1 map $uri $nominatim_script_name {
7 map $uri $nominatim_path_info {
11 map $query_string $email_id {
12 ~(^|&)email=([^&]+) $2;
15 upstream nominatim_service {
16 server 127.0.0.1:<%= @pools[:www][:port ]%>;
22 <% @frontends.each do |frontend| -%>
23 <% frontend.ipaddresses(:role => :external) do |address| -%>
33 map $http_user_agent $blocked_user_agent {
35 include <%= @confdir %>/nginx_blocked_user_agent.conf;
38 map $http_referer $blocked_referrer {
40 include <%= @confdir %>/nginx_blocked_referrer.conf;
43 map $whitelisted $limit_www {
45 0 $binary_remote_addr;
48 map $blocked_user_agent $limit_tarpit {
50 1 $binary_remote_addr;
51 2 $binary_remote_addr;
54 limit_req_zone $limit_www zone=www:50m rate=2r/s;
55 limit_req_zone $limit_tarpit zone=tarpit:10m rate=1r/s;
56 limit_req_zone $binary_remote_addr zone=blocked:10m rate=20r/m;
59 listen 80 default_server;
60 listen [::]:80 default_server;
62 location /nginx_status {
70 rewrite ^/\.well-known/acme-challenge/(.*)$ http://acme.openstreetmap.org/.well-known/acme-challenge/$1 permanent;
73 return 301 https://$host$request_uri;
79 listen 443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
81 listen [::]:443 ssl deferred backlog=16384 reuseport fastopen=2048 http2 default_server;
82 server_name localhost;
84 ssl_certificate /etc/ssl/certs/<%= node[:fqdn] %>.pem;
85 ssl_certificate_key /etc/ssl/private/<%= node[:fqdn] %>.key;
87 root <%= @directory %>/website;
90 access_log <%= node[:nominatim][:logdir] %>/nominatim.openstreetmap.org-access.log combined;
91 error_log <%= node[:nominatim][:logdir] %>/nominatim.openstreetmap.org-error.log;
93 location /nginx_status {
101 error_page 403 /403.html;
103 limit_req zone=blocked burst=5;
106 error_page 429 /509.html;
108 limit_req zone=blocked burst=5;
112 set $anyid $http_referer$http_user_agent$email_id;
115 if ($blocked_user_agent ~ ^2$)
117 if ($blocked_referrer)
120 try_files $uri $uri/ @php;
124 limit_req zone=www burst=10;
125 limit_req zone=tarpit burst=2;
126 limit_req_status 429;
127 fastcgi_pass nominatim_service;
128 include fastcgi_params;
129 fastcgi_param QUERY_STRING $args;
130 fastcgi_param PATH_INFO "$nominatim_path_info";
131 fastcgi_param SCRIPT_FILENAME "$document_root/$nominatim_script_name";
135 limit_req zone=www burst=10;
136 limit_req zone=tarpit burst=2;
137 limit_req_status 429;
138 fastcgi_pass nominatim_service;
139 include fastcgi_params;
140 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;