# Minimal rl-nginx configuration.
#
# For dynamic module builds, copy the built module into nginx's modules
# directory and uncomment the load_module directive below.
#
# load_module modules/ngx_http_rn_module.so;

events {}

http {
  resolver 127.0.0.53 valid=30s ipv6=off;
  resolver_timeout 2s;

  # These are deliberately non-working placeholders. Replace both values.
  ratelimitly_dns_srv  tenant.example.invalid;
  ratelimitly_auth_key rl-aes1REPLACE_WITH_YOUR_KEY;

  ratelimitly_policy   standard unit=50ms;
  ratelimitly_fail     close;
  ratelimitly_debug    off;

  # $remote_addr is textual connection identity. If the real-IP module rewrites
  # it, accept forwarded addresses only from explicitly trusted proxy networks.
  ratelimitly_zone api
    "bucket=v1|scope=api|ip=$remote_addr"
    rate=100r/s;

  server {
    listen 8080;

    location /api/ {
      # Keep labels bounded and free of user, path, header, cookie, and key data.
      ratelimitly_label "scope=api";
      ratelimitly zone=api;
      proxy_pass http://127.0.0.1:9000;
    }
  }
}