Update nginx.conf

Author: ra-sun-god

deploy/nginx.conf

@@ -1,98 +1,143 @@
 # ============================================================
-# StellarForge — Nginx Reverse Proxy Configuration
+# StellarForge — Nginx Reverse Proxy Configuration (SPEED-OPTIMIZED)
 # Domain: stellarforge.app (and www.stellarforge.app)
 #
-# Proxies:
-#   - HTTP → Next.js app (port 3700, next start)
-#   - /collab → WebSocket collab server (port 3002)
-#   - /lsp → WebSocket LSP server (port 3099)
-#   - WebSocket upgrade support for all paths
+# On top of the previous fix (upstream keepalive, correct
+# Connection handling, split rate limits), this pass adds:
 #
-# SSL is managed by certbot — it will auto-inject the
-# ssl_certificate directives when you run:
+#   1. /_next/static/ is served DIRECTLY from disk instead of
+#      proxying to Node. This is the single biggest latency win
+#      available — every JS/CSS chunk currently round-trips
+#      through your Next.js process for no reason; these files
+#      are content-hashed and immutable, nginx can serve them
+#      straight off disk with a 1-year cache header.
+#      >>> You MUST update the `alias` path below to your actual
+#      >>> .next/static build output directory.
+#   2. proxy_socket_keepalive on upstream connections.
+#   3. Tighter client-facing keepalive + timeout tuning so idle
+#      connections don't tie up workers.
+#   4. sendfile/tcp_nopush/tcp_nodelay for the local file serving
+#      (error page + static assets).
+#   5. Optional (commented) microcaching block for cacheable GET
+#      API routes, and optional Brotli.
+#
+# IMPORTANT — two more optimizations can't live in this file and
+# need to be done separately (instructions at the very bottom):
+#   A. HTTP/2 + TLS session reuse + OCSP stapling, added to the
+#      443 block certbot generates for you.
+#   B. worker_processes / worker_connections tuning in the main
+#      /etc/nginx/nginx.conf.
+#
+# SSL is managed by certbot — it will auto-inject ssl_certificate
+# directives when you run:
 #   certbot --nginx -d stellarforge.app -d www.stellarforge.app
-# Do NOT add SSL directives manually.
+# Do NOT add SSL directives manually to THIS file's port 80 block.
 #
 # Usage:
 #   1. Copy to /etc/nginx/sites-available/stellarforge.app
 #   2. Symlink: ln -s /etc/nginx/sites-available/stellarforge.app /etc/nginx/sites-enabled/
-#   3. certbot --nginx -d stellarforge.app -d www.stellarforge.app
-#   4. nginx -t && systemctl reload nginx
-#
-# Prerequisites:
-#   - Next.js running on port 3700 (bun run start)
-#   - Collab server running on port 3002 (bm2 or manually)
-#   - LSP server running on port 3099 (bm2 or manually)
+#   3. Confirm /etc/nginx/conf.d/upgrade.conf does NOT also exist
+#      (it would duplicate the map below)
+#   4. Update the /_next/static/ alias path below to your real build dir
+#   5. nginx -t   <-- always run this before reloading
+#   6. certbot --nginx -d stellarforge.app -d www.stellarforge.app
+#   7. Apply the HTTP/2 + SSL tuning snippet at the bottom of this file
+#      to the 443 block certbot creates
+#   8. nginx -t && systemctl reload nginx
 # ============================================================
 
-# ─── WebSocket upgrade map (MUST be outside server block) ───
-# This tells nginx how to handle the Connection header for WebSocket
-# upgrades. Without this, WebSocket connections fail with
-# "unknown connection_upgrade variable".
-# This is defined INLINE here — no need for a separate upgrade.conf file.
 map $http_upgrade $connection_upgrade {
     default upgrade;
-    ''      close;
+    '' close;
+}
+
+# ─── Upstream pools with keepalive ────────────────────────────
+# Reuses backend connections instead of opening a new TCP
+# connection per request.
+upstream nextjs_backend {
+    server 127.0.0.1:3700;
+    keepalive 64;
+    keepalive_requests 1000;
+    keepalive_timeout 60s;
+
+    # If you ever run Next.js as multiple instances (e.g. PM2
+    # cluster mode across several ports) for more throughput on
+    # multi-core boxes, add them here and nginx load-balances
+    # automatically:
+    #   server 127.0.0.1:3701;
+    #   server 127.0.0.1:3702;
+    # least_conn;
+}
+
+upstream collab_backend {
+    server 127.0.0.1:3002;
+    keepalive 32;
+}
+
+upstream lsp_backend {
+    server 127.0.0.1:3099;
+    keepalive 32;
 }
 
-# Rate limiting zone
-limit_req_zone $binary_remote_addr zone=stellarforge_api:10m rate=10r/s;
+# ─── Rate limiting zones ───────────────────────────────────────
+limit_req_zone $binary_remote_addr zone=stellarforge_api:10m rate=20r/s;
+limit_req_zone $binary_remote_addr zone=stellarforge_app:10m rate=50r/s;
 
-# Upload size for file imports / avatar uploads
 client_max_body_size 25M;
 
-# ─── HTTP server (certbot will add the 443 block automatically) ──
+# ─── Local file I/O tuning (error pages, static assets) ───────
+sendfile on;
+tcp_nopush on;
+tcp_nodelay on;
+
 server {
     listen 80;
     listen [::]:80;
     server_name stellarforge.app www.stellarforge.app;
 
-    # Let's Encrypt challenge path
-    location /.well-known/acme-challenge/ {
-        root /var/www/html;
-    }
-
-    # ─── www → non-www redirect ──────────────────────────────
-    if ($host = www.stellarforge.app) {
-        return 301 https://stellarforge.app$request_uri;
-    }
-
     # certbot will insert the HTTPS redirect here after running:
     #   certbot --nginx -d stellarforge.app -d www.stellarforge.app
 
+    # ─── Client-facing connection tuning ──────────────────────
+    # Keeps idle client connections short so workers free up fast,
+    # while still letting browsers reuse one connection for all
+    # the assets on a page instead of opening a new one each time.
+    keepalive_timeout 20s;
+    keepalive_requests 1000;
+    client_header_timeout 15s;
+    client_body_timeout 15s;
+    send_timeout 15s;
+    reset_timedout_connection on;
+
     # ─── WebSocket: Collab server (/collab/) ─────────────────
-    # Proxies to the Yjs WebSocket collab server on port 3002.
-    # This is the cross-device live collaboration server.
-    # Client connects via: wss://stellarforge.app/collab/stellarforge-<roomId>
     location /collab/ {
-        proxy_pass http://127.0.0.1:3002;
+        proxy_pass http://collab_backend;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection $connection_upgrade;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_socket_keepalive on;
 
         proxy_read_timeout 86400s;
         proxy_send_timeout 86400s;
         proxy_buffering off;
         proxy_cache off;
     }
 
-    # ─── WebSocket: LSP server (/lsp and /workspace/) ────────
-    # Proxies to the rust-analyzer LSP server on port 3099.
-    # /lsp is the WebSocket endpoint for LSP/JSON-RPC protocol.
-    # /workspace/ serves files from the build workspace (for go-to-def etc.)
-    location /lsp {
-        proxy_pass http://127.0.0.1:3099;
+    # ─── WebSocket: LSP server (/lsp/ and /workspace/) ───────
+    location /lsp/ {
+        proxy_pass http://lsp_backend;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection $connection_upgrade;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_socket_keepalive on;
 
         proxy_read_timeout 86400s;
         proxy_send_timeout 86400s;
@@ -101,63 +146,106 @@ server {
     }
 
     location /workspace/ {
-        proxy_pass http://127.0.0.1:3099;
+        proxy_pass http://lsp_backend;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection $connection_upgrade;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_socket_keepalive on;
 
         proxy_read_timeout 86400s;
         proxy_send_timeout 86400s;
         proxy_buffering off;
         proxy_cache off;
     }
 
+    # ─── Static assets — served directly from disk, bypassing Node ──
+    # >>> UPDATE THIS PATH to your real .next/static build output,
+    # >>> e.g. /var/www/stellarforge/.next/static/
+    location /_next/static/ {
+        alias /var/www/stellarforge/.next/static/;
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+        # Not rate-limited — these are cheap, cacheable, and a
+        # single page load fires dozens of them in parallel.
+    }
+
+    # Public /public/ folder assets (favicons, images, etc.) —
+    # same idea, update path to match your deployment.
+    location /public/ {
+        alias /var/www/stellarforge/public/;
+        expires 30d;
+        add_header Cache-Control "public";
+        access_log off;
+    }
+
+    # ─── Optional: microcaching for cacheable GET API routes ──
+    # Uncomment and adjust if you have public, non-personalized
+    # GET endpoints (e.g. leaderboard, public stats). Skips this
+    # for anything with a session cookie so logged-in users always
+    # hit the backend.
+    #
+    # proxy_cache_path /var/cache/nginx/stellarforge levels=1:2
+    #     keys_zone=stellarforge_cache:10m max_size=200m inactive=60m;
+    #
+    # location /api/public/ {
+    #     proxy_pass http://nextjs_backend;
+    #     proxy_http_version 1.1;
+    #     proxy_set_header Connection "";
+    #     proxy_set_header Host $host;
+    #     proxy_cache stellarforge_cache;
+    #     proxy_cache_valid 200 30s;
+    #     proxy_cache_bypass $cookie_session;
+    #     proxy_no_cache $cookie_session;
+    #     add_header X-Cache-Status $upstream_cache_status;
+    # }
+
     # ─── API routes (/api/) ──────────────────────────────────
     location /api/ {
-        proxy_pass http://127.0.0.1:3700;
+        proxy_pass http://nextjs_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_socket_keepalive on;
 
         add_header Cache-Control "no-store, no-cache, must-revalidate";
         proxy_buffering on;
         proxy_buffer_size 16k;
         proxy_buffers 8 32k;
 
-        # 35s read timeout — Neon cold start can take 10-15s,
-        # and SIWS verify does multiple DB queries (upsert + profile create).
-        # Next.js maxDuration is 30s, so 35s gives nginx a 5s buffer.
-        proxy_read_timeout 35s;
-        proxy_send_timeout 35s;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 60s;
+        proxy_send_timeout 60s;
 
-        limit_req zone=stellarforge_api burst=20 nodelay;
-        client_max_body_size 25M;
+        limit_req zone=stellarforge_api burst=40 nodelay;
     }
 
     # ─── Next.js app (everything else) ────────────────────────
     location / {
-        proxy_pass http://127.0.0.1:3700;
+        proxy_pass http://nextjs_backend;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_socket_keepalive on;
 
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-
-        proxy_read_timeout 300s;
-        proxy_send_timeout 300s;
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 60s;
+        proxy_send_timeout 60s;
         proxy_buffering on;
         proxy_buffer_size 16k;
         proxy_buffers 8 32k;
 
-        limit_req zone=stellarforge_api burst=20 nodelay;
+        limit_req zone=stellarforge_app burst=80 nodelay;
     }
 
     # ─── Compression ─────────────────────────────────────────
@@ -181,6 +269,14 @@ server {
         font/woff2
         application/wasm;
 
+    # Optional: Brotli compresses better than gzip for text assets.
+    # Requires the ngx_brotli module (not built into stock nginx —
+    # check `nginx -V` for it, or install nginx-module-brotli).
+    # brotli on;
+    # brotli_comp_level 5;
+    # brotli_types text/plain text/css application/javascript
+    #     application/json image/svg+xml font/woff2 application/wasm;
+
     # ─── Logging ──────────────────────────────────────────────
     access_log /var/log/nginx/stellarforge.app.access.log;
     error_log /var/log/nginx/stellarforge.app.error.log warn;
@@ -192,3 +288,41 @@ server {
         internal;
     }
 }
+
+# ============================================================
+# A. After running certbot, add this to the 443 block it creates
+#    for faster TLS handshakes + HTTP/2 (lets browsers multiplex
+#    all those Next.js chunk requests over one connection instead
+#    of opening 6 parallel ones):
+#
+#   listen 443 ssl;
+#   http2 on;                 # nginx >= 1.25.1 syntax
+#   # (older nginx: listen 443 ssl http2; instead of the two lines above)
+#
+#   ssl_session_cache shared:SSL:10m;
+#   ssl_session_timeout 1d;
+#   ssl_session_tickets off;
+#   ssl_protocols TLSv1.2 TLSv1.3;
+#   ssl_prefer_server_ciphers off;
+#
+#   ssl_stapling on;
+#   ssl_stapling_verify on;
+#   resolver 1.1.1.1 8.8.8.8 valid=300s;
+#   resolver_timeout 5s;
+#
+# B. In /etc/nginx/nginx.conf (main context), these matter more
+#    for you than most sites given the WS collab/LSP connections
+#    holding workers open for hours:
+#
+#   worker_processes auto;
+#   worker_rlimit_nofile 65535;
+#
+#   events {
+#       worker_connections 4096;
+#       multi_accept on;
+#       use epoll;
+#   }
+#
+#   Check current limits with: ulimit -n
+#   If low, also raise the nginx systemd service's LimitNOFILE.
+# ============================================================