custom-nginx-reverse-proxy.conf

worker_processes auto;

events {
    accept_mutex on;
    multi_accept on;
    worker_connections 512;
}

http {
    include mime.types;
    server_names_hash_bucket_size 128;
    sendfile on;

    proxy_buffers 8 1024k;
    proxy_buffer_size 1024k;
    aio on;
    directio 4m;
    tcp_nopush on;
    tcp_nodelay on;

    upstream platform {
        server 10.200.10.1:3333;
    }

    upstream network_explorer {
        server 10.200.10.1:3334;
    }

    upstream brokers_ws {
        server 10.200.10.1:8690;
        server 10.200.10.1:8790;
        keepalive 20;
        keepalive_requests 50;
        keepalive_timeout 60s;
    }

    upstream brokers_http {
        server 10.200.10.1:8691;
        server 10.200.10.1:8791;
        keepalive 20;
        keepalive_requests 50;
        keepalive_timeout 60s;
    }

    upstream storage_http {
        server 10.200.10.1:8891;
    }

    upstream mainchain_rpc_http {
        server 10.200.10.1:8545;
    }

    upstream mainchain_rpc_ws {
        server 10.200.10.1:8450;
    }

    upstream sidechain_rpc_http {
        server 10.200.10.1:8546;
    }

    upstream sidechain_rpc_ws {
        server 10.200.10.1:8451;
    }

    server {
        proxy_connect_timeout 10s;

        listen 80;

        # UNCOMMENT FOR SSL
        # -----------------

        # listen 443 ssl;
        # ssl_certificate /etc/nginx/mounted-certs/bundle.crt;
        # ssl_certificate_key /etc/nginx/mounted-certs/secret.key;
        # if ($scheme = http) {
        #     return 301 https://$host$request_uri;
        # }

        # Enables all versions of TLS, but not SSLv2 or 3 which are weak and now deprecated.
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

        # Disables all weak ciphers
        ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

		location /health_check {
			return 200;
			access_log off;
			add_header Content-Type text/plain;
			add_header Cache-Control no-cache;
			keepalive_timeout 0;
		}

        # Websocket endpoint
        location /api/v2/ws {
            add_header X-debug "/api/v2/ws";
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_http_version 1.1;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_pass http://brokers_ws;
            proxy_read_timeout 240s;
        }

        # Data REST endpoints
        location ~ /api/v2/streams/(.*)/(data|metadata/partitions/.*|storage/partitions/.*|data/partitions/.*)$ {
            add_header X-debug "/api/v2/streams";
            proxy_pass http://storage_http;
            proxy_read_timeout 240s;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        # Data Volume endpoint
        location /api/v2/volume {
            add_header X-debug "/api/v2/volume";
            proxy_pass http://brokers_http;
            proxy_read_timeout 240s;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        # Network explorer
        location /network-explorer/ {
            proxy_pass http://network_explorer$request_uri;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        ### Utility paths proxied to the Ethereum nodes in the docker stack. Useful if SSL is terminated at nginx ###

        location /mainchain-rpc/http/ {
            proxy_pass http://mainchain_rpc_http/;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        location /mainchain-rpc/ws/ {
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_http_version 1.1;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_pass http://mainchain_rpc_ws/;
        }

        location /sidechain-rpc/http/ {
            proxy_pass http://sidechain_rpc_http/;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

        location /sidechain-rpc/ws/ {
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_http_version 1.1;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_pass http://sidechain_rpc_ws/;
        }

        # Proxy everything else to the Hub app
        location / {
            add_header X-debug "/";
            proxy_pass         http://platform;
            proxy_redirect     off;
            proxy_set_header   Host $host;
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Host $server_name;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
        }

    }
}