/deployments/nginx/nginx.conf

worker_processes auto;

events {
    worker_connections 8192;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 75;
    keepalive_requests 10000;
    server_tokens off;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    upstream clawreef_backend {
        server 127.0.0.1:9001;
        keepalive 128;
    }

    server {
        listen 8443 ssl;
        http2 on;
        server_name _;

        ssl_certificate /etc/nginx/tls/tls.crt;
        ssl_certificate_key /etc/nginx/tls/tls.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers off;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 1d;

        root /usr/share/nginx/html;
        index index.html;

        # Allow runtime workspace archives through the API.
        # Default nginx client_max_body_size (1 MiB) would reject normal
        # workspace uploads at the edge with 413 Content Too Large before
        # the request reaches the backend. start.sh rewrites this value from
        # CLAWMANAGER_WORKSPACE_ARCHIVE_MAX_MIB when set.
        client_max_body_size 500m;

        location = /healthz {
            access_log off;
            add_header Content-Type text/plain;
            return 200 'ok';
        }

        location ~ ^/api/v1/instances/[0-9]+/proxy/? {
            proxy_pass http://clawreef_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_connect_timeout 15s;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_buffering off;
            proxy_request_buffering off;
        }

        location /api/ {
            proxy_pass http://clawreef_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_connect_timeout 15s;
            proxy_read_timeout 3600s;
        }

        location / {
            try_files $uri $uri/ /index.html;
        }
    }
}