# Basic LLM Proxy Configuration
server {
    listen 80;
    server_name api.yourdomain.com;

    # Redirect HTTP to HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.yourdomain.com;

    # SSL Configuration
    ssl_certificate /etc/letsencrypt/live/api.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.yourdomain.com/privkey.pem;

    # Proxy to OpenAI API
    location /v1/ {
        proxy_pass https://api.openai.com/v1/;
        proxy_set_header Host api.openai.com;
        proxy_set_header Authorization "Bearer $openai_api_key";
        proxy_ssl_server_name on;
        
        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}
                    

# OpenAI Upstream with multiple endpoints
upstream openai_backend {
    least_conn;
    
    # Primary endpoint
    server api.openai.com:443 weight=3;
    
    # Keepalive connections
    keepalive 32;
    keepalive_timeout 60s;
}

# Anthropic Upstream
upstream anthropic_backend {
    server api.anthropic.com:443;
    keepalive 16;
}

# Multi-provider upstream for load balancing
upstream llm_fallback {
    server api.openai.com:443 weight=2;
    server api.anthropic.com:443 weight=1;
    keepalive 24;
}
                    

# Cache path configuration
proxy_cache_path /var/cache/nginx/llm
    levels=1:2
    keys_zone=llm_cache:100m
    max_size=10g
    inactive=24h
    use_temp_path=off;

# Cache configuration in server block
server {
    # ... other config ...
    
    location /v1/chat/completions {
        proxy_pass https://openai_backend/v1/chat/completions;
        
        # Enable caching
        proxy_cache llm_cache;
        
        # Cache key based on request body
        proxy_cache_key "$request_method|$request_uri|$request_body";
        
        # Cache valid responses for 24 hours
        proxy_cache_valid 200 24h;
        proxy_cache_valid 429 1m;
        proxy_cache_valid 500 0;
        
        # Allow cache bypass
        proxy_cache_bypass $http_x_no_cache;
        
        # Add cache status header
        add_header X-Cache-Status $upstream_cache_status;
        
        # ... other proxy settings ...
    }
}
                    

# Modern SSL Configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;

# SSL Session Configuration
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;

# HSTS
add_header Strict-Transport-Security "max-age=63072000" always;
                    

# Worker Processes
worker_processes auto;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    multi_accept on;
    use epoll;
}

http {
    # Connection optimization
    keepalive_timeout 65;
    keepalive_requests 1000;
    
    # Buffer settings
    client_body_buffer_size 128k;
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    
    # Request body handling for large prompts
    client_max_body_size 50m;
    client_body_in_file_only off;
    
    # Logging format
    log_format llm_json '{"time":"$time_iso8601",'
                   '"method":"$request_method",'
                   '"uri":"$request_uri",'
                   '"status":$status,'
                   '"bytes":$body_bytes_sent,'
                   '"duration":$request_time,'
                   '"cache":"$upstream_cache_status"}';
    
    access_log /var/log/nginx/llm-access.log llm_json;
}
                    

# Rate limiting zones
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;

server {
    location /v1/ {
        # Rate limiting with burst
        limit_req zone=api_limit burst=20 nodelay;
        limit_conn conn_limit 10;
        
        # Custom error response
        error_page 429 = @rate_limited;
        
        # ... proxy configuration ...
    }
    
    location @rate_limited {
        default_type application/json;
        return 429 '{"error":"Rate limit exceeded"}';
    }
}