fureunoir/schon
fureunoir/schon
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Features: 1) Introduce upstream blocks for backend and Prometheus servers; 2) Add new caching headers for static file locations; 3) Enhance SSL configuration with improved security headers and session settings;

Browse source 
Fixes: 1) Replace hardcoded paths and domains with dynamic variables for maintainability; 2) Consolidate and simplify HTTP-to-HTTPS redirects;

Extra: Improve overall formatting and alignment for better readability.
This commit is contained in:
Egor Pavlovich Gorbunov 2025-06-19 09:52:47 +03:00
parent d72c3947d4
commit 12dcb71d6f
1 changed files with 95 additions and 88 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

183
nginx
View file

@ -1,170 +1,177 @@
# ------------------------------------------------------------ set $domain evibes.com;
# Server block for api.evibes.com set $backend_root evibes-backend-django;
# ------------------------------------------------------------ set $frontend_root evibes-frontend-vue;
server {
server_name api.evibes.com b2b.evibes.com;
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/evibes.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/evibes.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
upstream django_backend {
server 127.0.0.1:8000;
}
upstream prom_backend {
server 127.0.0.1:9090;
}
server {
listen 443 ssl http2;
server_name api.$domain b2b.$domain;
ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy no-referrer-when-downgrade always;
client_max_body_size 100M; client_max_body_size 100M;
location / { location / {
proxy_pass http://localhost:8000; proxy_pass http://django_backend;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
} }
# Serve favicon (static file—CORS headers are inherited from the server block)
location /favicon.ico { location /favicon.ico {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/evibes-backend-django/static; root /var/jenkins/workspace/$backend_root/static;
} }
location = /robots.txt { location = /robots.txt {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
alias /var/jenkins/workspace/evibes-backend-django/static/robots_backend.txt; alias /var/jenkins/workspace/$backend_root/static/robots_backend.txt;
default_type text/plain; default_type text/plain;
} }
# Media files (served with CORS via the server block add_header directives)
location /media/ { location /media/ {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/evibes-backend-django/; root /var/jenkins/workspace/$backend_root;
} }
# Static files (served with CORS via the server block add_header directives)
location /static/ { location /static/ {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/evibes-backend-django/; root /var/jenkins/workspace/$backend_root;
} }
error_page 500 502 503 504 /maintenance.html; error_page 500 502 503 504 /maintenance.html;
location = /maintenance.html { location = /maintenance.html {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/evibes-backend-django/static; root /var/jenkins/workspace/$backend_root/static;
internal; internal;
} }
} }
# ------------------------------------------------------------
# Server block for evibes.com and www.evibes.com (Frontend)
# ------------------------------------------------------------
server { server {
server_name evibes.com www.evibes.com; listen 443 ssl http2;
listen 443 ssl; server_name $domain www.$domain;
ssl_certificate /etc/letsencrypt/live/evibes.com/fullchain.pem; ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/evibes.com/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf; include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy no-referrer-when-downgrade always;
location ~* \.(?:js|css|png|jpe?g|gif|svg|woff2?)$ {
root /var/jenkins/workspace/$frontend_root/dist;
try_files $uri =404;
add_header Cache-Control "public, max-age=31536000, immutable";
access_log off;
}
location /favicon.ico { location /favicon.ico {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/evibes-backend-django/static; root /var/jenkins/workspace/$backend_root/static;
} }
location / { location / {
root /var/jenkins/workspace/evibes-frontend-vue/dist; root /var/jenkins/workspace/$frontend_root/dist;
try_files $uri $uri/ /index.html @maintenance; try_files $uri $uri/ /index.html @maintenance;
} }
location = /index.html { location = /index.html {
root /var/jenkins/workspace/evibes-frontend-vue/dist; root /var/jenkins/workspace/$frontend_root/dist;
try_files $uri @maintenance; try_files $uri @maintenance;
} }
location = /robots.txt { location = /robots.txt {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
alias /var/jenkins/workspace/evibes-backend-django/static/robots_frontend.txt; alias /var/jenkins/workspace/$backend_root/static/robots_frontend.txt;
default_type text/plain; default_type text/plain;
} }
location ~ ^/sitemap(?:-(?P<section>[a-z]+)(?:-(?P<page>\d+))?)?\.xml$ { location ~ ^/sitemap(?:-(?P<section>[a-z]+)(?:-(?P<page>\d+))?)?\.xml$ {
proxy_pass http://localhost:8000$request_uri; proxy_pass http://django_backend$request_uri;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Accept "application/xml"; proxy_set_header Accept "application/xml";
} }
location @maintenance { location @maintenance {
return 503; return 503;
} }
error_page 503 404 500 502 504 /maintenance.html; error_page 503 404 500 502 504 /maintenance.html;
location = /maintenance.html { location = /maintenance.html {
root /var/jenkins/workspace/evibes-backend-django/static;
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/$backend_root/static;
internal; internal;
} }
} }
# ------------------------------------------------------------
# Server block for prometheus.evibes.com
# ------------------------------------------------------------
server { server {
server_name prometheus.evibes.com; listen 443 ssl http2;
listen 443 ssl; server_name prometheus.$domain;
ssl_certificate /etc/letsencrypt/live/evibes.com/fullchain.pem; ssl_certificate /etc/letsencrypt/live/$domain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/evibes.com/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/$domain/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf; include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy no-referrer-when-downgrade always;
client_max_body_size 100M; client_max_body_size 100M;
location / { location / {
proxy_pass http://localhost:9090; proxy_pass http://prom_backend;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
} }
location = /robots.txt { location = /robots.txt {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
alias /var/jenkins/workspace/evibes-backend-django/static/robots_backend.txt; alias /var/jenkins/workspace/$backend_root/static/robots_backend.txt;
default_type text/plain; default_type text/plain;
} }
location /favicon.ico { location /favicon.ico {
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/evibes-backend-django/static; root /var/jenkins/workspace/$backend_root/static;
} }
error_page 500 502 503 504 /maintenance.html; error_page 500 502 503 504 /maintenance.html;
location = /maintenance.html { location = /maintenance.html {
root /var/jenkins/workspace/evibes-backend-django/static;
add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Origin "*";
root /var/jenkins/workspace/$backend_root/static;
internal; internal;
} }
} }
# ------------------------------------------------------------
# HTTP → HTTPS Redirects
# ------------------------------------------------------------
server { server {
if ($host = www.evibes.com) {
return 301 https://$host$request_uri;
}
if ($host = evibes.com) {
return 301 https://$host$request_uri;
}
server_name evibes.com www.evibes.com;
listen 80; listen 80;
return 404; server_name api.$domain b2b.$domain www.$domain $domain prometheus.$domain;
} return 301 https://$host$request_uri;
server {
if ($host = api.evibes.com) {
return 301 https://$host$request_uri;
}
server_name api.evibes.com;
listen 80;
return 404;
} }