machankura/mempool
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update production configurations + README for v2.3

Browse Source 
* Refactor production nginx configuration files
* Update README for new networks, SQL, etc.
This commit is contained in:
wiz
2022-01-04 15:28:17 +09:00
parent 9c03a1b79e
commit 9a82973d28
26 changed files with 751 additions and 1099 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
production/nginx/http-basic.conf Normal file
View File

@@ -0,0 +1,39 @@
# basics
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server_tokens off;
server_name_in_redirect off;
include /usr/local/etc/nginx/mime.types;
default_type application/octet-stream;
# default logs
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
# reset timed out connections freeing ram
reset_timedout_connection on;
# maximum time between packets the client can pause when sending nginx any data
client_body_timeout 10s;
# maximum time the client has to send the entire header to nginx
client_header_timeout 10s;
# timeout which a single keep-alive client connection will stay open
keepalive_timeout 69s;
# maximum time between packets nginx is allowed to pause when sending the client data
send_timeout 10s;
# number of requests per connection, does not affect SPDY
keepalive_requests 100;
# enable gzip compression
gzip on;
gzip_vary on;
gzip_comp_level 6;
gzip_min_length 1000;
gzip_proxied expired no-cache no-store private auth;
# text/html is always compressed by gzip module
gzip_types application/javascript application/json application/ld+json application/manifest+json application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard;
# limit request body size
client_max_body_size 10m;

57
production/nginx/http-language.conf Normal file
View File

@@ -0,0 +1,57 @@
map $http_accept_language $header_lang {
default en-US;
~*^en-US en-US;
~*^en en-US;
~*^ar ar;
~*^cs cs;
~*^de de;
~*^es es;
~*^fa fa;
~*^fr fr;
~*^ko ko;
~*^hi hi;
~*^it it;
~*^ka ka;
~*^hu hu;
~*^nl nl;
~*^ja ja;
~*^nb nb;
~*^pl pl;
~*^pt pt;
~*^sl sl;
~*^fi fi;
~*^sv sv;
~*^tr tr;
~*^uk uk;
~*^vi vi;
~*^zh zh;
}
map $cookie_lang $lang {
default $header_lang;
~*^en-US en-US;
~*^en en-US;
~*^ar ar;
~*^cs cs;
~*^de de;
~*^es es;
~*^fa fa;
~*^fr fr;
~*^hi hi;
~*^it it;
~*^ka ka;
~*^hu hu;
~*^ja ja;
~*^ko ko;
~*^nb nb;
~*^nl nl;
~*^pl pl;
~*^pt pt;
~*^sl sl;
~*^fi fi;
~*^sv sv;
~*^tr tr;
~*^uk uk;
~*^vi vi;
~*^zh zh;
}

4
production/nginx/http-proxy-cache.conf Normal file
View File

@@ -0,0 +1,4 @@
# proxy cache
proxy_cache_path /var/cache/nginx/services keys_zone=services:20m levels=1:2 inactive=600s max_size=100m;
proxy_cache_path /var/cache/nginx/markets keys_zone=markets:20m levels=1:2 inactive=600s max_size=100m;
types_hash_max_size 2048;

8
production/nginx/location-api-v1-contributors.conf Normal file
View File

@@ -0,0 +1,8 @@
location /api/v1/contributors {
proxy_pass https://mempool.space;
proxy_hide_header onion-location;
proxy_hide_header strict-transport-security;
proxy_hide_header content-security-policy;
proxy_hide_header x-frame-options;
# don't rate limit this API prefix
}

11
production/nginx/location-api-v1-donations-images.conf Normal file
View File

@@ -0,0 +1,11 @@
location /api/v1/donations/images {
proxy_pass https://mempool.space;
proxy_cache services;
proxy_cache_valid 200 1d;
expires 7d;
add_header Cache-Control "public, no-transform";
proxy_hide_header onion-location;
proxy_hide_header strict-transport-security;
proxy_hide_header content-security-policy;
proxy_hide_header x-frame-options;
}

8
production/nginx/location-api-v1-donations.conf Normal file
View File

@@ -0,0 +1,8 @@
location /api/v1/donations {
proxy_pass https://mempool.space;
proxy_hide_header onion-location;
proxy_hide_header strict-transport-security;
proxy_hide_header content-security-policy;
proxy_hide_header x-frame-options;
# don't rate limit this API prefix
}

43
production/nginx/location-api.conf Normal file
View File

@@ -0,0 +1,43 @@
location /api/v1/ws {
proxy_pass $mempoolBackend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location /api/v1 {
try_files /dev/null @mempool-api-v1;
}
location /api/ {
rewrite ^/api/(.*) /$1 break;
try_files /dev/null @electrs-api;
}
location @mempool-api-v1 {
proxy_pass $mempoolBackend;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
proxy_set_header X-Forwarded-Proto $scheme;
}
location @electrs-api {
proxy_pass $electrsBackend;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
proxy_set_header X-Forwarded-Proto $scheme;
}

12
production/nginx/location-liquid-api.conf Normal file
View File

@@ -0,0 +1,12 @@
location /liquid/api/v1/ws {
proxy_pass http://127.0.0.1:8998/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location /liquid/api/v1 {
proxy_pass http://127.0.0.1:8998/api/v1;
}
location /liquid/api/ {
proxy_pass http://electrs-liquid-mainnet/;
}

12
production/nginx/location-liquidtestnet-api.conf Normal file
View File

@@ -0,0 +1,12 @@
location /liquidtestnet/api/v1/ws {
proxy_pass http://127.0.0.1:8994/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location /liquidtestnet/api/v1 {
proxy_pass http://127.0.0.1:8994/api/v1;
}
location /liquidtestnet/api/ {
proxy_pass http://electrs-liquid-testnet/;
}

46
production/nginx/location-redirects.conf Normal file
View File

@@ -0,0 +1,46 @@
# redirect mempool.space/liquid to liquid.network
location /liquid {
rewrite /liquid/(.*) https://liquid.network/$1;
rewrite /liquid https://liquid.network/;
return 308;
}
# redirect mempool.space/liquidtestnet to liquid.network/testnet
location /liquidtestnet {
rewrite /liquidtestnet/(.*) https://liquid.network/testnet/$1;
rewrite /liquidtestnet/ https://liquid.network/testnet/;
rewrite /liquidtestnet https://liquid.network/testnet;
return 308;
}
# redirect mempool.space/bisq to bisq.markets
location /bisq {
rewrite /bisq/(.*) https://bisq.markets/$1;
rewrite /bisq https://bisq.markets/;
return 308;
}
# redirect /api to /docs/api
location = /api {
return 308 https://$host/docs/api;
}
location = /api/ {
return 308 https://$host/docs/api;
}
# redirect /testnet/api to /testnet/docs/api
location = /testnet/api {
return 308 https://$host/testnet/docs/api;
}
location = /testnet/api/ {
return 308 https://$host/testnet/docs/api;
}
# redirect /signet/api to /signet/docs/api
location = /signet/api {
return 308 https://$host/signet/docs/api;
}
location = /signet/api/ {
return 308 https://$host/signet/docs/api;
}

12
production/nginx/location-signet-api.conf Normal file
View File

@@ -0,0 +1,12 @@
location /signet/api/v1/ws {
proxy_pass http://mempool-bitcoin-signet/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location /signet/api/v1 {
proxy_pass http://mempool-bitcoin-signet/api/v1;
}
location /signet/api/ {
proxy_pass http://electrs-bitcoin-signet/;
}

12
production/nginx/location-testnet-api.conf Normal file
View File

@@ -0,0 +1,12 @@
location /testnet/api/v1/ws {
proxy_pass http://mempool-bitcoin-testnet/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location /testnet/api/v1 {
proxy_pass http://mempool-bitcoin-testnet/api/v1;
}
location /testnet/api/ {
proxy_pass http://electrs-bitcoin-testnet/;
}

124
production/nginx/nginx.conf Normal file
View File

@@ -0,0 +1,124 @@
# FreeBSD configuration
user nobody;
pid /var/run/nginx.pid;
worker_processes auto;
worker_rlimit_nofile 100000;
events {
worker_connections 9000;
multi_accept on;
}
http {
# DNS servers for on-demand recursive resolver
resolver 8.8.8.8;
# HTTP basic configuration
include mempool/production/nginx/http-basic.conf;
include mempool/production/nginx/http-proxy-cache.conf;
include mempool/production/nginx/http-language.conf;
# mempool backend configuration
include mempool/production/nginx/upstream-mempool.conf;
# electrs backend configuration
include mempool/production/nginx/upstream-electrs.conf;
include mempool/production/nginx/server-electrs.conf;
# MEMPOOL.NINJA
server {
# clearnet v4/v6
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name mempool.ninja;
set $mempoolBackend "http://mempool-bitcoin-mainnet";
set $electrsBackend "http://electrs-bitcoin-mainnet";
# tor v3
listen 127.0.0.1:81;
set $onion "mempoolhqx4isw62xs7abwphsq7ldayuidyx2v2oethdhhj6mlo2r6ad";
# filesystem paths
root /mempool/public_html/mainnet/;
access_log /var/log/nginx/mempool-access.log;
error_log /var/log/nginx/mempool-error.log;
# ssl configuration
ssl_certificate /usr/local/etc/letsencrypt/live/mempool.ninja/fullchain.pem;
ssl_certificate_key /usr/local/etc/letsencrypt/live/mempool.ninja/privkey.pem;
include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
# site configuration
include mempool/production/nginx/server-mempool.conf;
}
# BISQ.NINJA
server {
# clearnet v4/v6
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name bisq.ninja;
set $mempoolBackend "http://mempool-bisq-mainnet";
set $electrsBackend "http://electrs-bitcoin-mainnet";
# tor v3
listen 127.0.0.1:82;
set $onion "mempoolhqx4isw62xs7abwphsq7ldayuidyx2v2oethdhhj6mlo2r6ad";
# filesystem paths
root /mempool/public_html/bisq/;
access_log /var/log/nginx/bisq-access.log;
error_log /var/log/nginx/bisq-error.log;
# ssl configuration
ssl_certificate /usr/local/etc/letsencrypt/live/bisq.ninja/fullchain.pem;
ssl_certificate_key /usr/local/etc/letsencrypt/live/bisq.ninja/privkey.pem;
include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
# site configuration
include mempool/production/nginx/server-bisq.conf;
}
# LIQUID.PLACE
server {
# clearnet v4/v6
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name liquid.place;
set $mempoolBackend "http://mempool-liquid-mainnet";
set $electrsBackend "http://electrs-liquid-mainnet";
# tor v3
listen 127.0.0.1:83;
set $onion "mempoolhqx4isw62xs7abwphsq7ldayuidyx2v2oethdhhj6mlo2r6ad";
# filesystem paths
root /mempool/public_html/liquid/;
access_log /var/log/nginx/liquid-access.log;
error_log /var/log/nginx/liquid-error.log;
# ssl configuration
ssl_certificate /usr/local/etc/letsencrypt/live/liquid.place/fullchain.pem;
ssl_certificate_key /usr/local/etc/letsencrypt/live/liquid.place/privkey.pem;
include /usr/local/etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /usr/local/etc/letsencrypt/ssl-dhparams.pem;
# site configuration
include mempool/production/nginx/server-liquid.conf;
}
# HTTP to HTTPS redirect
server {
# clearnet v4/v6
listen 80;
listen [::]:80;
server_name _;
# only redirect for our hosted domains
if ($host ~ "^(mempool.ninja|bisq.ninja|liquid.place)$")
{
return 301 https://$host$request_uri;
}
return 503;
}
}

85
production/nginx/server-bisq.conf Normal file
View File

@@ -0,0 +1,85 @@
include mempool/production/nginx/server-common.conf;
include mempool/production/nginx/location-api-v1-contributors.conf;
include mempool/production/nginx/location-api-v1-donations.conf;
include mempool/production/nginx/location-api-v1-donations-images.conf;
proxy_cache markets;
proxy_cache_valid 200 30s;
# route electrs APIs to electrs
location /api/tx/ {
proxy_pass http://electrs-bitcoin-mainnet/tx/;
}
# rewrite APIs to match what backend expects
location /api/currencies {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/depth {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/hloc {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/offers {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/ticker {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/trades {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/volumes {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/markets {
rewrite ^/api/(.*) /api/v1/bisq/markets/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api/v1 {
rewrite ^/api/v1/(.*) /api/v1/bisq/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /api {
rewrite ^/api/(.*) /api/v1/bisq/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /bisq/api/v1 {
rewrite ^/bisq/api/v1/(.*) /api/v1/bisq/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
location /bisq/api {
rewrite ^/bisq/api/(.*) /api/v1/bisq/$1 break;
try_files $uri $uri/ @mempool-bisq;
}
# special handling for websocket
location /api/v1/ws {
proxy_pass http://127.0.0.1:8996/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location @mempool-bisq {
proxy_pass http://127.0.0.1:8996;
proxy_http_version 1.1;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_cache_bypass $http_upgrade;
proxy_redirect off;
proxy_set_header X-Forwarded-Proto $scheme;
}

65
production/nginx/server-common.conf Normal file
View File

@@ -0,0 +1,65 @@
# angular builds to index.html
index index.html;
# tor onion redirect
add_header Onion-Location http://$onion.onion$request_uri;
# HSTS preload enable
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
# generate frame configuration from origin header
set $frameOptions "DENY";
set $contentSecurityPolicy "frame-ancestors 'none'";
# used for iframes on https://mempool.space/network
if ($http_referer ~ ^https://mempool.space/)
{
set $frameOptions "ALLOW-FROM https://mempool.space";
set $contentSecurityPolicy "frame-ancestors https://mempool.space";
}
# used for iframes on https://mempool.ninja/network
if ($http_referer ~ ^https://mempool.ninja/)
{
set $frameOptions "ALLOW-FROM https://mempool.ninja";
set $contentSecurityPolicy "frame-ancestors https://mempool.ninja";
}
# used for iframes on https://wiz.biz/bitcoin/nodes
if ($http_referer ~ ^https://wiz.biz/)
{
set $frameOptions "ALLOW-FROM https://wiz.biz";
set $contentSecurityPolicy "frame-ancestors https://wiz.biz";
}
# restrict usage of frames
add_header X-Frame-Options $frameOptions;
add_header Content-Security-Policy $contentSecurityPolicy;
# enable browser and proxy caching
add_header Cache-Control "public, no-transform";
# vary cache if user changes language preference
add_header Vary Accept-Language;
add_header Vary Cookie;
# fallback for all URLs i.e. /address/foo /tx/foo /block/000
location / {
try_files /$lang/$uri /$lang/$uri/ $uri $uri/ /en-US/$uri @index-redirect;
expires 10m;
}
location /resources {
try_files /$lang/$uri /$lang/$uri/ $uri $uri/ /en-US/$uri @index-redirect;
expires 1h;
}
location @index-redirect {
rewrite (.*) /$lang/index.html;
}
# location block using regex are matched in order
# used to rewrite resources from /<lang>/ to /en-US/
location ~ ^/(ar|bg|bs|ca|cs|da|de|et|el|es|eo|eu|fa|fr|gl|ko|hr|id|it|he|ka|lv|lt|hu|mk|ms|nl|ja|ka|no|nb|nn|pl|pt|pt-BR|ro|ru|sk|sl|sr|sh|fi|sv|th|tr|uk|vi|zh)/resources/ {
rewrite ^/[a-zA-Z-]*/resources/(.*) /en-US/resources/$1;
}
# used for cookie override
location ~ ^/(ar|bg|bs|ca|cs|da|de|et|el|es|eo|eu|fa|fr|gl|ko|hr|id|it|he|ka|lv|lt|hu|mk|ms|nl|ja|ka|no|nb|nn|pl|pt|pt-BR|ro|ru|sk|sl|sr|sh|fi|sv|th|tr|uk|vi|zh)/ {
try_files $uri $uri/ /$1/index.html =404;

35
production/nginx/server-electrs.conf Normal file
View File

@@ -0,0 +1,35 @@
server {
listen 127.0.0.1:4000;
access_log /dev/null;
location / {
proxy_pass http://electrs-bitcoin-mainnet;
}
}
server {
listen 127.0.0.1:4001;
access_log /dev/null;
location / {
proxy_pass http://electrs-liquid-mainnet;
}
}
server {
listen 127.0.0.1:4002;
access_log /dev/null;
location / {
proxy_pass http://electrs-bitcoin-testnet;
}
}
server {
listen 127.0.0.1:4003;
access_log /dev/null;
location / {
proxy_pass http://electrs-bitcoin-signet;
}
}
server {
listen 127.0.0.1:4004;
access_log /dev/null;
location / {
proxy_pass http://electrs-liquid-testnet;
}
}

7
production/nginx/server-liquid.conf Normal file
View File

@@ -0,0 +1,7 @@
include mempool/production/nginx/server-common.conf;
include mempool/production/nginx/location-api-v1-contributors.conf;
include mempool/production/nginx/location-api-v1-donations-images.conf;
include mempool/production/nginx/location-api-v1-donations.conf;
include mempool/production/nginx/location-api.conf;
include mempool/production/nginx/location-liquid-api.conf;
include mempool/production/nginx/location-liquidtestnet-api.conf;

8
production/nginx/server-mempool.conf Normal file
View File

@@ -0,0 +1,8 @@
include mempool/production/nginx/server-common.conf;
include mempool/production/nginx/location-redirects.conf;
include mempool/production/nginx/location-api-v1-contributors.conf;
include mempool/production/nginx/location-api-v1-donations.conf;
include mempool/production/nginx/location-api-v1-donations-images.conf;
include mempool/production/nginx/location-api.conf;
include mempool/production/nginx/location-testnet-api.conf;
include mempool/production/nginx/location-signet-api.conf;

15
production/nginx/upstream-electrs.conf Normal file
View File

@@ -0,0 +1,15 @@
upstream electrs-bitcoin-mainnet {
server [::1]:3000 fail_timeout=10s max_fails=10 weight=99999;
}
upstream electrs-liquid-mainnet {
server [::1]:3001 fail_timeout=10s max_fails=10 weight=99999;
}
upstream electrs-bitcoin-testnet {
server [::1]:3002 fail_timeout=10s max_fails=10 weight=99999;
}
upstream electrs-bitcoin-signet {
server [::1]:3003 fail_timeout=10s max_fails=10 weight=99999;
}
upstream electrs-liquid-testnet {
server [::1]:3004 fail_timeout=10s max_fails=10 weight=99999;
}

18
production/nginx/upstream-mempool.conf Normal file
View File

@@ -0,0 +1,18 @@
upstream mempool-bitcoin-mainnet {
server 127.0.0.1:8999 fail_timeout=10s max_fails=10 weight=99999;
}
upstream mempool-liquid-mainnet {
server 127.0.0.1:8998 fail_timeout=10s max_fails=10 weight=99999;
}
upstream mempool-bitcoin-testnet {
server 127.0.0.1:8997 fail_timeout=10s max_fails=10 weight=99999;
}
upstream mempool-bitcoin-bisq {
server 127.0.0.1:8996 fail_timeout=10s max_fails=10 weight=99999;
}
upstream mempool-bitcoin-signet {
server 127.0.0.1:8995 fail_timeout=10s max_fails=10 weight=99999;
}
upstream mempool-liquid-testnet {
server 127.0.0.1:8994 fail_timeout=10s max_fails=10 weight=99999;
}