Update Nginx configuration for improved request handling and connection limits

Author: mbuechner

config/nginx/nginx.conf

@@ -30,7 +30,7 @@ http {
     client_body_buffer_size     16k;
     client_header_buffer_size   4k;
     large_client_header_buffers 8 16K;
-    keepalive_timeout           1200s;
+    keepalive_timeout           75s;
     keepalive_requests          100;
     reset_timedout_connection   off;
     tcp_nodelay                 on;
@@ -113,8 +113,20 @@ http {
                                 text/x-component
                                 text/x-cross-domain-policy;
 
-    real_ip_header              X-Real-IP;
-    real_ip_recursive           off;
+    real_ip_header              X-Forwarded-For;
+    real_ip_recursive           on;
+
+    set_real_ip_from            127.0.0.1;
+    set_real_ip_from            10.0.0.0/8;
+    set_real_ip_from            172.16.0.0/12;
+    set_real_ip_from            192.168.0.0/16;
+
+    limit_req_status            429;
+    limit_conn_status           429;
+
+    limit_req_zone              $binary_remote_addr zone=drupal_rps:20m rate=5r/s;
+    limit_req_zone              $binary_remote_addr zone=drupal_heavy:20m rate=1r/s;
+    limit_conn_zone             $binary_remote_addr zone=perip_conn:20m;
 
     add_header                  X-XSS-Protection '1; mode=block';
     add_header                  X-Frame-Options SAMEORIGIN;

config/nginx/preset.conf

@@ -73,6 +73,12 @@ location / {
         try_files $uri @drupal;
     }
 
+    location ~* ^/(search|jsonapi|graphql)(/|$) {
+        limit_conn perip_conn 5;
+        limit_req  zone=drupal_heavy burst=10 nodelay;
+        try_files $uri @drupal;
+    }
+
 
     location ~* ^(?:.+\.(?:make|txt|engine|inc|info|install|module|profile|po|pot|sh|.*sql|test|theme|tpl(?:\.php)?|xtmpl)|code-style\.pl|/Entries.*|/Repository|/Root|/Tag|/Template)$ {
         return 404;
@@ -96,6 +102,8 @@ location / {
 }
 
 location @drupal {
+    limit_conn perip_conn 10;
+    limit_req  zone=drupal_rps burst=30 nodelay;
     include fastcgi.conf;
     fastcgi_param QUERY_STRING $query_string;
     fastcgi_param SCRIPT_NAME /index.php;
@@ -104,6 +112,8 @@ location @drupal {
 }
 
 location @drupal-no-args {
+    limit_conn perip_conn 10;
+    limit_req  zone=drupal_rps burst=30 nodelay;
     include fastcgi.conf;
     fastcgi_param QUERY_STRING q=$uri;
     fastcgi_param SCRIPT_NAME /index.php;
@@ -112,6 +122,8 @@ location @drupal-no-args {
 }
 
 location = /index.php {
+    limit_conn perip_conn 10;
+    limit_req  zone=drupal_rps burst=30 nodelay;
     fastcgi_pass php;
 }