upstream example_api_backend {
    server 127.0.0.1:8080;
    keepalive 32;
}

server {
    listen 80;
    listen [::]:80;
    server_name api.example.com;
    include /etc/nginx/snippets/acme-challenge.conf;
    location / { return 308 https://api.example.com$request_uri; }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name api.example.com;

    include /etc/nginx/snippets/tls-example.conf;
    include /etc/nginx/snippets/security-headers.conf;
    include /etc/nginx/snippets/hsts.conf;

    client_max_body_size 4m;
    limit_conn conn_per_ip 30;
    limit_req zone=api_per_ip burst=40 nodelay;

    location = /healthz {
        access_log off;
        proxy_pass http://example_api_backend/healthz;
        include /etc/nginx/snippets/proxy-common.conf;
    }

    location = /login {
        limit_req zone=login_per_ip burst=5 nodelay;
        proxy_pass http://example_api_backend;
        include /etc/nginx/snippets/proxy-common.conf;
    }

    location / {
        limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
        proxy_pass http://example_api_backend;
        include /etc/nginx/snippets/proxy-common.conf;
    }
}
