Features: 1) Introduce upstream blocks for backend and Prometheus servers; 2) Add new caching headers for static file locations; 3) Enhance SSL configuration with improved security headers and session settings;
Fixes: 1) Replace hardcoded paths and domains with dynamic variables for maintainability; 2) Consolidate and simplify HTTP-to-HTTPS redirects; Extra: Improve overall formatting and alignment for better readability.
This commit is contained in:
parent
d72c3947d4
commit
12dcb71d6f
1 changed files with 95 additions and 88 deletions
183
nginx
183
nginx
|
|
@ -1,170 +1,177 @@
|
|||
# ------------------------------------------------------------
|
||||
# Server block for api.evibes.com
|
||||
# ------------------------------------------------------------
|
||||
server {
|
||||
server_name api.evibes.com b2b.evibes.com;
|
||||
listen 443 ssl;
|
||||
ssl_certificate /etc/letsencrypt/live/evibes.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/evibes.com/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
set $domain evibes.com;
|
||||
set $backend_root evibes-backend-django;
|
||||
set $frontend_root evibes-frontend-vue;
|
||||
|
||||
upstream django_backend {
|
||||
server 127.0.0.1:8000;
|
||||
}
|
||||
|
||||
upstream prom_backend {
|
||||
server 127.0.0.1:9090;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name api.$domain b2b.$domain;
|
||||
ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
ssl_session_tickets off;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
add_header X-Frame-Options SAMEORIGIN always;
|
||||
add_header X-Content-Type-Options nosniff always;
|
||||
add_header Referrer-Policy no-referrer-when-downgrade always;
|
||||
client_max_body_size 100M;
|
||||
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:8000;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://django_backend;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# Serve favicon (static file—CORS headers are inherited from the server block)
|
||||
location /favicon.ico {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/evibes-backend-django/static;
|
||||
root /var/jenkins/workspace/$backend_root/static;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
alias /var/jenkins/workspace/evibes-backend-django/static/robots_backend.txt;
|
||||
default_type text/plain;
|
||||
alias /var/jenkins/workspace/$backend_root/static/robots_backend.txt;
|
||||
default_type text/plain;
|
||||
}
|
||||
|
||||
# Media files (served with CORS via the server block add_header directives)
|
||||
location /media/ {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/evibes-backend-django/;
|
||||
root /var/jenkins/workspace/$backend_root;
|
||||
}
|
||||
|
||||
# Static files (served with CORS via the server block add_header directives)
|
||||
location /static/ {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/evibes-backend-django/;
|
||||
root /var/jenkins/workspace/$backend_root;
|
||||
}
|
||||
|
||||
error_page 500 502 503 504 /maintenance.html;
|
||||
location = /maintenance.html {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/evibes-backend-django/static;
|
||||
root /var/jenkins/workspace/$backend_root/static;
|
||||
internal;
|
||||
}
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Server block for evibes.com and www.evibes.com (Frontend)
|
||||
# ------------------------------------------------------------
|
||||
server {
|
||||
server_name evibes.com www.evibes.com;
|
||||
listen 443 ssl;
|
||||
ssl_certificate /etc/letsencrypt/live/evibes.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/evibes.com/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
listen 443 ssl http2;
|
||||
server_name $domain www.$domain;
|
||||
ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
ssl_session_tickets off;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
add_header X-Frame-Options SAMEORIGIN always;
|
||||
add_header X-Content-Type-Options nosniff always;
|
||||
add_header Referrer-Policy no-referrer-when-downgrade always;
|
||||
|
||||
location ~* \.(?:js|css|png|jpe?g|gif|svg|woff2?)$ {
|
||||
root /var/jenkins/workspace/$frontend_root/dist;
|
||||
try_files $uri =404;
|
||||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location /favicon.ico {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/evibes-backend-django/static;
|
||||
root /var/jenkins/workspace/$backend_root/static;
|
||||
}
|
||||
|
||||
location / {
|
||||
root /var/jenkins/workspace/evibes-frontend-vue/dist;
|
||||
try_files $uri $uri/ /index.html @maintenance;
|
||||
root /var/jenkins/workspace/$frontend_root/dist;
|
||||
try_files $uri $uri/ /index.html @maintenance;
|
||||
}
|
||||
|
||||
location = /index.html {
|
||||
root /var/jenkins/workspace/evibes-frontend-vue/dist;
|
||||
try_files $uri @maintenance;
|
||||
root /var/jenkins/workspace/$frontend_root/dist;
|
||||
try_files $uri @maintenance;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
alias /var/jenkins/workspace/evibes-backend-django/static/robots_frontend.txt;
|
||||
default_type text/plain;
|
||||
alias /var/jenkins/workspace/$backend_root/static/robots_frontend.txt;
|
||||
default_type text/plain;
|
||||
}
|
||||
|
||||
location ~ ^/sitemap(?:-(?P<section>[a-z]+)(?:-(?P<page>\d+))?)?\.xml$ {
|
||||
proxy_pass http://localhost:8000$request_uri;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Accept "application/xml";
|
||||
proxy_pass http://django_backend$request_uri;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Accept "application/xml";
|
||||
}
|
||||
|
||||
location @maintenance {
|
||||
return 503;
|
||||
return 503;
|
||||
}
|
||||
|
||||
error_page 503 404 500 502 504 /maintenance.html;
|
||||
location = /maintenance.html {
|
||||
root /var/jenkins/workspace/evibes-backend-django/static;
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/$backend_root/static;
|
||||
internal;
|
||||
}
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# Server block for prometheus.evibes.com
|
||||
# ------------------------------------------------------------
|
||||
server {
|
||||
server_name prometheus.evibes.com;
|
||||
listen 443 ssl;
|
||||
ssl_certificate /etc/letsencrypt/live/evibes.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/evibes.com/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
listen 443 ssl http2;
|
||||
server_name prometheus.$domain;
|
||||
ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
ssl_session_timeout 10m;
|
||||
ssl_session_tickets off;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
||||
add_header X-Frame-Options SAMEORIGIN always;
|
||||
add_header X-Content-Type-Options nosniff always;
|
||||
add_header Referrer-Policy no-referrer-when-downgrade always;
|
||||
client_max_body_size 100M;
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:9090;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://prom_backend;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location = /robots.txt {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
alias /var/jenkins/workspace/evibes-backend-django/static/robots_backend.txt;
|
||||
default_type text/plain;
|
||||
alias /var/jenkins/workspace/$backend_root/static/robots_backend.txt;
|
||||
default_type text/plain;
|
||||
}
|
||||
|
||||
location /favicon.ico {
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/evibes-backend-django/static;
|
||||
root /var/jenkins/workspace/$backend_root/static;
|
||||
}
|
||||
|
||||
error_page 500 502 503 504 /maintenance.html;
|
||||
location = /maintenance.html {
|
||||
root /var/jenkins/workspace/evibes-backend-django/static;
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
root /var/jenkins/workspace/$backend_root/static;
|
||||
internal;
|
||||
}
|
||||
}
|
||||
|
||||
# ------------------------------------------------------------
|
||||
# HTTP → HTTPS Redirects
|
||||
# ------------------------------------------------------------
|
||||
server {
|
||||
if ($host = www.evibes.com) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
if ($host = evibes.com) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server_name evibes.com www.evibes.com;
|
||||
listen 80;
|
||||
return 404;
|
||||
}
|
||||
|
||||
server {
|
||||
if ($host = api.evibes.com) {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server_name api.evibes.com;
|
||||
listen 80;
|
||||
return 404;
|
||||
server_name api.$domain b2b.$domain www.$domain $domain prometheus.$domain;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue