# Map for CORS map $upstream_http_access_control_allow_origin $allow_origin { '' "*"; } # Rate limiting zones for bot protection limit_req_zone $binary_remote_addr zone=global:10m rate=10r/s; limit_req_zone $binary_remote_addr zone=post_requests:10m rate=3r/s; limit_req_zone $binary_remote_addr zone=api_services:10m rate=5r/s; limit_req_zone $binary_remote_addr zone=unknown_ua:10m rate=2r/s; # Map for unknown user agents (empty or generic ones) map $http_user_agent $is_unknown_ua { default 0; ~*^$ 1; ~*^curl 1; ~*^wget 1; ~*^python-requests 1; ~*^java 1; ~*^Go-http-client 1; ~*^okhttp 1; ~*^PostmanRuntime 1; ~*^insomnia 1; } server { listen 0.0.0.0:8080; listen [::]:8080; server_name faaso-prod.ralsina.me; add_header 'Access-Control-Allow-Origin' $allow_origin; add_header 'Access-Control-Allow-Headers' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Allow' 'POST, GET, OPTIONS'; if ($request_method = 'OPTIONS' ) { return 200; } location / { limit_req zone=global burst=20 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:8888; proxy_set_header X-Forwarded-Host $http_host; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name tocry-demo.ralsina.me; add_header 'Access-Control-Allow-Origin' $allow_origin; add_header 'Access-Control-Allow-Headers' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Allow' 'POST, GET, OPTIONS'; if ($request_method = 'OPTIONS' ) { return 200; } location / { limit_req zone=global burst=20 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:8182; proxy_set_header X-Forwarded-Host $http_host; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name grafito-demo.ralsina.me; add_header 'Access-Control-Allow-Origin' $allow_origin; add_header 'Access-Control-Allow-Headers' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Allow' 'POST, GET, OPTIONS'; if ($request_method = 'OPTIONS' ) { return 200; } location / { limit_req zone=global burst=20 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:1112; proxy_set_header X-Forwarded-Host $http_host; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name code.ralsina.me; location / { limit_req zone=global burst=20 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://mindy.tail20c16.ts.net:8088; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection upgrade; proxy_set_header Accept-Encoding gzip; } error_page 500 502 503 504 /custom_50x.html; error_page 429 /429.html; location = /custom_50x.html { root /usr/share/nginx/html; internal; } location = /429.html { return 429 '
Rate limit exceeded. Please try again later.
'; add_header Content-Type text/html; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name home.ralsina.me; server_name ralsina.me; server_name faaso.ralsina.me; server_name nicolino.ralsina.me; server_name crycco.ralsina.me; server_name nombres.ralsina.me; server_name grafito.ralsina.me; server_name tocry.ralsina.me; server_name kv.ralsina.me; if ($http_user_agent ~* "(AdsBot-Google|Amazonbot|anthropic-ai|Applebot|Applebot-Extended|AwarioRssBot|AwarioSmartBot|Bytespider|CCBot|ChatGPT-User|ClaudeBot|Claude-Web|cohere-ai|DataForSeoBot|Diffbot|FacebookBot|FriendlyCrawler|Google-Extended|GoogleOther|GPTBot|img2dataset|ImagesiftBot|magpie-crawler|Meltwater|omgili|omgilibot|peer39_crawler|peer39_crawler/1.0|PerplexityBot|PiplBot|scoop.it|Seekr|YouBot)") { return 307 https://ash-speed.hetzner.com/10GB.bin; } location / { # Apply stricter limits for unknown user agents limit_req zone=unknown_ua burst=3 nodelay; limit_req zone=global burst=20 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:8080; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header Host $host; } error_page 500 502 503 504 /custom_50x.html; error_page 429 /429.html; location = /custom_50x.html { root /usr/share/nginx/html; internal; } location = /429.html { return 429 'Rate limit exceeded. Please try again later.
'; add_header Content-Type text/html; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name links.ralsina.me; location / { limit_req zone=global burst=20 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:8086; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header Host $host; } error_page 500 502 503 504 /custom_50x.html; error_page 429 /429.html; location = /custom_50x.html { root /usr/share/nginx/html; internal; } location = /429.html { return 429 'Rate limit exceeded. Please try again later.
'; add_header Content-Type text/html; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name git.ralsina.me; location / { limit_req zone=global burst=20 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:3000; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header Host $host; } error_page 403 404 500 502 503 504 /custom_50x.html; error_page 429 /429.html; location = /custom_50x.html { root /usr/share/nginx/html; internal; } location = /429.html { return 429 'Rate limit exceeded. Please try again later.
'; add_header Content-Type text/html; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name gotify.ralsina.me; add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Headers' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Allow' 'POST, GET, OPTIONS'; if ($request_method = 'OPTIONS' ) { return 200; } location / { limit_req zone=api_services burst=10 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:7777; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header Host $host; } location /stream { # No rate limiting for WebSocket connections proxy_pass http://rocky.tail20c16.ts.net:7777; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; } error_page 403 404 500 502 503 504 /custom_50x.html; error_page 429 /429.html; location = /custom_50x.html { root /usr/share/nginx/html; internal; } location = /429.html { return 429 'Rate limit exceeded. Please try again later.
'; add_header Content-Type text/html; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name faas.ralsina.me; add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Headers' '*'; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Allow' 'POST, GET, OPTIONS'; if ($request_method = 'OPTIONS' ) { return 200; } location / { limit_req zone=api_services burst=10 nodelay; limit_req zone=post_requests burst=5 nodelay; proxy_pass http://rocky.tail20c16.ts.net:8082; proxy_set_header X-Forwarded-Host $http_host; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name snips.ralsina.me; location / { # No rate limiting for WebSocket connections proxy_pass http://rocky.tail20c16.ts.net:8091 ; proxy_set_header X-Forwarded-Host $http_host; # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name metrics.ralsina.me; auth_basic "Metrics Dashboard - Restricted Access"; auth_basic_user_file /etc/nginx/.htpasswd; # Serve static HTML directly location / { root /usr/share/nginx/html/goaccess; try_files /index.html @goaccess; } location @goaccess { proxy_pass http://127.0.0.1:7890; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 86400; } # WebSocket endpoint for GoAccess location /ws { proxy_pass http://127.0.0.1:7890; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 86400; } } server { listen 0.0.0.0:8080; listen [::]:8080; server_name covers.ralsina.me; return 301 https://ralsina.me/stories/covers/; }