@codai/cbd/nginx.conf

Codai Better Database - High-Performance Vector Memory System with HPKV-inspired architecture and MCP server

# 🌐 CBD Universal Database - Production Nginx Configuration

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    # Basic Settings
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # Logging
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
                    
    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log warn;
    
    # Performance
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    client_max_body_size 100M;
    
    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
    
    # Rate limiting
    limit_req_zone $binary_remote_addr zone=api:10m rate=100r/s;
    limit_req_zone $binary_remote_addr zone=graphql:10m rate=50r/s;
    
    # Upstream servers for load balancing
    upstream cbd_core_backend {
        least_conn;
        server cbd-core:4180 max_fails=3 fail_timeout=30s;
        keepalive 32;
    }
    
    upstream cbd_collaboration_backend {
        ip_hash; # Sticky sessions for WebSocket
        server cbd-collaboration:4600 max_fails=3 fail_timeout=30s;
        keepalive 16;
    }
    
    upstream cbd_analytics_backend {
        least_conn;
        server cbd-analytics:4700 max_fails=3 fail_timeout=30s;
        keepalive 16;
    }
    
    upstream cbd_graphql_backend {
        least_conn;
        server cbd-graphql:4800 max_fails=3 fail_timeout=30s;
        keepalive 16;
    }
    
    # Health check endpoint
    server {
        listen 80;
        server_name health.cbd.local;
        
        location / {
            return 200 "CBD Load Balancer Healthy\n";
            add_header Content-Type text/plain;
        }
    }
    
    # Main server block
    server {
        listen 80;
        server_name api.cbd.codai.ai cbd.codai.ai;
        
        # Security headers
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;
        add_header X-XSS-Protection "1; mode=block";
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        
        # CBD Core API
        location / {
            limit_req zone=api burst=20 nodelay;
            
            proxy_pass http://cbd_core_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_cache_bypass $http_upgrade;
            
            # Timeouts
            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
            
            # Health check
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
        }
        
        # Collaboration Service (WebSocket support)
        location /collaboration/ {
            proxy_pass http://cbd_collaboration_backend/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # WebSocket specific settings
            proxy_read_timeout 86400;
            proxy_send_timeout 86400;
            proxy_connect_timeout 60s;
        }
        
        # AI Analytics Service
        location /analytics/ {
            limit_req zone=api burst=10 nodelay;
            
            proxy_pass http://cbd_analytics_backend/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # Longer timeout for AI processing
            proxy_connect_timeout 120s;
            proxy_send_timeout 120s;
            proxy_read_timeout 120s;
        }
        
        # GraphQL Gateway
        location /graphql {
            limit_req zone=graphql burst=10 nodelay;
            
            proxy_pass http://cbd_graphql_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # CORS headers for GraphQL
            add_header Access-Control-Allow-Origin "*";
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
            add_header Access-Control-Allow-Headers "Authorization, Content-Type";
            
            if ($request_method = 'OPTIONS') {
                return 204;
            }
        }
        
        # Static files and documentation
        location /docs/ {
            alias /usr/share/nginx/html/docs/;
            expires 1h;
            add_header Cache-Control "public, immutable";
        }
        
        # Monitoring endpoints
        location /metrics {
            proxy_pass http://cbd_core_backend/metrics;
            allow 172.20.0.0/16; # Only allow internal network
            deny all;
        }
        
        # Health checks
        location /health {
            access_log off;
            proxy_pass http://cbd_core_backend/health;
            proxy_connect_timeout 5s;
            proxy_read_timeout 5s;
        }
        
        # Error pages
        error_page 404 /404.html;
        error_page 500 502 503 504 /50x.html;
        
        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }
    
    # HTTPS server (if SSL certificates are available)
    server {
        listen 443 ssl http2;
        server_name api.cbd.codai.ai cbd.codai.ai;
        
        # SSL configuration
        ssl_certificate /etc/nginx/ssl/cert.pem;
        ssl_certificate_key /etc/nginx/ssl/key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;
        ssl_dhparam /etc/nginx/ssl/dhparam.pem;
        
        # SSL optimization
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_session_tickets off;
        
        # HSTS
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        
        # Same location blocks as HTTP server
        include /etc/nginx/conf.d/cbd_locations.conf;
    }
}