# Install in the nginx http context. Replace the hostname and certificate paths.
# Direct TLS ingress. For Cloudflare see recommended-rules.md before enabling real IP.
limit_req_zone $binary_remote_addr zone=task_global:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=task_auth:10m rate=5r/m;
limit_conn_zone $binary_remote_addr zone=task_connections:10m;
log_format task_safe '$remote_addr $request_method $uri $status $request_time';
server {
    listen 80;
    server_name task.example.invalid;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name task.example.invalid;
    ssl_certificate /etc/letsencrypt/live/task.example.invalid/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/task.example.invalid/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    server_tokens off;
    access_log /var/log/nginx/task-access.log task_safe;
    # Error logs can contain request URLs; restrict access and retention.
    error_log /var/log/nginx/task-error.log warn;
    client_max_body_size 6m;
    client_body_timeout 15s;
    client_header_timeout 15s;
    keepalive_timeout 15s;
    send_timeout 30s;
    limit_conn task_connections 20;
    limit_req_status 429;
    limit_conn_status 429;

    location ~ /\. { return 404; }
    location ~ ^/(?:storage|src|database|node_modules|bin|docs|infrastructure)(?:/|$) { return 404; }
    location ^~ /api/v1/admin/auth/ {
        limit_req zone=task_auth burst=10 nodelay;
        include /etc/nginx/snippets/task-proxy.conf;
    }
    location / {
        limit_req zone=task_global burst=30 nodelay;
        include /etc/nginx/snippets/task-proxy.conf;
    }
}