nginx.conf

user  nginx;
worker_processes  auto;
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

# Events block
 events {
    worker_connections  1024;
}

# HTTP block
http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    # log_format  proxy_debug  '$remote_addr - $remote_user [$time_local] '
    #                          '"$request" '
    #                          'status=$status bytes=$body_bytes_sent '
    #                          'referer="$http_referer" '
    #                          'valid_referer=$valid_referer '
    #                          'host="$http_host" '
    #                          'upstream_status="$upstream_status" '
    #                          'upstream_response_time="$upstream_response_time" '
    #                          'request_uri="$request_uri" '
    #                          'args="$args" '
    #                          'location="$sent_http_location" '
    #                          'upstream_http_location="$upstream_http_location" '
    #                          'captured_path="$captured_path" '
    #                          'proxied_url="$proxied_url"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    # Public Pokedex Tracker data is shared by every visitor, so retain it briefly
    # at the edge while allowing a stale response during an upstream refresh.
    proxy_cache_path /var/cache/nginx/catchemall
                     levels=1:2
                     keys_zone=catchemall_api:10m
                     inactive=1h
                     max_size=100m;

    server {
        listen       80;
        server_name  _;

        # Security headers
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options DENY;
        add_header X-XSS-Protection "1; mode=block";

        # Gzip compression
        gzip on;
        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        # Specify DNS resolver for variables
        resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 valid=300s;
        resolver_timeout 5s;  # Timeout for DNS resolution

        location ~ ^/gobble/static/(.*)$ {
            # access_log /var/log/nginx/proxy_debug.log proxy_debug;

            set $captured_path $1;

            # Prevent this public proxy from being used as an open PostHog relay.
            # Allow localhost plus the apex domain and its subdomains, with ports.
            set $valid_referer 0;
            if ($http_referer ~* "^https?://(localhost|([a-zA-Z0-9-]+\.)?vivekraman\.dev)(:[0-9]+)?(/|$)") {
                set $valid_referer 1;
            }
            if ($valid_referer = 0) {
                return 403;
            }

            set $posthog_static "https://us-assets.i.posthog.com/static/";
            set $proxied_url "$posthog_static$captured_path$is_args$args";
            # use variable to force proper DNS re-resolution, also must manually pass along path
            proxy_pass $proxied_url;
            proxy_set_header Host "us-assets.i.posthog.com";
            proxy_ssl_server_name on;
            proxy_set_header Cookie $http_cookie;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;
            # proxy_set_header Authorization $http_authorization;
        }

        location ~ ^/gobble/(.*)$ {
            # access_log /var/log/nginx/proxy_debug.log proxy_debug;

            set $captured_path $1;

            # Keep the browser event URL distinct from PostHog ingestion paths.
            if ($captured_path = "event/") {
                set $captured_path "i/v0/e/";
            }

            # Prevent this public proxy from being used as an open PostHog relay.
            # Allow localhost plus the apex domain and its subdomains, with ports.
            set $valid_referer 0;
            if ($http_referer ~* "^https?://(localhost|([a-zA-Z0-9-]+\.)?vivekraman\.dev)(:[0-9]+)?(/|$)") {
                set $valid_referer 1;
            }
            if ($valid_referer = 0) {
                return 403;
            }

            set $posthog_main "https://us.i.posthog.com/";
            set $proxied_url "$posthog_main$captured_path$is_args$args";
            # use variable to force proper DNS re-resolution, also must manually pass along path
            proxy_pass $proxied_url;
            proxy_set_header Host "us.i.posthog.com";
            proxy_ssl_server_name on;
            proxy_set_header Cookie $http_cookie;
            # proxy_set_header Authorization $http_authorization;
        }

        # The tracker API does not send a browser-accessible CORS header. Proxy its
        # API under one same-origin prefix. Keep this site's trailing-slash URLs,
        # while normalizing the upstream path because its API rejects them.
        location /catchemall/api/ {
            rewrite ^/catchemall/api/(.*)/$ /api/$1 break;
            rewrite ^/catchemall/api/(.*)$ /api/$1 break;
            proxy_pass https://pokedextracker.com;
            proxy_cache catchemall_api;
            proxy_cache_valid 200 30m;
            proxy_cache_valid 404 1m;
            proxy_cache_lock on;
            proxy_cache_background_update on;
            proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
            proxy_hide_header Cache-Control;
            add_header Cache-Control "public, max-age=1800" always;
            proxy_set_header Host pokedextracker.com;
            proxy_ssl_server_name on;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # The catalog is a separate content-hashed asset, independent of captures.
        location ~ ^/_astro/pokemon-catalog\.[^/]+\.js$ {
            root /usr/share/nginx/html;
            try_files $uri =404;
            add_header Cache-Control "public, max-age=31536000, immutable";
        }

        # Sheet URLs include a content hash query parameter, so they can be cached
        # indefinitely and are replaced automatically after regeneration.
        location ^~ /catchemall/sprites/ {
            root /usr/share/nginx/html;
            try_files $uri =404;
            add_header Cache-Control "public, max-age=31536000, immutable" always;
        }

        # RFC 8288 Link headers on homepage; RFC 9727 api-catalog GET body (`application/linkset+json`)
        location = / {
            root   /usr/share/nginx/html;
            try_files /index.html =404;
            add_header X-Content-Type-Options nosniff;
            add_header X-Frame-Options DENY;
            add_header X-XSS-Protection "1; mode=block";
            add_header Link '</.well-known/api-catalog>; rel="api-catalog", </sitemap-index.xml>; rel="describedby"' always;
        }

        location = /.well-known/api-catalog {
            root         /usr/share/nginx/html;
            default_type application/linkset+json;
        }

        # Error pages
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

        # Serve static files
        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }
    }
}