SpongeAuth/nginx.conf at master · SpongePowered/SpongeAuth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
user nginx;
worker_processes auto;
error_log /dev/stderr;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /dev/stdout  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    client_max_body_size 10M;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # TLS ends at Traefik: take the client address from its X-Forwarded-For.
    # The trusted proxies come from NGINX_TRUSTED_PROXIES, rendered by nginx-trusted-proxies.sh at startup.
    include             /run/nginx/trusted-proxies.conf;
    real_ip_header      X-Forwarded-For;
    real_ip_recursive   on;

    proxy_cache_path /var/cache/nginx/avatar levels=1:2 keys_zone=STATIC:10m inactive=6h max_size=2g;

    upstream spongeauth {
        # app container in the same pod
        server 127.0.0.1:8080;
    }

    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name  _;

        # static/ and media/ are mounted under here, at the same paths the app container uses under public_html
        root /usr/share/nginx/public_html;

        rewrite ^/avatars(.*)$ /avatar$1;
        rewrite ^/settings$ /accounts/settings/ permanent;

        location / {
            try_files $uri @proxy_to_app;
        }

        location /static/ {
            add_header Cache-Control "public, max-age=3600, must-revalidate";
        }

        location /avatar/ {
            proxy_cache_valid       5m;
            proxy_cache             STATIC;
            proxy_cache_key         "$request_method $request_uri $http_accept";
            proxy_cache_lock        on;
            add_header X-Cache-Status $upstream_cache_status;
            expires 5m;
            proxy_hide_header Vary;
            add_header Vary "Accept";

            add_header Cache-Control "public, max-age=300, must-revalidate";

            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Forwarded-Proto $http_x_forwarded_proto;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        Host $http_host;
            proxy_redirect          off;
            proxy_http_version      1.1;
            proxy_pass http://spongeauth;
        }

        location @proxy_to_app {
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Forwarded-Proto $http_x_forwarded_proto;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        Host $http_host;
            proxy_redirect          off;
            proxy_http_version      1.1;
            proxy_pass http://spongeauth;
        }
    }
}