site.social.conf.template

limit_req_zone $binary_remote_addr zone=sdc:32m rate=100r/m;
proxy_cache_path /var/cache/nginx levels=1:2 inactive=6h keys_zone=sdc_cache:100m;

server {

    listen 8081;
    server_name $SERVER_NAME;

    # ddos blacklist
    deny 122.8.125.184;
    deny 130.206.99.1;
    deny 177.226.255.170;
    deny 179.127.252.154;
    deny 192.119.168.147;
    deny 202.55.183.226;
    deny 202.62.17.217;
    deny 69.125.96.181;
    deny 79.173.237.10;
    deny 83.48.73.254;
    deny 89.35.44.248;
    deny 92.114.178.198;
    deny 99.197.236.213;

    # ignore csp violations
    location /api/v1/csp_violation {
        return 403;
    }

    # proxy traffic for healthcheck to the upstream without https redirect for the ELB to see a 200 on /
    location /.well-known/healthcheck.json {
      limit_req zone=sdc;
      proxy_set_header  Host $host;
      proxy_set_header  X-Real-IP $remote_addr;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  X-Forwarded-Proto $scheme;
      proxy_ignore_client_abort on;
      proxy_read_timeout 90;
      proxy_http_version 1.1;
      proxy_redirect off;
      proxy_pass  http://steemit-sdc:8080/.well-known/healthcheck.json;
    }

    add_header Strict-Transport-Security "max-age=31557600; includeSubDomains; preload" always;

    # redirect certain routes to the wallet app

    location ~* ^/@[0-9a-z\-\.]+/(transfers|curation-rewards|author-rewards|permissions|password) {
        return 301 $WALLET_URL$request_uri;
    }

    location /change_password {
        return 301 $WALLET_URL$request_uri;
    }

    location /recover_account_step_1 {
        return 301 $WALLET_URL$request_uri;
    }

    location = /market {
        return 301 $WALLET_URL$request_uri;
    }

    location /~witnesses {
        return 301 $WALLET_URL$request_uri;
    }

    location /cryptocurrency/@bitcoinminer25/youhash-cloud-mining-scam-or-legit {
        access_log off;
        return 403;
    }
    
    location /flstudio/@cracked-games/ltxziiz9 {
        access_log off;
        return 403;
    }
    
    location /music/@jneelocamacho/how-to-download-free-fl-studio-mobile {
        access_log off;
        return 403;
    }

    location /music/@therealtblgk/fl-studio-12-4-2-digital-download-for-windows-first-3-to-comment-will-get-a-free-copy {
        access_log off;
        return 403;
    }

    location /music/@therealtblgk/fl-studio-12-4-2-for-1-sbd {
        access_log off;
        return 403;
    }
    
    location /fullmovie/@marvinlox/baaghi-2-hindi-2018-full-movie-in-720p-hd-dvdrip-bluerayrip {
        access_log off;
        return 403;
    }
    
    location ~ /@unicef(/|$) {
        access_log off;
        return 403;
    }
    
    location / {
      limit_req zone=sdc burst=50;

      # rewrite http to https (ALB does the https termination)
      if ($http_x_forwarded_proto != 'https') {
        return 301 https://$server_name$request_uri;
      }

      proxy_set_header  Host $host;
      proxy_set_header  X-Real-IP $remote_addr;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  X-Forwarded-Proto $scheme;
      proxy_ignore_client_abort on;
      proxy_read_timeout 90;
      proxy_http_version 1.1;
      proxy_hide_header Strict-Transport-Security;
      add_header Strict-Transport-Security "max-age=31557600; includeSubDomains; preload" always;
      add_header 'Content-Security-Policy' 'upgrade-insecure-requests';

      proxy_cache sdc_cache;
      proxy_cache_valid 200 2m;
      proxy_cache_key $request_uri;
      proxy_cache_lock on;
      proxy_cache_lock_age 5m;
      proxy_cache_lock_timeout 5m;

      proxy_pass  http://steemit-sdc:8080;

    }
}

server {
    listen 8081;

    server_name www.$SERVER_NAME;
    return 301 https://$SERVER_NAME$request_uri;
}