# Rate limit zone: 50r/s per IP, 10MB shared memory
limit_req_zone $binary_remote_addr zone=scraper_limit:10m rate=50r/s;

upstream scraper_backend {
    server 172.19.0.2:3091;
    keepalive 16;
}

server {
    listen 127.0.0.1:3089;
    listen [::1]:3089;

    # ── Security headers ──────────────────────────────────────────────
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "no-referrer" always;

    # ── Rate limiting ─────────────────────────────────────────────────
    limit_req zone=scraper_limit burst=100 nodelay;
    limit_req_status 429;

    # ── Logging ───────────────────────────────────────────────────────
    access_log /var/log/nginx/scraper_access.log;
    error_log  /var/log/nginx/scraper_error.log warn;

    location / {
        proxy_pass http://scraper_backend;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_connect_timeout 10s;
        proxy_send_timeout 10s;
        proxy_read_timeout 30s;

        proxy_buffering off;
    }
}
