nginx.conf

limit_req_zone $binary_remote_addr zone=sockets:100m rate=1r/s;

upstream express {
    server localhost:3002 max_fails=10 fail_timeout=30s;
}

server {
    listen 80;
    server_name 3september.ru;
    server_name www.3september.ru;

    location / {
        return 301 https://3september.ru$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name www.3september.ru;

    ssl_certificate /etc/letsencrypt/live/3september.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/3september.ru/privkey.pem;

    location / {
        return 301 https://3september.ru$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name 3september.ru;

    charset utf-8;
    root /srv/http/3september.ru;

    index index.html;

    ssl_certificate /etc/letsencrypt/live/3september.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/3september.ru/privkey.pem;

    location / {
        root /srv/http/3september.ru/public;

        location ~* \.(css|png|jpg|js|mp4)$ {
            expires 2w;
            log_not_found off;
        }

        try_files $uri $uri/ /index.html?$args @index;
    }

    location @index {
        rewrite ^ / permanent;
    }

    location /social/ {
        include fastcgi_params;

        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root/social/generator.php;
    }

    location /social/posters/ {
        expires 2w;
        log_not_found off;

        try_files $uri $uri =404;
    }

    location = /update/ {
        limit_req zone=sockets burst=5;
        limit_req_status 429;

        proxy_set_header Host $host;
        proxy_pass http://express/update/;
    }

    location = /receive/ {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;

        proxy_pass http://express/receive/;
    }

    location = /robots.txt {
        log_not_found off;
        access_log off;
    }

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }
}