MCP Business AI Transformation

events { worker_connections 1024; } http { upstream frontend { server frontend:3000; } upstream mcp_server { server mcp-server:8000; } # Rate limiting limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s; limit_req_zone $binary_remote_addr zone=general:10m rate=30r/s; server { listen 80; server_name localhost; # Security headers add_header X-Frame-Options "SAMEORIGIN" always; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always; # Frontend routes location / { limit_req zone=general burst=50 nodelay; proxy_pass http://frontend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } # MCP API routes location /api/ { limit_req zone=api burst=20 nodelay; proxy_pass http://mcp_server; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Timeout settings proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; } # MCP protocol endpoint location /mcp { limit_req zone=api burst=20 nodelay; proxy_pass http://mcp_server; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # MCP specific headers proxy_set_header Content-Type "application/json"; proxy_set_header Accept "application/json"; } # Health checks location /health { proxy_pass http://mcp_server/api/v1/health; access_log off; } # Metrics endpoint (restricted access) location /metrics { allow 127.0.0.1; allow 10.0.0.0/8; allow 172.16.0.0/12; allow 192.168.0.0/16; deny all; proxy_pass http://mcp-server:9090/metrics; } # Static files caching location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ { expires 1y; add_header Cache-Control "public, immutable"; proxy_pass http://frontend; } } # HTTPS configuration (uncomment and configure for production) # server { # listen 443 ssl http2; # server_name localhost; # # ssl_certificate /etc/nginx/ssl/cert.pem; # ssl_certificate_key /etc/nginx/ssl/key.pem; # # ssl_protocols TLSv1.2 TLSv1.3; # ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384; # ssl_prefer_server_ciphers off; # # # Same location blocks as HTTP # } }