From 2c820f1cc0e67b571470c48c9782bf125b27f50e Mon Sep 17 00:00:00 2001
From: wiz <j@wiz.biz>
Date: Sat, 18 Nov 2023 15:09:02 +0900
Subject: [PATCH] ops: Rewrite nginx config for new services API endpoints

---
 .../nginx/location-api-v1-services.conf       | 252 ++++++++++--------
 production/nginx/location-api.conf            |   4 +-
 2 files changed, 146 insertions(+), 110 deletions(-)

diff --git a/production/nginx/location-api-v1-services.conf b/production/nginx/location-api-v1-services.conf
index d3f233da8..3efff38e4 100644
--- a/production/nginx/location-api-v1-services.conf
+++ b/production/nginx/location-api-v1-services.conf
@@ -1,122 +1,158 @@
-location /api/v1/services/account {
-	proxy_pass $mempoolSpaceServices;
-	expires -1;
-	add_header 'Pragma' 'no-cache';
-	add_header 'Cache-Control' 'private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
-	proxy_hide_header Cache-Control;
-	proxy_hide_header Expires;
-	proxy_hide_header Pragma;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
-}
-location /api/v1/services/auth {
-	proxy_pass $mempoolSpaceServices;
-	expires -1;
-	add_header 'Pragma' 'no-cache';
-	add_header 'Cache-Control' 'private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
-	proxy_hide_header Cache-Control;
-	proxy_hide_header Expires;
-	proxy_hide_header Pragma;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
-}
-location /api/v1/services {
-	proxy_pass $mempoolSpaceServices;
-	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 1d;
-	expires 1d;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
-}
-location /api/v1/contributors/images {
-	proxy_pass $mempoolSpaceServices;
-	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 1w;
-	expires 1w;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
+###########
+# routing #
+###########
+
+location /api/v1/assets {
+	try_files /dev/null @mempool-api-v1-services-cache-short;
 }
 location /api/v1/contributors {
-	proxy_pass $mempoolSpaceServices;
-	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 1d;
-	expires 1d;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
+	try_files /dev/null @mempool-api-v1-services-cache-medium;
 }
-location /api/v1/donations/images {
-	proxy_pass $mempoolSpaceServices;
-	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 1w;
-	expires 1w;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
+location /api/v1/contributors/images {
+	try_files /dev/null @mempool-api-v1-services-cache-long;
 }
 location /api/v1/donations {
-	proxy_pass $mempoolSpaceServices;
-	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 1d;
-	expires 1d;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
+	try_files /dev/null @mempool-api-v1-services-cache-medium;
 }
-location /api/v1/translators/images {
-	proxy_pass $mempoolSpaceServices;
-	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 1w;
-	expires 1w;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
+location /api/v1/donations/images {
+	try_files /dev/null @mempool-api-v1-services-cache-long;
 }
 location /api/v1/translators {
+	try_files /dev/null @mempool-api-v1-services-cache-medium;
+}
+location /api/v1/translators/images {
+	try_files /dev/null @mempool-api-v1-services-cache-long;
+}
+location /api/v1/services/internal/ {
+	return 403;
+}
+location /api/v1/services/ {
+	try_files /dev/null @mempool-api-v1-services-cache-disabled;
+}
+
+###########
+# caching #
+###########
+
+location @mempool-api-v1-services-cache-disabled {
+	proxy_pass $mempoolSpaceServices;
+
+	# remove these just in case double proxied
+	proxy_hide_header Onion-Location;
+	proxy_hide_header Strict-Transport-Security;
+	proxy_hide_header Content-Security-Policy;
+	proxy_hide_header X-Frame-Options;
+
+	# remove cache headers from services backend
+	proxy_hide_header Cache-Control;
+	proxy_hide_header Expires;
+	proxy_hide_header Pragma;
+
+	# pass these headers to services backend
+	proxy_set_header Host $host;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+
+	# add our own cache headers
+	add_header 'Pragma' 'no-cache';
+	add_header 'Cache-Control' 'private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+	proxy_redirect off;
+	proxy_buffering off;
+
+	expires -1;
+}
+
+location @mempool-api-v1-services-cache-short {
 	proxy_pass $mempoolSpaceServices;
 	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 1d;
-	expires 1d;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
+	proxy_redirect off;
+
+	# remove these just in case double proxied
+	proxy_hide_header Onion-Location;
+	proxy_hide_header Strict-Transport-Security;
+	proxy_hide_header Content-Security-Policy;
+	proxy_hide_header X-Frame-Options;
+
+	# pass these headers to services backend
+	proxy_set_header Host $host;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+
+	# remove cache headers from services backend
+	proxy_hide_header Cache-Control;
+	proxy_hide_header Expires;
+	proxy_hide_header Pragma;
+
+	# add our own cache headers
+	add_header 'Pragma' 'public';
+	add_header 'Cache-Control' 'public';
+	expires 2s;
+
+	# server-side cache validity
+	proxy_cache_valid 200 2s;
 }
-location /api/v1/assets {
+
+location @mempool-api-v1-services-cache-medium {
 	proxy_pass $mempoolSpaceServices;
 	proxy_cache services;
-	proxy_cache_background_update on;
-	proxy_cache_use_stale updating;
-	proxy_cache_valid 200 10m;
-	expires 10m;
-	proxy_hide_header onion-location;
-	proxy_hide_header strict-transport-security;
-	proxy_hide_header content-security-policy;
-	proxy_hide_header x-frame-options;
+	proxy_redirect off;
+
+	# remove these just in case double proxied
+	proxy_hide_header Onion-Location;
+	proxy_hide_header Strict-Transport-Security;
+	proxy_hide_header Content-Security-Policy;
+	proxy_hide_header X-Frame-Options;
+
+	# pass these headers to services backend
+	proxy_set_header Host $host;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+
+	# remove cache headers from services backend
+	proxy_hide_header Cache-Control;
+	proxy_hide_header Expires;
+	proxy_hide_header Pragma;
+
+	# add our own cache headers
+	add_header 'Pragma' 'public';
+	add_header 'Cache-Control' 'public';
+	expires 7d;
+
+	# server-side cache validity
+	proxy_cache_valid 200 7d;
+}
+
+location @mempool-api-v1-services-cache-long {
+	proxy_pass $mempoolSpaceServices;
+	proxy_cache services;
+	proxy_redirect off;
+
+	# remove these just in case double proxied
+	proxy_hide_header Onion-Location;
+	proxy_hide_header Strict-Transport-Security;
+	proxy_hide_header Content-Security-Policy;
+	proxy_hide_header X-Frame-Options;
+
+	# pass these headers to services backend
+	proxy_set_header Host $host;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+
+	# remove cache headers from services backend
+	proxy_hide_header Cache-Control;
+	proxy_hide_header Expires;
+	proxy_hide_header Pragma;
+
+	# add our own cache headers
+	add_header 'Pragma' 'public';
+	add_header 'Cache-Control' 'public';
+	expires 30d;
+
+	# server-side cache validity
+	proxy_cache_valid 200 30d;
 }
diff --git a/production/nginx/location-api.conf b/production/nginx/location-api.conf
index 71afa295a..b8c79cd50 100644
--- a/production/nginx/location-api.conf
+++ b/production/nginx/location-api.conf
@@ -4,10 +4,10 @@
 
 # Block the internal APIs of esplora
 location /api/internal/ {
-	return 404;
+	return 403;
 }
 location /api/v1/internal/ {
-	return 404;
+	return 403;
 }
 
 # websocket has special HTTP headers