# Add these directives inside the existing nginx http block. The server-wide
# zones bound aggregate traffic, while the address-keyed zones prevent one
# client from consuming the whole allowance.
limit_req_zone $binary_remote_addr zone=tdkpin_highscore_client_rate:10m rate=5r/s;
limit_req_zone $server_name zone=tdkpin_highscore_global_rate:1m rate=50r/s;
limit_conn_zone $binary_remote_addr zone=tdkpin_highscore_client_connections:10m;
limit_conn_zone $server_name zone=tdkpin_highscore_global_connections:1m;

# Add these blocks inside the server block that serves the game.
location /api/highscores {
    limit_req zone=tdkpin_highscore_client_rate burst=10 nodelay;
    limit_req zone=tdkpin_highscore_global_rate burst=25 nodelay;
    limit_req_status 429;
    limit_conn tdkpin_highscore_client_connections 10;
    limit_conn tdkpin_highscore_global_connections 100;
    limit_conn_status 429;

    client_max_body_size 1k;
    client_body_timeout 5s;
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_connect_timeout 2s;
    proxy_send_timeout 5s;
    proxy_read_timeout 5s;
    proxy_next_upstream off;
}

# Optional health check for local monitoring.
location = /healthz {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
}