Nginx rate limiting and caching configuration

<p>FastAPI is running behind Nginx. Need rate limiting per client IP to prevent abuse, response caching for expensive endpoints, and gzip compression. Currently serving all traffic directly without any of these.</p>

<p>Configure Nginx with rate limiting zones, proxy cache, and gzip:</p> <div class="highlight"><pre><span></span><code><span class="c1"># /etc/nginx/nginx.conf or /etc/nginx/conf.d/default.conf</span> <span class="c1"># Rate limiting zones (define at http level)</span> <span class="k">limit_req_zone</span><span class="w"> </span><span class="nv">$binary_remote_addr</span><span class="w"> </span><span class="s">zone=api_limit:10m</span><span class="w"> </span><span class="s">rate=60r/m</span><span class="p">;</span> <span class="k">limit_req_zone</span><span class="w"> </span><span class="nv">$binary_remote_addr</span><span class="w"> </span><span class="s">zone=write_limit:10m</span><span class="w"> </span><span class="s">rate=20r/m</span><span class="p">;</span> <span class="c1"># Cache zone</span> <span class="k">proxy_cache_path</span><span class="w"> </span><span class="s">/tmp/nginx_cache</span><span class="w"> </span><span class="s">levels=1:2</span><span class="w"> </span><span class="s">keys_zone=api_cache:10m</span><span class="w"> </span><span class="s">max_size=100m</span><span class="w"> </span><span class="s">inactive=60m</span><span class="p">;</span> <span class="k">server</span><span class="w"> </span><span class="p">{</span> <span class="w"> </span><span class="kn">listen</span><span class="w"> </span><span class="mi">80</span><span class="p">;</span> <span class="w"> </span><span class="kn">server_name</span><span class="w"> </span><span class="s">api.example.com</span><span class="p">;</span> <span class="w"> </span><span class="kn">gzip</span><span class="w"> </span><span class="no">on</span><span class="p">;</span> <span class="w"> </span><span class="kn">gzip_types</span><span class="w"> </span><span class="s">application/json</span><span class="w"> </span><span class="s">text/plain</span><span class="p">;</span> <span class="w"> </span><span class="kn">gzip_min_length</span><span class="w"> </span><span class="mi">1024</span><span class="p">;</span> <span class="w"> </span><span class="c1"># Apply rate limit to all routes</span> <span class="w"> </span><span class="kn">limit_req</span><span class="w"> </span><span class="s">zone=api_limit</span><span class="w"> </span><span class="s">burst=20</span><span class="w"> </span><span class="s">nodelay</span><span class="p">;</span> <span class="w"> </span><span class="kn">location</span><span class="w"> </span><span class="s">/api/v1/traces/search</span><span class="w"> </span><span class="p">{</span> <span class="w"> </span><span class="c1"># Stricter limit for expensive search endpoint</span> <span class="w"> </span><span class="kn">limit_req</span><span class="w"> </span><span class="s">zone=api_limit</span><span class="w"> </span><span class="s">burst=10</span><span class="w"> </span><span class="s">nodelay</span><span class="p">;</span> <span class="w"> </span><span class="kn">limit_req_status</span><span class="w"> </span><span class="mi">429</span><span class="p">;</span> <span class="w"> </span><span class="c1"># Cache GET search responses for 30 seconds</span> <span class="w"> </span><span class="kn">proxy_cache</span><span class="w"> </span><span class="s">api_cache</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_cache_key</span><span class="w"> </span><span class="s">"</span><span class="nv">$request_uri$http_x_api_key"</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_cache_valid</span><span class="w"> </span><span class="mi">200</span><span class="w"> </span><span class="s">30s</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_cache_bypass</span><span class="w"> </span><span class="nv">$http_pragma</span><span class="p">;</span> <span class="w"> </span><span class="kn">add_header</span><span class="w"> </span><span class="s">X-Cache-Status</span><span class="w"> </span><span class="nv">$upstream_cache_status</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_pass</span><span class="w"> </span><span class="s">http://api:8000</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_set_header</span><span class="w"> </span><span class="s">Host</span><span class="w"> </span><span class="nv">$host</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_set_header</span><span class="w"> </span><span class="s">X-Real-IP</span><span class="w"> </span><span class="nv">$remote_addr</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_set_header</span><span class="w"> </span><span class="s">X-Forwarded-For</span><span class="w"> </span><span class="nv">$proxy_add_x_forwarded_for</span><span class="p">;</span> <span class="w"> </span><span class="p">}</span> <span class="w"> </span><span class="kn">location</span><span class="w"> </span><span class="s">/api/v1/traces</span><span class="w"> </span><span class="p">{</span> <span class="w"> </span><span class="c1"># Stricter write limit</span> <span class="w"> </span><span class="kn">limit_req</span><span class="w"> </span><span class="s">zone=write_limit</span><span class="w"> </span><span class="s">burst=5</span><span class="w"> </span><span class="s">nodelay</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_pass</span><span class="w"> </span><span class="s">http://api:8000</span><span class="p">;</span> <span class="w"> </span><span class="p">}</span> <span class="w"> </span><span class="kn">location</span><span class="w"> </span><span class="s">/</span><span class="w"> </span><span class="p">{</span> <span class="w"> </span><span class="kn">proxy_pass</span><span class="w"> </span><span class="s">http://api:8000</span><span class="p">;</span> <span class="w"> </span><span class="kn">proxy_read_timeout</span><span class="w"> </span><span class="s">30s</span><span class="p">;</span> <span class="w"> </span><span class="p">}</span> <span class="p">}</span> </code></pre></div> <p>Key: <code>burst</code> allows queuing up to N requests above the rate. <code>nodelay</code> processes burst immediately (no queue delay) but counts against limit. <code>$binary_remote_addr</code> uses 4 bytes vs 15 for the string form — more efficient for large zones.</p>