Erich Blume
b667f21e10
The health check returned 200 immediately on nginx start, before Tailscale connected. Fly.io routed traffic to the new machine with a cold proxy cache and no MagicDNS, causing upstream DNS timeouts. Defer the health check by returning 503 until a sentinel file (/tmp/tailscale-ready) is created after Tailscale connects. This keeps the old machine serving traffic during the startup window. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
95 lines
2.9 KiB
Nginx Configuration File
95 lines
2.9 KiB
Nginx Configuration File
worker_processes auto;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# JSON access log for Alloy to tail → Loki + metric extraction
|
|
log_format json_log escape=json
|
|
'{'
|
|
'"time":"$time_iso8601",'
|
|
'"remote_addr":"$remote_addr",'
|
|
'"client_ip":"$http_fly_client_ip",'
|
|
'"request_method":"$request_method",'
|
|
'"request_uri":"$request_uri",'
|
|
'"status":$status,'
|
|
'"body_bytes_sent":$body_bytes_sent,'
|
|
'"request_time":$request_time,'
|
|
'"upstream_response_time":"$upstream_response_time",'
|
|
'"upstream_cache_status":"$upstream_cache_status",'
|
|
'"http_host":"$http_host",'
|
|
'"http_user_agent":"$http_user_agent"'
|
|
'}';
|
|
access_log /var/log/nginx/access.json.log json_log;
|
|
|
|
# Rate limiting zones — define per-service zones as needed
|
|
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
|
|
|
|
# Proxy cache: 200MB, evict after 24h of no access
|
|
proxy_cache_path /tmp/cache levels=1:2 keys_zone=services:10m
|
|
max_size=200m inactive=24h;
|
|
|
|
# MagicDNS resolver — using a variable in proxy_pass defers upstream DNS
|
|
# resolution to request time, letting nginx start before Tailscale connects.
|
|
# Results are cached for 30s per worker to avoid per-request DNS lookups.
|
|
resolver 100.100.100.100 valid=30s;
|
|
resolver_timeout 5s;
|
|
|
|
# --- docs.eblu.me (static site) ---
|
|
server {
|
|
listen 8080;
|
|
server_name docs.eblu.me;
|
|
|
|
limit_req zone=general burst=20 nodelay;
|
|
|
|
location / {
|
|
set $upstream_docs https://docs.tail8d86e.ts.net;
|
|
proxy_pass $upstream_docs$request_uri;
|
|
proxy_ssl_verify off;
|
|
proxy_ssl_server_name on;
|
|
|
|
# Cache aggressively — static site only.
|
|
# Do NOT use these settings for dynamic services.
|
|
proxy_cache services;
|
|
proxy_cache_valid 200 1d;
|
|
proxy_cache_valid 404 1m;
|
|
proxy_cache_use_stale error timeout updating;
|
|
proxy_cache_lock on;
|
|
|
|
# Prevent cache-busting: ignore query strings and
|
|
# client cache-control headers.
|
|
# Safe for static sites; breaks dynamic services.
|
|
proxy_cache_key $host$uri;
|
|
proxy_ignore_headers Cache-Control Set-Cookie;
|
|
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|
|
|
|
}
|
|
|
|
# Catch-all: reject unknown hosts, but serve health check
|
|
server {
|
|
listen 8080 default_server;
|
|
|
|
location /healthz {
|
|
if (!-f /tmp/tailscale-ready) {
|
|
return 503 "starting\n";
|
|
}
|
|
return 200 "ok\n";
|
|
}
|
|
|
|
location /stub_status {
|
|
stub_status;
|
|
allow 127.0.0.1;
|
|
deny all;
|
|
}
|
|
|
|
location / {
|
|
return 444;
|
|
}
|
|
}
|
|
}
|