email-list.nginx.conf

# Nginx reverse-proxy configuration for email-list
#
# Place this file at /etc/nginx/sites-available/email-list and enable it:
#
#   ln -s /etc/nginx/sites-available/email-list /etc/nginx/sites-enabled/
#   nginx -t && systemctl reload nginx
#
# Replace example.com with your actual domain.
# Obtain a TLS certificate first, e.g.:
#   certbot --nginx -d example.com

server {
    listen 80;
    listen [::]:80;
    server_name example.com;

    # Redirect all HTTP traffic to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name example.com;

    # TLS — managed by Certbot or supply your own paths
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # Only the /subscribe endpoint is exposed
    location = /subscribe {
        proxy_pass         http://127.0.0.1:3000/subscribe;
        proxy_http_version 1.1;

        # Pass the real client IP so the app can rate-limit by IP correctly.
        # $remote_addr is the IP of the direct connection to this nginx instance.
        # If nginx is itself behind an upstream proxy (e.g. Cloudflare, a load
        # balancer), $remote_addr will be that proxy's IP rather than the end
        # client's IP, which would cause all users to share a single rate-limit
        # bucket. In that case, use the trusted upstream header instead, e.g.:
        #   proxy_set_header X-Forwarded-For $http_x_forwarded_for;
        # and ensure the upstream proxy is the only source of that header.
        proxy_set_header X-Forwarded-For $remote_addr;

        # Strip headers that should not reach the upstream
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;

        # Only POST is accepted; reject everything else at the nginx level
        limit_except POST {
            deny all;
        }

        # Restrict body size to slightly above the app's own 1 KB limit so
        # nginx rejects obviously oversized requests before they reach Node
        client_max_body_size 2k;

        # Timeouts
        proxy_connect_timeout 5s;
        proxy_send_timeout    10s;
        proxy_read_timeout    10s;
    }

    # Block all other paths
    location / {
        return 404;
    }
}