nginx.conf.j2

# This file was generated by Ansible for {{ ansible_fqdn }}
# Do NOT modify this file by hand!

limit_req_zone  $binary_remote_addr  zone=one:10m   rate=3r/s;
limit_req_zone  $projectid  zone=two:10m   rate=3r/s;
limit_req_status 429;

server {

    listen     {{ sentry_port|default(80) }};
    server_name {{sentry_hostname}};

    {% if sentry_ssl_certificate %}
        ssl on;
        ssl_certificate {{ sentry_ssl_certificate }};
        ssl_certificate_key {{ sentry_ssl_certificate_key }};

        # https://wiki.mozilla.org/Security/Server_Side_TLS
        # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
        # ssl_dhparam /path/to/dhparam.pem;
        ssl_session_timeout 5m;
        ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK';
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:50m;
    {% endif %}

    access_log {{sentry_access_log}};
    error_log {{sentry_error_log}};

    proxy_set_header   Host                 $http_host;
    proxy_set_header   X-Real-IP            $remote_addr;
    proxy_set_header   X-Forwarded-For      $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Proto    $scheme;
    proxy_redirect     off;

    keepalive_timeout 0;

    proxy_read_timeout {{sentry_nginx_timeout}};
    proxy_send_timeout {{sentry_nginx_timeout}};
    send_timeout {{sentry_nginx_timeout}};
    resolver_timeout {{sentry_nginx_timeout}};
    client_body_timeout {{sentry_nginx_timeout}};

    client_max_body_size 150k;
    client_body_buffer_size 150k;

    location / {
      proxy_pass        http://{{sentry_web_host}}:{{sentry_web_port}};
    }

    location ~* /api/(?P<projectid>\d+/)?store/ {
      proxy_pass        http://{{sentry_web_host}}:{{sentry_web_port}};
      limit_req   zone=one  burst=3  nodelay;
      limit_req   zone=two  burst=10  nodelay;
    }

}