Livrare LOT 1 - Didi

ai_platform/modules/gateway/deploy/nginx.conf.template

@@ -0,0 +1,169 @@
+worker_processes auto;
+error_log /var/log/nginx/error.log warn;
+pid /var/run/nginx.pid;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    # ======================================================================
+    # Logging
+    # ======================================================================
+    log_format main '$remote_addr [$time_local] "$request" '
+                    '$status $body_bytes_sent rt=$request_time '
+                    'auth=$auth_status';
+
+    access_log /var/log/nginx/access.log main;
+
+    # Hide nginx version
+    server_tokens off;
+
+    # ======================================================================
+    # Bearer Token Authentication
+    # ======================================================================
+    map_hash_bucket_size 128;
+    map $http_authorization $auth_status {
+        default       "denied";
+        "Bearer ${GATEWAY_API_TOKEN}" "ok";
+    }
+
+    # ======================================================================
+    # Upstreams
+    # ======================================================================
+    # NOTE: nginx resolves all upstream hostnames at config load time.
+    # Missing names abort startup, so only deployed services are listed here.
+    # Re-enable an upstream when its container exists on this host.
+    #
+    # upstream llm {
+    #     server didiAI-llm-api:14011;
+    # }
+    #
+    # upstream audio {
+    #     server didiAI-audio-api:54300;
+    # }
+
+    upstream web {
+        server didiAI-web-api:51100;
+    }
+
+    upstream catalog {
+        server didiAI-catalog-api:11000;
+    }
+
+    # upstream embeddings {
+    #     server didiAI-embeddings-api:14100;
+    # }
+    #
+    # upstream rerank {
+    #     server didiAI-rerank-api:14200;
+    # }
+
+    # ======================================================================
+    # Gateway Server
+    # ======================================================================
+    server {
+        listen 11000;
+        server_name _;
+
+        # Max upload size (audio files up to 500MB)
+        client_max_body_size 500M;
+
+        # Default JSON content type for error responses
+        default_type application/json;
+
+        # Timeouts
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 600s;
+
+        # Common proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Request-ID $request_id;
+
+        # ==================================================================
+        # Health - NO auth required
+        # ==================================================================
+        location = /health {
+            access_log off;
+            default_type application/json;
+            return 200 '{"status":"ok","service":"didiAI-gateway"}';
+        }
+
+        # ==================================================================
+        # LLM Inference / Audio Transcription — DISABLED on this host
+        # (didiAI-llm-api and didiAI-audio-api containers not present locally)
+        # Re-enable the upstream block above + location block below when deployed.
+        # ==================================================================
+        # location /llm/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://llm/;
+        #     proxy_buffering off;
+        #     proxy_cache off;
+        #     proxy_set_header Connection '';
+        #     proxy_http_version 1.1;
+        #     chunked_transfer_encoding on;
+        # }
+        #
+        # location /audio/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://audio/;
+        #     client_body_buffer_size 10M;
+        # }
+
+        # ==================================================================
+        # Web Fact-checking - /web/
+        # ==================================================================
+        location /web/ {
+            if ($auth_status = "denied") {
+                return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+            }
+
+            proxy_pass http://web/;
+        }
+
+        # ==================================================================
+        # Catalog (internal monitoring) - /catalog/
+        # ==================================================================
+        location /catalog/ {
+            if ($auth_status = "denied") {
+                return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+            }
+
+            proxy_pass http://catalog/;
+        }
+
+        # ==================================================================
+        # Embeddings / Rerank — DISABLED on this host
+        # (FastAPI wrappers not deployed; live BGE-M3 servers run elsewhere)
+        # Re-enable the upstream blocks above + location blocks below when deployed.
+        # ==================================================================
+        # location /embeddings/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://embeddings/;
+        # }
+        #
+        # location /rerank/ {
+        #     if ($auth_status = "denied") {
+        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
+        #     }
+        #     proxy_pass http://rerank/;
+        # }
+
+        # ==================================================================
+        # Default - show available routes
+        # ==================================================================
+        location / {
+            default_type application/json;
+            return 404 '{"error":"not_found","routes":["/web/","/catalog/","/health"]}';
+        }
+    }
+}