api.strale.io

{
  "example": {
    "config": "# HTTP redirect to HTTPS\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name google.com www.google.com;\n    return 301 https://$server_name$request_uri;\n}\n\n# WWW redirect to non-WWW\nserver {\n    listen 443 ssl http2;\n    listen [::]:443 ssl http2;\n    server_name www.google.com;\n\n    ssl_certificate /etc/letsencrypt/live/google.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/google.com/privkey.pem;\n\n    return 301 https://google.com$request_uri;\n}\n\n# Main server block\nserver {\n    listen 443 ssl http2;\n    listen [::]:443 ssl http2;\n    server_name google.com;\n\n    # SSL Configuration\n    ssl_certificate /etc/letsencrypt/live/google.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/google.com/privkey.pem;\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers HIGH:!aNULL:!MD5;\n    ssl_prefer_server_ciphers on;\n    ssl_session_cache shared:SSL:10m;\n    ssl_session_timeout 10m;\n\n    # Gzip Compression\n    gzip on;\n    gzip_vary on;\n    gzip_min_length 1000;\n    gzip_proxied any;\n    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/atom+xml image/svg+xml application/json;\n    gzip_disable \"msie6\";\n\n    # Security Headers\n    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;\n    add_header X-Frame-Options \"SAMEORIGIN\" always;\n    add_header X-Content-Type-Options \"nosniff\" always;\n    add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n    add_header X-XSS-Protection \"1; mode=block\" always;\n    add_header Permissions-Policy \"geolocation=(), microphone=(), camera=()\" always;\n\n    # Logging\n    access_log /var/log/nginx/google.com.access.log;\n    error_log /var/log/nginx/google.com.error.log;\n\n    # Root location\n    root /var/www/google.com/public;\n\n    location / {\n        proxy_pass http://localhost:3000;\n        \n        # Proxy Headers\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n        proxy_set_header X-Forwarded-Host $server_name;\n\n        # WebSocket Support\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n\n        # Timeouts\n        proxy_connect_timeout 60s;\n        proxy_send_timeout 60s;\n        proxy_read_timeout 60s;\n\n        # Buffering\n        proxy_buffering on;\n        proxy_buffer_size 4k;\n        proxy_buffers 8 4k;\n        proxy_busy_buffers_size 8k;\n    }\n\n    # Health check endpoint (optional)\n    location /health {\n        proxy_pass http://localhost:3000;\n        access_log off;\n    }\n}",
    "domain": "google.com",
    "features_enabled": [
      "SSL/TLS with Let's Encrypt",
      "HTTP to HTTPS redirect",
      "WWW to non-WWW redirect",
      "WebSocket support",
      "Gzip compression",
      "HTTP/2 support",
      "Security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, X-XSS-Protection, Permissions-Policy)",
      "Proxy headers (X-Real-IP, X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host)",
      "Connection pooling and buffering",
      "Request timeouts",
      "Logging"
    ],
    "notes": [
      "Ensure Let's Encrypt certificate exists at /etc/letsencrypt/live/google.com/ before deploying",
      "Update root directory path /var/www/google.com/public to match your application structure",
      "Upstream service must be running on localhost:3000",
      "HSTS header includes preload flag - only add if domain is in HSTS preload list",
      "SSL session cache uses shared memory for better performance across worker processes",
      "WebSocket upgrade headers ensure proper bidirectional communication",
      "Gzip compression excludes compressed formats to avoid double-compression overhead",
      "Consider adjusting proxy timeouts based on application response times",
      "Access logs can be disabled for health check endpoint to reduce log noise",
      "Certificate renewal with Let's Encrypt certbot is required every 90 days"
    ],
    "security_headers_included": [
      "Strict-Transport-Security (HSTS)",
      "X-Frame-Options",
      "X-Content-Type-Options",
      "Referrer-Policy",
      "X-XSS-Protection",
      "Permissions-Policy"
    ],
    "upstream_port": 3000
  },
  "properties": {
    "config": {
      "type": "string"
    },
    "features_enabled": {
      "type": "array"
    },
    "notes": {
      "type": "array"
    },
    "security_headers_included": {
      "type": "array"
    }
  },
  "type": "object"
}