paradigm_nginx_example

limit_req_zone $http_cf_connecting_ip zone=pradm:200m rate=10r/s;
limit_conn_status 429;
limit_req_status 429;

server {
    listen          80;
    server_name     api.EXAMPLE.com bg.EXAMPLE.com beta.EXAMPLE.com;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/html;
    }
    location = /.well-known/acme-challenge/ {
        return 404;
    }

    location / {
        return 301 https://$host$request_uri;
    }

}

server {
    listen          443 ssl;
    server_name     api.EXAMPLE.com;

    ssl_certificate /etc/letsencrypt/live/api.EXAMPLE.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.EXAMPLE.com/privkey.pem;

    location / {
        limit_req zone=pradm burst=6000; # could also add nodelay to this, so anything after the limit immediately gets 503. Without that, later requests just wait
        proxy_pass http://localhost:3000;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

server {
    listen          443 ssl;
    server_name     bg.EXAMPLE.com;

    ssl_certificate /etc/letsencrypt/live/bg.EXAMPLE.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bg.EXAMPLE.com/privkey.pem;

    location / {
        limit_req zone=pradm burst=6000; # could also add nodelay to this, so anything after the limit immediately gets 503. Without that, later requests just wait
        proxy_pass http://localhost:3000;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

server {
    listen          443 ssl;
    server_name     beta.EXAMPLE.com;

    ssl_certificate /etc/letsencrypt/live/beta.EXAMPLE.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/beta.EXAMPLE.com/privkey.pem;

    location / {
        proxy_pass http://localhost:4000;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}