iblog-client-react/nginx.conf at dev · DevOpsXLab/iblog-client-react · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# Crawlers and link-preview bots get server-rendered meta tags (title,
# description, Open Graph, JSON-LD) from the API; people get the SPA.
map $http_user_agent $is_bot {
    default 0;
    "~*(googlebot|google-inspectiontool|bingbot|yandex|duckduckbot|baiduspider|applebot|petalbot|slurp|telegrambot|twitterbot|facebookexternalhit|facebot|linkedinbot|slackbot|discordbot|whatsapp|pinterest|vkshare|skypeuripreview|redditbot|embedly|quora link preview|mastodon)" 1;
}

# Public scheme behind a TLS-terminating proxy.
map $http_x_forwarded_proto $public_scheme {
    default $http_x_forwarded_proto;
    "" $scheme;
}

server {
    listen 80;
    server_tokens off;
    root /usr/share/nginx/html;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/css application/javascript application/json image/svg+xml text/plain application/xml application/rss+xml;

    # Security headers for the SPA (the API sets its own).
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https: http:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin" always;

    # Server-Sent Events: no buffering, long-lived.
    location ~ ^/api/.*/stream$ {
        proxy_pass ${API_URL};
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 1h;
    }

    location /api/ {
        proxy_pass ${API_URL};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        client_max_body_size 6m;
    }

    # Hashed build assets never change.
    location /assets/ {
        add_header Cache-Control "public, max-age=31536000, immutable";
        add_header X-Content-Type-Options "nosniff" always;
        try_files $uri =404;
    }

    # robots.txt needs an absolute sitemap URL, so it is built per host.
    location = /robots.txt {
        default_type text/plain;
        return 200 "User-agent: *\nDisallow: /me/\nDisallow: /new-story\nDisallow: /p/*/edit\nAllow: /\n\nSitemap: $public_scheme://$http_host/api/sitemap.xml\n";
    }

    location = /healthz {
        access_log off;
        default_type text/plain;
        return 200 "ok";
    }

    # SPA: always revalidate the shell so deploys show up immediately.
    location / {
        add_header Cache-Control "no-cache";
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https: http:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
        add_header Cross-Origin-Opener-Policy "same-origin" always;
        if ($is_bot) {
            rewrite ^/(.*)$ /api/prerender/$1 last;
        }
        try_files $uri /index.html;
    }
}