foxhunt/deployment/nginx/foxhunt-hft.conf

# Foxhunt HFT Trading System - High-Performance Load Balancer Configuration
# Optimized for ultra-low latency and high-throughput trading operations

# Performance optimizations for HFT
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 65535;

# Enable real-time scheduling for critical requests
worker_priority -5;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
    accept_mutex off;
    epoll_events 512;
}

http {
    # Basic settings optimized for performance
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 5;
    types_hash_max_size 2048;
    server_tokens off;
    
    # Buffer settings for high throughput
    client_body_buffer_size 1m;
    client_max_body_size 10m;
    client_body_timeout 5s;
    client_header_timeout 5s;
    large_client_header_buffers 4 32k;
    
    # Proxy settings for low latency
    proxy_buffering off;
    proxy_buffer_size 4k;
    proxy_busy_buffers_size 8k;
    proxy_connect_timeout 1s;
    proxy_send_timeout 5s;
    proxy_read_timeout 30s;
    proxy_next_upstream error timeout invalid_header;
    
    # Connection pooling for backend services
    upstream_keepalive_connections 100;
    upstream_keepalive_requests 1000;
    upstream_keepalive_timeout 60s;
    
    # Logging optimized for compliance and performance
    log_format foxhunt_access '$remote_addr - $remote_user [$time_local] '
                              '"$request" $status $body_bytes_sent '
                              '"$http_referer" "$http_user_agent" '
                              '$request_time $upstream_response_time '
                              '$upstream_addr $request_id';
    
    log_format foxhunt_performance '$time_iso8601|$request_id|$upstream_addr|'
                                  '$request_time|$upstream_response_time|'
                                  '$status|$body_bytes_sent|$request_length';
    
    access_log /var/log/nginx/foxhunt_access.log foxhunt_access;
    access_log /var/log/nginx/foxhunt_performance.log foxhunt_performance;
    error_log /var/log/nginx/foxhunt_error.log warn;
    
    # Rate limiting for DDoS protection
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=1000r/s;
    limit_req_zone $binary_remote_addr zone=trading_limit:10m rate=10000r/s;
    
    # Include upstream definitions (managed by deployment scripts)
    include /etc/nginx/conf.d/foxhunt-upstream.conf;
    
    # Main trading system server
    server {
        listen 80;
        listen 443 ssl http2;
        server_name foxhunt.trading.local;
        
        # SSL configuration for production
        ssl_certificate /etc/ssl/certs/foxhunt.crt;
        ssl_certificate_key /etc/ssl/private/foxhunt.key;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 5m;
        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_protocols TLSv1.2 TLSv1.3;
        
        # Security headers
        add_header X-Frame-Options DENY always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        
        # Core trading API
        location /api/trading/ {
            limit_req zone=trading_limit burst=1000 nodelay;
            
            proxy_pass http://foxhunt_core;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Request-ID $request_id;
            
            # Ultra-low latency settings
            proxy_buffering off;
            proxy_cache off;
            proxy_connect_timeout 100ms;
            proxy_send_timeout 1s;
            proxy_read_timeout 5s;
        }
        
        # Risk management API
        location /api/risk/ {
            limit_req zone=api_limit burst=500 nodelay;
            
            proxy_pass http://foxhunt_risk;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Request-ID $request_id;
        }
        
        # ML inference API
        location /api/ml/ {
            limit_req zone=api_limit burst=200 nodelay;
            
            proxy_pass http://foxhunt_ml;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Request-ID $request_id;
            
            # Longer timeout for ML operations
            proxy_connect_timeout 1s;
            proxy_send_timeout 5s;
            proxy_read_timeout 30s;
        }
        
        # Data API
        location /api/data/ {
            limit_req zone=api_limit burst=1000 nodelay;
            
            proxy_pass http://foxhunt_data;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Request-ID $request_id;
        }
        
        # Health check endpoints (bypass rate limiting)
        location /health {
            access_log off;
            proxy_pass http://foxhunt_core;
            proxy_connect_timeout 1s;
            proxy_send_timeout 2s;
            proxy_read_timeout 2s;
        }
        
        # Metrics endpoint for monitoring
        location /metrics {
            access_log off;
            allow 127.0.0.1;
            allow 10.0.0.0/8;
            allow 172.16.0.0/12;
            allow 192.168.0.0/16;
            deny all;
            
            proxy_pass http://foxhunt_core;
        }
        
        # WebSocket support for real-time data
        location /ws/ {
            proxy_pass http://foxhunt_core;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # WebSocket-specific timeouts
            proxy_connect_timeout 1s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }
        
        # Static assets (if any)
        location /static/ {
            expires 1h;
            add_header Cache-Control "public, no-transform";
        }
        
        # Default location - return 404
        location / {
            return 404;
        }
    }
    
    # gRPC server for TLI
    server {
        listen 50051 http2;
        server_name foxhunt.grpc.local;
        
        # gRPC settings
        grpc_buffer_size 4k;
        grpc_connect_timeout 1s;
        grpc_send_timeout 30s;
        grpc_read_timeout 30s;
        
        location / {
            grpc_pass grpc://foxhunt_tli;
            grpc_set_header Host $host;
            grpc_set_header X-Real-IP $remote_addr;
            grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            grpc_set_header X-Request-ID $request_id;
        }
    }
    
    # Monitoring and admin interface
    server {
        listen 8080;
        server_name admin.foxhunt.local;
        
        # Restrict access to admin interface
        allow 127.0.0.1;
        allow 10.0.0.0/8;
        allow 172.16.0.0/12;
        allow 192.168.0.0/16;
        deny all;
        
        # Status and metrics
        location /nginx_status {
            stub_status on;
            access_log off;
        }
        
        # Upstream status
        location /upstream_status {
            upstream_show;
        }
        
        # Real-time metrics
        location /realtime_metrics {
            push_stream_publisher admin;
            push_stream_channels_path $arg_id;
        }
        
        # System health dashboard
        location /dashboard {
            try_files $uri $uri/ =404;
            root /var/www/foxhunt-dashboard;
            index index.html;
        }
    }
    
    # Canary monitoring server
    include /etc/nginx/conf.d/foxhunt-canary.conf;
}

# Stream configuration for TCP/UDP load balancing (if needed)
stream {
    # Custom protocol load balancing
    upstream foxhunt_custom_protocol {
        server 127.0.0.1:9001 max_fails=2 fail_timeout=30s;
        server 127.0.0.1:9002 max_fails=2 fail_timeout=30s backup;
    }
    
    server {
        listen 9000;
        proxy_pass foxhunt_custom_protocol;
        proxy_timeout 1s;
        proxy_responses 1;
        proxy_connect_timeout 1s;
    }
}