nginx.conf

# SPDX-License-Identifier: MIT
# SPDX-FileCopyrightText: 2026 Marcus Quinn

worker_processes 1;
pid /run/buzz/nginx.pid;
error_log /run/buzz/nginx-error.log info;

events {
	worker_connections 1024;
}

http {
	access_log /run/buzz/nginx-access.log;
	client_body_temp_path /run/buzz/nginx/client-body;
	fastcgi_temp_path /run/buzz/nginx/fastcgi;
	proxy_temp_path /run/buzz/nginx/proxy;
	scgi_temp_path /run/buzz/nginx/scgi;
	uwsgi_temp_path /run/buzz/nginx/uwsgi;

	map $http_upgrade $connection_upgrade {
		default upgrade;
		'' close;
	}
	map $http_x_forwarded_for $pairing_client_key {
		~(?<pairing_client_address>[0-9A-Fa-f:.]+)\s*$ $pairing_client_address;
		default $binary_remote_addr;
	}

	limit_conn_zone $server_addr zone=pairing_global:10m;
	limit_conn_zone $pairing_client_key zone=pairing_per_client:10m;

	upstream buzz_relay {
		server 127.0.0.1:3001;
		keepalive 16;
	}

	upstream buzz_pairing_relay {
		server 127.0.0.1:5000;
	}

	server {
		listen 0.0.0.0:3000;
		server_name _;
		client_header_timeout 10s;

		location = /pair {
			limit_conn pairing_global 128;
			limit_conn pairing_per_client 4;
			limit_except GET { deny all; }
			client_body_timeout 10s;
			client_max_body_size 8k;
			proxy_pass http://buzz_pairing_relay;
			proxy_http_version 1.1;
			proxy_set_header Host $host;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
			proxy_buffering off;
			proxy_connect_timeout 5s;
			proxy_read_timeout 130s;
			proxy_send_timeout 130s;
		}

		location / {
			client_max_body_size 0;
			proxy_pass http://buzz_relay;
			proxy_http_version 1.1;
			proxy_set_header Host $host;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
			proxy_buffering off;
			proxy_request_buffering off;
			proxy_read_timeout 3600s;
			proxy_send_timeout 3600s;
		}
	}
}