proxy_set_header         auth-mode $AUTH_MODE;
         proxy_set_header         refresh-token $REFRESH_TOKEN;
+        proxy_set_header         auth-mode $AUTH_MODE;
+        proxy_intercept_errors   on;
     }
 
     location /login {
         proxy_pass               $login_proxy;
-
-        include                  /etc/nginx/include/security-headers.conf;
     }
 
-    location ~ ^/(logout|get-user|login-telegram|login-confirm|refresh-token)$ {
+    location ~ ^/(logout|get-user)$ {
         proxy_pass               http://auth_api/$AUTH_MODE/$1;
-        proxy_set_header         auth-mode $AUTH_MODE;
-        proxy_set_header         refresh-token $REFRESH_TOKEN;
+    }
+
+    location = / {
+        limit_req                zone=req_limit_page burst=1 nodelay;
+
+        proxy_pass               http://app;
+
+        proxy_http_version       1.1;
+        proxy_set_header         Upgrade $http_upgrade;
+        proxy_set_header         Connection 'upgrade';
+        proxy_set_header         Host $host;
+        proxy_cache_bypass       $http_upgrade;
+
+        include                  /etc/nginx/include/auth.conf;
     }
 
     location / {
         proxy_pass               http://app;
 
-        include                  /etc/nginx/include/headers.conf;
-        include                  /etc/nginx/include/auth.conf;
-        include                  /etc/nginx/include/security-headers.conf;
-    }
+        proxy_http_version       1.1;
+        proxy_set_header         Upgrade $http_upgrade;
+        proxy_set_header         Connection 'upgrade';
+        proxy_set_header         Host $host;
+        proxy_cache_bypass       $http_upgrade;
 
-    location /socket.io/ {
-        proxy_pass               http://auth_api/socket.io/;
-
-        include                  /etc/nginx/include/headers.conf;
         include                  /etc/nginx/include/auth.conf;
-        include                  /etc/nginx/include/security-headers.conf;
+
     }
 
     location = /health {

config/nginx.exposed.conf

@@ -1,26 +0,0 @@
- include                    /etc/nginx/include/upstream.conf;
-
-
-server {
-    listen                  80;
-    include                 /etc/nginx/mime.types;
-    
-    location / {
-        proxy_pass          $APPLICATION;
-
-        proxy_http_version  1.1;
-        proxy_set_header    Upgrade $http_upgrade;
-        proxy_set_header    Connection 'upgrade';
-        proxy_set_header    Host $host;
-        proxy_cache_bypass  $http_upgrade;
-    }
-
-    location = /health {
-        access_log          off;
-        add_header          'Content-Type' 'application/json';
-        return              200 'UP';
-    }
-
-    include /etc/nginx/include/location.conf;
-    include /etc/nginx/include/robots.conf;
-}

config/nginx.off.conf

@@ -8,7 +8,9 @@ upstream app {
 server {
     listen                  80;
     include                 /etc/nginx/mime.types;
-    include                 /etc/nginx/include/csp.conf;
+
+    limit_req               zone=req_limit_per_ip burst=30;
+    limit_conn              conn_limit_per_ip 30;
 
     location / {
         proxy_pass          http://app;
@@ -18,8 +20,6 @@ server {
         proxy_set_header    Connection 'upgrade';
         proxy_set_header    Host $host;
         proxy_cache_bypass  $http_upgrade;
-
-        include             /etc/nginx/include/security-headers.conf;
     }
 
     location = /health {

docker-compose.auth.expose.yml

@@ -1,27 +0,0 @@
-version: '3'
-
-services:
-  server:
-    ports:
-      - '${PORT_EXPOSE}:80'
-    image: nginx:alpine
-    environment:
-      - APPLICATION=${APPLICATION}
-      - AUTH_MODE=${AUTH_MODE}
-      - REFRESH_TOKEN=${REFRESH_TOKEN}
-    volumes:
-      - ./config/nginx.auth.conf:/etc/nginx/templates/default.conf.template
-      - ./config/include:/etc/nginx/include
-      - ./config/http/nginx.conf:/etc/nginx/nginx.conf
-    restart: always
-    networks:
-      - auth_network
-      - app_network
-
-networks:
-  auth_network:
-    external:
-      name: auth_network
-  app_network:
-    external:
-      name: ${NETWORK_NAME}

docker-compose.exposed.yml

@@ -1,19 +0,0 @@
-version: '3'
-
-services:
-  server:
-    extends:
-      file: docker-compose.traefik.yml
-      service: server
-    image: nginx:alpine
-    environment:
-      - APPLICATION=${APPLICATION}
-    volumes:
-      - ./config/nginx.exposed.conf:/etc/nginx/templates/default.conf.template
-      - ./config/include:/etc/nginx/include
-      - ./config/http/nginx.conf:/etc/nginx/nginx.conf
-    restart: always
-
-networks:
-  web:
-    external: true