nginx.conf

# backup of the production nginx configuration
# ratelimit
limit_req_zone $binary_remote_addr zone=filesystem_limit:10m rate=5r/s;

server {
	server_name hwcinternaldb.highquality.rip;

	location @proxy {
		proxy_pass http://localhost:3000;
		proxy_http_version 1.1;
		proxy_redirect off;
		proxy_cache_bypass $http_upgrade;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection 'upgrade';
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	}

	location /filesystem {
		limit_req zone=filesystem_limit burst=10 nodelay;
		limit_req_status 429;
		try_files $uri @proxy;
	}

	location / {
		try_files $uri @proxy;
	}

	listen [::]:443 ssl ipv6only=on; # managed by Certbot
	listen 443 ssl; # managed by Certbot

    # Redacted SSL configuration
	ssl_certificate ; # managed by Certbot
	ssl_certificate_key ; # managed by Certbot
	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

	real_ip_header CF-Connecting-IP;
	real_ip_recursive on;

    # for testing site availability under heavy attack (to ratelimit a specific ip, thats not my own)
	# set_real_ip_from MY_IP_ADDRESS_THAT_I_REMOVED;

	# https://github.com/ergin/nginx-cloudflare-real-ip
	# - IPv4
	set_real_ip_from 173.245.48.0/20;
	set_real_ip_from 103.21.244.0/22;
	set_real_ip_from 103.22.200.0/22;
	set_real_ip_from 103.31.4.0/22;
	set_real_ip_from 141.101.64.0/18;
	set_real_ip_from 108.162.192.0/18;
	set_real_ip_from 190.93.240.0/20;
	set_real_ip_from 188.114.96.0/20;
	set_real_ip_from 197.234.240.0/22;
	set_real_ip_from 198.41.128.0/17;
	set_real_ip_from 162.158.0.0/15;
	set_real_ip_from 104.16.0.0/13;
	set_real_ip_from 104.24.0.0/14;
	set_real_ip_from 172.64.0.0/13;
	set_real_ip_from 131.0.72.0/22;

	# - IPv6
	set_real_ip_from 2400:cb00::/32;
	set_real_ip_from 2606:4700::/32;
	set_real_ip_from 2803:f800::/32;
	set_real_ip_from 2405:b500::/32;
	set_real_ip_from 2405:8100::/32;
	set_real_ip_from 2a06:98c0::/29;
	set_real_ip_from 2c0f:f248::/32;


}