apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-template
  labels:
    app: my-app
data:
  backend.conf: |
    server {
      sendfile on;
      tcp_nopush on;
      tcp_nodelay on;

      charset utf-8;
      server_tokens off;
      client_max_body_size 128M;

      set_real_ip_from ${NGINX_GLB_IP};
      set_real_ip_from 130.211.0.0/22;
      set_real_ip_from 35.191.0.0/16;
      real_ip_header X-Forwarded-For;
      real_ip_recursive on;

      listen 3000 default_server;
      listen [::]:3000 default_server;

      server_name _;
      root ${NGINX_ROOT};
      index index.php;

      location / {
        try_files $uri $uri/ /index.php$is_args$args;
      }

      location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_pass 127.0.0.1:9000;
        try_files $uri =404;
      }

      location ~ /\.(?!well-known).* {
          deny all;
      }
    }
  frontend.conf: |
    limit_req_zone $binary_remote_addr zone=frontend_web:50m rate=200r/s;
    limit_req_status 444;

    server {
      sendfile on;
      tcp_nopush on;
      tcp_nodelay on;

      charset utf-8;
      server_tokens off;
      client_max_body_size 128M;

      set_real_ip_from ${NGINX_GLB_IP};
      set_real_ip_from 130.211.0.0/22;
      set_real_ip_from 35.191.0.0/16;
      real_ip_header X-Forwarded-For;
      real_ip_recursive on;

      listen 80 default_server;
      listen [::]:80 default_server;

      server_name _;
      root ${NGINX_ROOT};
      index index.html;

      gzip on;
      gzip_disable "msie6";
      gzip_vary on;
      gzip_proxied any;
      gzip_comp_level 6;
      gzip_buffers 16 8k;
      gzip_http_version 1.1;
      gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

      add_header X-Content-Type-Options nosniff;
      add_header X-XSS-Protection "1; mode=block";
      add_header Strict-Transport-Security "max-age=63072000" always;

      location / {
        limit_req zone=frontend_web burst=100 nodelay;
        try_files $uri $uri/ /index.html;
      }

      location /api/ {
        limit_req zone=frontend_web burst=200 nodelay;
        proxy_pass ${NGINX_BACKEND_API}/;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
        proxy_set_header X-Google-Real-IP $remote_addr;
      }

      location ~* \.(ico|css|js|gif|jpe?g|png|ogg|ogv|svg|svgz|eot|otf|woff2?|map)(\?.+)?$ {
        expires 1h;
        add_header Cache-Control "public";
        access_log off;
        log_not_found off;
        error_log /dev/null crit;
      }

      location ~ /\.(?!well-known).* {
        deny all;
      }
    }
