77 lines
3 KiB
Text
77 lines
3 KiB
Text
# Worker stays unprivileged as the image's default "nginx" user, but gains the "root" group so
|
|
# it can read /var/www/userfiles - backend-b (running as root) writes those with
|
|
# FILE_UPLOAD_DIRECTORY_PERMISSIONS=0750, group-readable but not world-readable. Mirrors
|
|
# deploy/prod/playbook.yml's "Allow nginx to read backend user files" (www-data joins the
|
|
# backend's file-owning group instead of loosening the mode).
|
|
user nginx root;
|
|
|
|
events {}
|
|
|
|
http {
|
|
client_max_body_size 128M;
|
|
|
|
upstream backend {
|
|
server backend-b:8000;
|
|
}
|
|
|
|
server {
|
|
|
|
listen 8080 ssl;
|
|
server_name localhost;
|
|
|
|
ssl_certificate /etc/nginx/nginx.crt;
|
|
ssl_certificate_key /etc/nginx/nginx.key;
|
|
|
|
location /api {
|
|
#proxy_set_header X-Forwarded-For "$http_x_forwarded_for, $realip_remote_addr";
|
|
proxy_set_header Host $host:$server_port;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_pass http://backend;
|
|
}
|
|
|
|
location /auth {
|
|
#proxy_set_header X-Forwarded-For "$http_x_forwarded_for, $realip_remote_addr";
|
|
proxy_set_header Host $host:$server_port;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_pass http://backend;
|
|
}
|
|
|
|
location /media {
|
|
proxy_set_header Host $host:$server_port;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_pass http://backend;
|
|
}
|
|
|
|
location /redirect_media/ {
|
|
internal;
|
|
alias /var/www/userfiles/;
|
|
# This location serves the file directly, bypassing Django (and therefore
|
|
# django-cors-headers) entirely - it's the target of the X-Accel-Redirect
|
|
# response from files/media_urls.py, used when SERVE_X_ACCEL_REDIRECT=True.
|
|
# CORS headers must be added here explicitly since nothing else will.
|
|
add_header 'Access-Control-Allow-Origin' '*' always;
|
|
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
|
|
add_header 'Access-Control-Allow-Headers' 'Authorization, Accept, Content-Type, Origin, User-Agent' always;
|
|
}
|
|
|
|
location /docs {
|
|
proxy_pass http://backend/docs;
|
|
}
|
|
|
|
location /static {
|
|
proxy_pass http://backend/static;
|
|
}
|
|
}
|
|
}
|