Skip to content

Commit f7fa691

Browse files
FancMa01FancMa01
authored
Merge pull request #1031 from hpcc-systems/yadhap/nginx-ddos-protection
Added DDoS protection to Nginx config
2 parents cb2919e + 088fe43 commit f7fa691

File tree

2 files changed

+103
-49
lines changed

2 files changed

+103
-49
lines changed

‎Tombolo/client-reactjs/nginx/conf.d/nginx.conf.template-no-ssl

+50-23
Original file line numberDiff line numberDiff line change
@@ -1,57 +1,84 @@
1+
# Rate limiting zone for DDoS protection (limits to 10 req/s per IP)
2+
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;
3+
4+
# Connection limiting zone for DDoS protection
5+
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
6+
7+
# Main HTTP server
18
server {
2-
listen 80;
3-
server_name $HOSTNAME;
9+
listen 80; # Listens on port 80 (HTTP, no SSL)
10+
server_name $HOSTNAME; # Dynamic hostname variable
11+
12+
# DDoS protection
13+
limit_req zone=mylimit burst=20 nodelay; # Limits HTTP floods
14+
limit_conn conn_limit 50; # Caps connections per IP
15+
limit_conn_log_level warn; # Logs exceeded limits
16+
client_body_timeout 10s; # Drops slow body sends
17+
client_header_timeout 10s; # Drops slow header sends
18+
keepalive_timeout 5s; # Closes idle connections
19+
send_timeout 10s; # Limits response time
20+
client_max_body_size 2m; # Caps request size
21+
22+
# Security headers
423
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
524
add_header X-XSS-Protection "1; mode=block";
625
add_header X-Permitted-Cross-Domain-Policies "none";
726
add_header X-Frame-Options "deny";
8-
#add_header Access-Control-Allow-Origin "domain";
9-
add_header Access-Control-Allow-Origin https://${DOLLAR}server_name;
27+
#add_header Access-Control-Allow-Origin "domain"; # Commented out in original
28+
add_header Access-Control-Allow-Origin https://$server_name;
1029
add_header X-Content-Type-Options "nosniff";
1130
add_header Content-Security-Policy "script-src 'self'; object-src 'self'; worker-src 'self' blob:;";
1231
add_header Cache-Control "no-store";
1332
add_header Pragma "no-cache";
33+
34+
# Logging
1435
error_log /var/log/nginx/tombolo-error.log;
1536
access_log /var/log/nginx/tombolo-access.log;
37+
38+
# Static files
1639
location / {
17-
proxy_set_header X-Real-IP ${DOLLAR}remote_addr;
18-
proxy_set_header X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
19-
proxy_set_header Host ${DOLLAR}http_host;
40+
limit_req zone=mylimit burst=20 nodelay; # Rate limit for this location
41+
proxy_set_header X-Real-IP $remote_addr;
42+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
43+
proxy_set_header Host $http_host;
2044
proxy_hide_header X-Powered-By;
2145
expires -1;
22-
23-
root /usr/share/nginx/html;
24-
index index.html index.htm;
25-
try_files ${DOLLAR}uri ${DOLLAR}uri/ /index.html;
46+
root /usr/share/nginx/html;
47+
index index.html index.htm;
48+
try_files $uri $uri/ /index.html;
2649
}
2750

51+
# API proxy
2852
location /api {
53+
limit_req zone=mylimit burst=50 nodelay; # Higher burst for API
2954
proxy_pass http://node:3000;
3055
proxy_set_header X-Frame-Options "deny";
3156
proxy_hide_header X-Powered-By;
3257
}
3358

34-
# Location block for SSE at /api/addClusterWithProgress
59+
# SSE for clustering progress
3560
location /api/cluster/addClusterWithProgress {
36-
proxy_pass http://node:3000; # Pass to your Node.js server
37-
proxy_set_header Connection keep-alive;
38-
proxy_buffering off; # Disable buffering to support SSE
39-
proxy_cache off; # Disable caching
40-
chunked_transfer_encoding off; # Disable chunked transfer encoding
41-
add_header Cache-Control no-cache; # Ensure no caching is done on client side
61+
proxy_pass http://node:3000;
62+
proxy_set_header Connection keep-alive;
63+
proxy_buffering off;
64+
proxy_cache off;
65+
chunked_transfer_encoding off;
66+
add_header Cache-Control no-cache;
4267
}
4368

69+
# WebSocket for Socket.IO
4470
location /socket.io {
4571
proxy_pass http://node:3000;
4672
proxy_http_version 1.1;
47-
proxy_set_header Upgrade ${DOLLAR}http_upgrade;
73+
proxy_set_header Upgrade $http_upgrade;
4874
proxy_set_header Connection 'upgrade';
49-
proxy_set_header Host ${DOLLAR}host;
50-
proxy_cache_bypass ${DOLLAR}http_upgrade;
75+
proxy_set_header Host $host;
76+
proxy_cache_bypass $http_upgrade;
5177
}
5278

79+
# Error pages
5380
error_page 500 502 503 504 /50x.html;
54-
location = /50x.html {
55-
root /usr/share/nginx/html;
81+
location = /50x.html {
82+
root /usr/share/nginx/html;
5683
}
5784
}

‎Tombolo/client-reactjs/nginx/conf.d/nginx.conf.template-ssl

+53-26
Original file line numberDiff line numberDiff line change
@@ -1,72 +1,99 @@
1+
# Rate limiting zone for DDoS protection (limits to 50 req/s per IP)
2+
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=50r/s;
3+
4+
# Connection limiting zone for DDoS protection
5+
limit_conn_zone $binary_remote_addr zone=conn_limit:150m;
6+
7+
# HTTP to HTTPS redirect
18
server {
29
listen 80;
310
server_name $HOSTNAME;
4-
return 301 https://${DOLLAR}server_name${DOLLAR}request_uri;
11+
return 301 https://$server_name$request_uri;
512
}
613

14+
# Main HTTPS server
715
server {
16+
# SSL setup
817
listen 443 ssl;
918
ssl_certificate /etc/nginx/certs/$CERTIFICATE_NAME;
1019
ssl_certificate_key /etc/nginx/certs/$CERTIFICATE_KEY;
1120
ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
1221
ssl_ecdh_curve secp384r1;
13-
ssl_session_timeout 10m;
22+
ssl_session_timeout 10m;
1423
ssl_session_cache shared:SSL:10m;
1524
server_name $HOSTNAME;
25+
26+
# DDoS protection
27+
limit_req zone=mylimit burst=20 nodelay; # Limits HTTP floods
28+
limit_conn conn_limit 50; # Caps connections per IP
29+
limit_conn_log_level warn; # Logs exceeded limits
30+
client_body_timeout 10s; # Drops slow body sends
31+
client_header_timeout 10s; # Drops slow header sends
32+
keepalive_timeout 5s; # Closes idle connections
33+
send_timeout 10s; # Limits response time
34+
client_max_body_size 2m; # Caps request size
35+
36+
# Security headers
1637
add_header Strict-Transport-Security "max-age=86400; includeSubDomains" always;
1738
add_header X-XSS-Protection "1; mode=block";
1839
add_header X-Permitted-Cross-Domain-Policies "none";
1940
add_header X-Frame-Options "deny";
2041
add_header Access-Control-Allow-Origin "domain";
21-
add_header Access-Control-Allow-Origin https://${DOLLAR}server_name;
42+
add_header Access-Control-Allow-Origin https://$server_name;
2243
add_header X-Content-Type-Options "nosniff";
2344
add_header Content-Security-Policy "script-src 'self'; base-uri 'self'; frame-ancestors 'deny'; form-action 'self'; default-src 'self'; object-src 'none'; worker-src 'self' blob:;";
2445
add_header Cache-Control "no-store";
2546
add_header Pragma "no-cache";
47+
48+
# Logging
2649
error_log /var/log/nginx/tombolo-error.log;
2750
access_log /var/log/nginx/tombolo-access.log;
51+
52+
# Static files
2853
location / {
29-
proxy_set_header X-Real-IP ${DOLLAR}remote_addr;
30-
proxy_set_header X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
31-
proxy_set_header Host ${DOLLAR}http_host;
54+
limit_req zone=mylimit burst=20 nodelay; # Rate limit for this location
55+
proxy_set_header X-Real-IP $remote_addr;
56+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
57+
proxy_set_header Host $http_host;
3258
proxy_hide_header X-Powered-By;
3359
expires -1;
34-
# adding this on top of -1, as part of the requirements for different browsers
3560
expires 01 Jan 1971 01:01:01 GMT;
36-
37-
root /usr/share/nginx/html;
38-
index index.html index.htm;
39-
try_files ${DOLLAR}uri ${DOLLAR}uri/ /index.html;
61+
root /usr/share/nginx/html;
62+
index index.html index.htm;
63+
try_files $uri $uri/ /index.html;
4064
}
4165

66+
# API proxy
4267
location /api {
68+
limit_req zone=mylimit burst=50 nodelay; # Higher burst for API
4369
proxy_pass http://node:3000;
4470
proxy_set_header X-Frame-Options "deny";
4571
proxy_hide_header X-Powered-By;
4672
}
4773

48-
# Location block for SSE at /api/addClusterWithProgress
74+
# SSE for clustering progress
4975
location /api/cluster/addClusterWithProgress {
50-
proxy_pass http://node:3000; # Pass to your Node.js server
51-
proxy_set_header Connection keep-alive;
52-
proxy_buffering off; # Disable buffering to support SSE
53-
proxy_cache off; # Disable caching
54-
chunked_transfer_encoding off; # Disable chunked transfer encoding
55-
add_header Cache-Control no-cache; # Ensure no caching is done on client side
76+
proxy_pass http://node:3000;
77+
proxy_set_header Connection keep-alive;
78+
proxy_buffering off;
79+
proxy_cache off;
80+
chunked_transfer_encoding off;
81+
add_header Cache-Control no-cache;
5682
}
5783

58-
59-
location /socket.io {
84+
# WebSocket for Socket.IO
85+
location /socket.io {
6086
proxy_pass http://node:3000;
6187
proxy_http_version 1.1;
62-
proxy_set_header Upgrade ${DOLLAR}http_upgrade;
88+
proxy_set_header Upgrade $http_upgrade;
6389
proxy_set_header Connection 'upgrade';
64-
proxy_set_header Host ${DOLLAR}host;
65-
proxy_cache_bypass ${DOLLAR}http_upgrade;
66-
}
90+
proxy_set_header Host $host;
91+
proxy_cache_bypass $http_upgrade;
92+
}
6793

94+
# Error pages
6895
error_page 500 502 503 504 /50x.html;
69-
location = /50x.html {
70-
root /usr/share/nginx/html;
96+
location = /50x.html {
97+
root /usr/share/nginx/html;
7198
}
7299
}

0 commit comments

Comments
 (0)