Skip to content

Commit 5190d47

Browse files
hurtkihurtki
committed
refactor(nginx): enforce Cloudflare IP check before real_ip processing and tidy config
1 parent 3a50f19 commit 5190d47

File tree

1 file changed

+73
-79
lines changed

1 file changed

+73
-79
lines changed

‎nginx/nginx.prod.conf‎

Lines changed: 73 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,124 +1,118 @@
1-
# --- CLOUDFLARE REAL IP SETUP ---
2-
set_real_ip_from 173.245.48.0/20;
3-
set_real_ip_from 103.21.244.0/22;
4-
set_real_ip_from 103.22.200.0/22;
5-
set_real_ip_from 103.31.4.0/22;
6-
set_real_ip_from 141.101.64.0/18;
7-
set_real_ip_from 108.162.192.0/18;
8-
set_real_ip_from 190.93.240.0/20;
9-
set_real_ip_from 188.114.96.0/20;
10-
set_real_ip_from 197.234.240.0/22;
11-
set_real_ip_from 198.41.128.0/17;
12-
set_real_ip_from 162.158.0.0/15;
13-
set_real_ip_from 104.16.0.0/13;
14-
set_real_ip_from 104.24.0.0/14;
15-
set_real_ip_from 172.64.0.0/13;
16-
set_real_ip_from 131.0.72.0/22;
17-
set_real_ip_from 2400:cb00::/32;
18-
set_real_ip_from 2606:4700::/32;
19-
set_real_ip_from 2803:f800::/32;
20-
set_real_ip_from 2405:b500::/32;
21-
set_real_ip_from 2405:8100::/32;
22-
set_real_ip_from 2a06:98c0::/29;
23-
set_real_ip_from 2c0f:f248::/32;
24-
25-
# Set the header to the real client IP provided by Cloudflare
26-
real_ip_header CF-Connecting-IP;
27-
281
# --- API rate limiting ---
29-
#limit how many simultaneous connections a single IP can hold open
2+
# limit how many simultaneous connections a single IP can hold open
303
limit_conn_zone $binary_remote_addr zone=limit_conn_per_ip:10m;
314

32-
limit_req_zone $binary_remote_addr zone=create_limit:10m rate=5r/m;
5+
limit_req_zone $binary_remote_addr zone=create_limit:10m rate=5r/m;
336
limit_req_zone $binary_remote_addr zone=preview_limit:10m rate=20r/m;
34-
limit_req_zone $binary_remote_addr zone=api:10m rate=100r/m;
7+
limit_req_zone $binary_remote_addr zone=api:10m rate=100r/m;
358

36-
limit_req_zone $binary_remote_addr zone=create_hourly:10m rate=1r/m; # 60 req per hour
9+
limit_req_zone $binary_remote_addr zone=create_hourly:10m rate=1r/m; # 60 req per hour
3710
limit_req_zone $binary_remote_addr zone=preview_hourly:10m rate=3r/m; # 180 req per hour
3811

3912
limit_req_status 429;
4013
limit_conn_status 429;
4114
limit_req_log_level warn;
4215

43-
#Auto blocking known scraping tools
44-
map $http_user_agent $bad_bot {
45-
default 0;
46-
"" 1;
47-
~*(wget|curl|scrapy|python-requests|postman|insomnia) 1;
16+
# --- Cloudflare IP check (uses original IP before real_ip substitution) ---
17+
geo $realip_remote_addr $not_cloudflare {
18+
default 1;
19+
173.245.48.0/20 0;
20+
103.21.244.0/22 0;
21+
103.22.200.0/22 0;
22+
103.31.4.0/22 0;
23+
141.101.64.0/18 0;
24+
108.162.192.0/18 0;
25+
190.93.240.0/20 0;
26+
188.114.96.0/20 0;
27+
197.234.240.0/22 0;
28+
198.41.128.0/17 0;
29+
162.158.0.0/15 0;
30+
104.16.0.0/13 0;
31+
104.24.0.0/14 0;
32+
172.64.0.0/13 0;
33+
131.0.72.0/22 0;
34+
2400:cb00::/32 0;
35+
2606:4700::/32 0;
36+
2803:f800::/32 0;
37+
2405:b500::/32 0;
38+
2405:8100::/32 0;
39+
2a06:98c0::/29 0;
40+
2c0f:f248::/32 0;
4841
}
4942

5043
# --- HTTPS thorugh Cloudflare Origin Certificate ---
5144
server {
5245
listen 443 ssl;
5346
server_name _;
5447

55-
ssl_certificate /etc/nginx/ssl/cert.pem;
48+
ssl_certificate /etc/nginx/ssl/cert.pem;
5649
ssl_certificate_key /etc/nginx/ssl/key.pem;
5750

58-
root /var/www/;
59-
allow 173.245.48.0/20;
60-
allow 103.21.244.0/22;
61-
allow 103.22.200.0/22;
62-
allow 103.31.4.0/22;
63-
allow 141.101.64.0/18;
64-
allow 108.162.192.0/18;
65-
allow 190.93.240.0/20;
66-
allow 188.114.96.0/20;
67-
allow 197.234.240.0/22;
68-
allow 198.41.128.0/17;
69-
allow 162.158.0.0/15;
70-
allow 104.16.0.0/13;
71-
allow 104.24.0.0/14;
72-
allow 172.64.0.0/13;
73-
allow 131.0.72.0/22;
74-
allow 2400:cb00::/32;
75-
allow 2606:4700::/32;
76-
allow 2803:f800::/32;
77-
allow 2405:b500::/32;
78-
allow 2405:8100::/32;
79-
allow 2a06:98c0::/29;
80-
allow 2c0f:f248::/32;
81-
deny all; #if ip is not from the above list then they will get 403
51+
# --- CLOUDFLARE REAL IP SETUP ---
52+
set_real_ip_from 173.245.48.0/20;
53+
set_real_ip_from 103.21.244.0/22;
54+
set_real_ip_from 103.22.200.0/22;
55+
set_real_ip_from 103.31.4.0/22;
56+
set_real_ip_from 141.101.64.0/18;
57+
set_real_ip_from 108.162.192.0/18;
58+
set_real_ip_from 190.93.240.0/20;
59+
set_real_ip_from 188.114.96.0/20;
60+
set_real_ip_from 197.234.240.0/22;
61+
set_real_ip_from 198.41.128.0/17;
62+
set_real_ip_from 162.158.0.0/15;
63+
set_real_ip_from 104.16.0.0/13;
64+
set_real_ip_from 104.24.0.0/14;
65+
set_real_ip_from 172.64.0.0/13;
66+
set_real_ip_from 131.0.72.0/22;
67+
set_real_ip_from 2400:cb00::/32;
68+
set_real_ip_from 2606:4700::/32;
69+
set_real_ip_from 2803:f800::/32;
70+
set_real_ip_from 2405:b500::/32;
71+
set_real_ip_from 2405:8100::/32;
72+
set_real_ip_from 2a06:98c0::/29;
73+
set_real_ip_from 2c0f:f248::/32;
74+
# Set the header to the real client IP provided by Cloudflare
75+
real_ip_header CF-Connecting-IP;
8276

83-
client_body_timeout 10s;
77+
if ($not_cloudflare) {
78+
return 403;
79+
}
80+
81+
root /var/www/;
82+
client_body_timeout 10s;
8483
client_header_timeout 10s;
85-
keepalive_timeout 15s;
86-
send_timeout 10s;
84+
keepalive_timeout 15s;
85+
send_timeout 10s;
8786

8887
# --- API proxy ---
8988
location = /banners {
90-
if ($bad_bot) {
91-
return 403; #Forbidden
92-
}
9389
limit_conn limit_conn_per_ip 5;
94-
limit_req zone=create_limit burst=3 nodelay;
90+
limit_req zone=create_limit burst=3 nodelay;
9591
limit_req zone=create_hourly burst=50 nodelay;
9692

9793
proxy_pass http://api;
98-
proxy_set_header Host $host;
94+
proxy_set_header Host $host;
9995
proxy_set_header X-Real-IP $remote_addr;
10096
}
97+
10198
location ^~ /banners/preview {
102-
if ($bad_bot){
103-
return 403; #Forbidden
104-
}
10599
limit_conn limit_conn_per_ip 10;
106-
limit_req zone=preview_limit burst=10 nodelay;
107-
limit_req zone=preview_hourly burst=200 nodelay;
100+
limit_req zone=preview_limit burst=10 nodelay;
101+
limit_req zone=preview_hourly burst=200 nodelay;
108102

109103
proxy_pass http://api;
110-
proxy_set_header Host $host;
104+
proxy_set_header Host $host;
111105
proxy_set_header X-Real-IP $remote_addr;
112106
}
113107

114108
# --- Static banners serving ---
115109
location ^~ /banners/ {
116110
try_files $uri.svg /banners/default;
117-
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
118-
add_header Last-Modified "";
111+
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
112+
add_header Last-Modified "";
119113
etag off;
120-
add_header Pragma "no-cache" always;
121-
add_header Expires "0" always;
114+
add_header Pragma "no-cache" always;
115+
add_header Expires "0" always;
122116
add_header Surrogate-Control "no-store" always;
123117
}
124118
}

0 commit comments

Comments
 (0)