vextoly/gitman

# Install as /etc/nginx/conf.d/gitman-hardening.conf (inside http {}).
# These maps/zones only take effect in GitMan server blocks that reference them.
map $host $gitman_hsts {
    default "";
    gitman.io "max-age=31536000";
    www.gitman.io "max-age=31536000";
}
map "$request_method:$uri" $gitman_auth_key {
    default "";
    ~^POST:/(login|signup|settings/password)/*$ $binary_remote_addr;
}
limit_req_zone $binary_remote_addr zone=gitman_requests:10m rate=20r/s;
limit_req_zone $gitman_auth_key zone=gitman_auth:10m rate=10r/m;
limit_conn_zone $binary_remote_addr zone=gitman_clients:10m;
limit_conn_zone $server_name zone=gitman_total:1m;
limit_conn_zone $binary_remote_addr zone=gitman_git_clients:10m;
limit_conn_zone $server_name zone=gitman_git_total:1m;
limit_conn_zone $binary_remote_addr zone=gitman_import_clients:10m;
limit_conn_zone $server_name zone=gitman_import_total:1m;
log_format gitman_safe '$remote_addr [$time_local] host=$host '
    '"$request_method $uri $server_protocol" $status $body_bytes_sent '
    'request_time=$request_time upstream_time=$upstream_response_time';