nginx.conf

events{
    worker_connections 1024;
}

http {
    server {
        listen 80;

        listen 443 ssl;

        # Path to the SSL certificate and private key
        ssl_certificate /etc/nginx/ssl/self-signed.crt;
        ssl_certificate_key /etc/nginx/ssl/self-signed.key;

        # SSL protocols and ciphers
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;

        # Additional security headers (optional)
        add_header Strict-Transport-Security "max-age=31536000" always;

        # 10M plus reserved 1M
        client_max_body_size 11M;

        location / {
            return 200 "Hello World!";
        }

        location /api/identity/ {
            proxy_pass http://identity-service:5000/;
        }

        location /api/file-storage/ {
            auth_request /auth;
            auth_request_set $x_internal_token $upstream_http_x_internal_token;

            # Internal services shouldn't know about the Authorization header.
            proxy_set_header Authorization "";
            proxy_set_header X-Internal-Token $x_internal_token;
            proxy_pass http://file-storage-service:5004/;
            # To prevent the client from seeing the Authorization header.
            proxy_hide_header X-Internal-Token;
        }
        
        location /api/user/v1.0/are-you-a-real-teapot/ {
            proxy_pass http://user-service:5004/v1.0/are-you-a-real-teapot;
        }

        location /api/user/v1.0/username/ {
            proxy_pass http://user-service:5004/v1.0/username/;
        }
        
        location /api/user/ {
            auth_request /auth;
            auth_request_set $x_internal_token $upstream_http_x_internal_token;

            # Internal services shouldn't know about the Authorization header.
            proxy_set_header Authorization "";
            proxy_set_header X-Internal-Token $x_internal_token;
            proxy_pass http://user-service:5004/;
            # To prevent the client from seeing the Authorization header.
            proxy_hide_header X-Internal-Token;
        }

        location /api/messaging/ {
            auth_request /auth;
            auth_request_set $x_internal_token $upstream_http_x_internal_token;

            # Internal services shouldn't know about the Authorization header.
            proxy_set_header Authorization "";
            proxy_set_header X-Internal-Token $x_internal_token;
            proxy_pass http://messaging-service:5000/;
            # To prevent the client from seeing the Authorization header.
            proxy_hide_header X-Internal-Token;
        }

        location /auth {
            proxy_pass http://identity-service:5000/v1.0/identity;
            internal; # Ensure this location is not directly accessible by the client
        }

        location /sms/ {
            proxy_pass http://sms-service-stub:5023/;
        }

        error_page 401 @401.json;
        location @401.json {
            default_type application/json;
            return 401 '{\n\t"error_type": "unauthorized",\n\t"error_message": "Unauthorized."\n}';
        }

        error_page 413 @413.json;
        location @413.json {
            default_type application/json;
            return 413 '{\n\t"error_type": "body_too_large",\n\t"error_message": "Request body is too large."\n}';
        }

        error_page 404 @404.json;
        location @404.json {
            default_type application/json;
            return 404 '{\n\t"error_type": "not_found",\n\t"error_message": "Not Found"\n}';
        }
        
        error_page 500 @500.json;
        location @500.json {
            default_type application/json;
            return 500 '{\n\t"error_type": "internal_error",\n\t"error_message": "Internal Server Error (nginx)"\n}';
        }
        
        error_page 502 @502.json;
        location @502.json {
            default_type application/json;
            return 502 '{\n\t"error_type": "internal_error",\n\t"error_message": "Bad gateway (nginx)"\n}';
        }
    }
}