auth.conf

# ─── Rate limiting zones (must be in http {} block) ───────────────
# Add these to your main nginx.conf inside the http {} block:
#
#   limit_req_zone $binary_remote_addr zone=auth_login:10m rate=5r/s;
#   limit_req_zone $binary_remote_addr zone=auth_general:10m rate=30r/s;

server {
    server_tokens off;
    server_name auth.example.com;

    location / {
        # Stricter rate limit on auth endpoints
        limit_req zone=auth_general burst=20 nodelay;

        proxy_pass http://127.0.0.1:5300;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;

        # Security headers
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;
        add_header Referrer-Policy strict-origin-when-cross-origin always;
    }

    # Tighter limit on login/register
    location ~ ^/auth/(login|register) {
        limit_req zone=auth_login burst=3 nodelay;

        proxy_pass http://127.0.0.1:5300;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 80;
}