nginx.conf

worker_processes 1;

include modules/*.conf;

events {
    worker_connections 1024;
}

http {
    limit_req_zone $jwt_email zone=one:10m rate=1r/s;
    limit_req_status 429;
    limit_req_log_level error;

    log_format mylog '$remote_addr - "$request"\tStatus: $status JWT-Subject: $jwt_sub JWT-Email: $jwt_email RateLimit: $limit_req_status';
    access_log /dev/stdout mylog;
    server {
        listen 8888;
        server_name localhost;

        set $jwt_sub "";
        set $jwt_email "";

        location /public {
            default_type application/json;
            return 200 '{"message": "Hello, World!"}';
        }

        location /private {
            access_by_lua_block {
                local libjwt = require("resty.libjwt")
                libjwt.validate({
                    jwks_files = {"/usr/share/tokens/jwks.json"},
                    extract_claims = {"sub", "email"},
                })
            }

            echo 'private';
        }

        location /private_validate_claims {
            access_by_lua_block {
                local libjwt = require("resty.libjwt")
                libjwt.validate({
                    jwks_files = {"/usr/share/tokens/jwks.json"},
                    extract_claims = {"sub", "email"},
                    validate_claims = {
                        name = {exact = "tsuru"},
                    },
                })
            }
            echo 'private';
        }

        location /private_limited {
            limit_req zone=one burst=1 nodelay;
            rewrite_by_lua_block {
                local libjwt = require("resty.libjwt")
                libjwt.validate({
                    jwks_files = {"/usr/share/tokens/jwks.json"},
                    extract_claims = {"sub", "email"},
                })
            }

            echo 'private+rate-limited';
        }

        location /ratelimit-api {
            limit_req_rw_handler;
        }
    }
}