ohmu/dev/config/otel-ratelimit/nginx.conf

worker_processes 1;
events { worker_connections 1024; }

http {
    # Real client IP: edge Caddy edastab X-Forwarded-For. Usalda tailneti (100.64.0.0/10)
    # ja edge'i avalikku IP-d; real_ip_recursive off -> võetakse XFF-i viimane (päris klient).
    set_real_ip_from 100.64.0.0/10;
    set_real_ip_from 188.166.84.16;
    real_ip_header X-Forwarded-For;
    real_ip_recursive off;

    # Rate-limit: 20 päringut/s IP kohta, puhverdus 60 (nodelay = kohe).
    limit_req_zone $binary_remote_addr zone=otlp:10m rate=20r/s;
    limit_req_status 429;
    limit_conn_zone $binary_remote_addr zone=otlpconn:10m;

    log_format main '$remote_addr "$request" $status';
    access_log /dev/stdout main;

    upstream collector { server clickstack:4318; }

    server {
        listen 4319;

        location / {
            limit_req zone=otlp burst=60 nodelay;
            limit_conn otlpconn 40;

            proxy_pass http://collector;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Authorization $http_authorization;
            proxy_request_buffering off;
            proxy_read_timeout 60s;
            client_max_body_size 10m;
        }
    }
}