API Gateway Concepts — Kong, NGINX, and AWS API Gateway Guide

# docker-compose.yml
version: '3'
services:
  kong-database:
    image: postgres:15
    environment:
      POSTGRES_DB: kong
      POSTGRES_USER: kong
      POSTGRES_PASSWORD: kongpass

  kong-migrations:
    image: kong:3.7
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_PASSWORD: kongpass
    command: "kong migrations bootstrap"
    depends_on:
      - kong-database

  kong:
    image: kong:3.7
    environment:
      KONG_DATABASE: postgres
      KONG_PG_HOST: kong-database
      KONG_PG_PASSWORD: kongpass
      KONG_PROXY_ACCESS_LOG: /dev/stdout
      KONG_ADMIN_ACCESS_LOG: /dev/stdout
      KONG_PROXY_ERROR_LOG: /dev/stderr
      KONG_ADMIN_ERROR_LOG: /dev/stderr
      KONG_ADMIN_LISTEN: "0.0.0.0:8001"
    ports:
      - "8000:8000"   # Proxy port
      - "8443:8443"   # Proxy HTTPS
      - "8001:8001"   # Admin API
    depends_on:
      - kong-migrations

# Add a service
curl -s -X POST http://localhost:8001/services \
  --data name=user-service \
  --data url=http://user-service:3000

# Add a route to the service
curl -s -X POST http://localhost:8001/services/user-service/routes \
  --data paths[]=/api/v1/users \
  --data name=users-route

# Enable rate limiting plugin
curl -s -X POST http://localhost:8001/services/user-service/plugins \
  --data name=rate-limiting \
  --data config.minute=100 \
  --data config.policy=local

# Enable JWT authentication
curl -s -X POST http://localhost:8001/services/user-service/plugins \
  --data name=jwt

# Enable CORS
curl -s -X POST http://localhost:8001/services/user-service/plugins \
  --data name=cors \
  --data config.origins=https://dodatech.com \
  --data config.methods=GET,POST,PUT,DELETE

# /etc/nginx/nginx.conf
events {
  worker_connections 1024;
}

http {
  upstream user_service {
    server user-service-1:3000 weight=3;
    server user-service-2:3000 weight=2;
    server user-service-3:3000 backup;
  }

  upstream order_service {
    server order-service:4000;
  }

  # Rate limit zones
  limit_req_zone $binary_remote_addr zone=api_limit:10m rate=100r/s;
  limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/s;

  server {
    listen 443 ssl;
    server_name api.dodatech.com;

    ssl_certificate /etc/ssl/certs/dodatech.crt;
    ssl_certificate_key /etc/ssl/private/dodatech.key;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;

    # CORS preflight
    if ($request_method = OPTIONS) {
      add_header Access-Control-Allow-Origin "https://dodatech.com";
      add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH";
      add_header Access-Control-Allow-Headers "Content-Type, Authorization";
      add_header Access-Control-Max-Age 86400;
      return 204;
    }

    # User service routes
    location /api/v1/users {
      limit_req zone=api_limit burst=20 nodelay;

      # JWT validation via auth request
      auth_request /_auth;

      proxy_pass http://user_service;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # Order service routes
    location /api/v1/orders {
      limit_req zone=api_limit burst=20 nodelay;
      auth_request /_auth;

      proxy_pass http://order_service;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
    }

    # Auth service (internal only)
    location /_auth {
      internal;
      proxy_pass http://auth-service:5000/validate;
      proxy_pass_request_body off;
      proxy_set_header Content-Length "";
      proxy_set_header X-Original-URI $request_uri;
    }

    # Stricter rate limit on auth endpoints
    location /api/v1/auth/login {
      limit_req zone=auth_limit burst=5 nodelay;
      proxy_pass http://auth-service:5000;
    }

    # Error handling
    error_page 429 /429.json;
    location = /429.json {
      return 429 '{"error":"rate_limited","message":"Too many requests"}';
    }

    error_page 401 /401.json;
    location = /401.json {
      return 401 '{"error":"unauthorized","message":"Authentication required"}';
    }
  }
}

location /nginx_status {
  stub_status on;
  access_log off;
  allow 127.0.0.1;
  deny all;
}

# Serverless.yml (with Serverless Framework)
service: dodatech-API-gateway

provider:
  name: AWS
  runtime: nodejs20.x
  region: us-east-1

functions:
  listUsers:
    handler: handlers/users.list
    events:
      - HTTP:
          path: /v1/users
          method: GET
          CORS: true
          authorizer: AWS_iam
          throttling:
            burstLimit: 100
            rateLimit: 50

  createUser:
    handler: handlers/users.create
    events:
      - HTTP:
          path: /v1/users
          method: POST
          CORS: true
          authorizer:
            type: COGNITO_USER_POOLS
            authorizerId: !Ref ApiGatewayAuthorizer

resource "AWS_API_gateway_REST_API" "dodatech_API" {
  name        = "DodaTech API"
  description = "DodaTech API Gateway"
}

resource "AWS_API_gateway_resource" "users" {
  REST_API_id = AWS_API_gateway_REST_API.dodatech_API.id
  parent_id   = AWS_API_gateway_REST_API.dodatech_API.root_resource_id
  path_part   = "users"
}

resource "AWS_API_gateway_method" "users_get" {
  REST_API_id   = AWS_API_gateway_REST_API.dodatech_API.id
  resource_id   = AWS_API_gateway_resource.users.id
  HTTP_method   = "GET"
  authorization = "COGNITO_USER_POOLS"
  authorizer_id = AWS_API_gateway_authorizer.cognito.id
}

resource "AWS_API_gateway_deployment" "prod" {
  REST_API_id = AWS_API_gateway_REST_API.dodatech_API.id
  stage_name  = "prod"
}