From a86e9f832353288115ba2ebe6bcad11a2cc662ac Mon Sep 17 00:00:00 2001 From: Kana Date: Fri, 1 Mar 2019 00:17:31 +0900 Subject: Create nginx.md --- docs/nginx.md | 92 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 docs/nginx.md (limited to 'docs/nginx.md') diff --git a/docs/nginx.md b/docs/nginx.md new file mode 100644 index 0000000..436dcfb --- /dev/null +++ b/docs/nginx.md @@ -0,0 +1,92 @@ +### Nginx config for SSL +Make sure that: +- `backend` and `frontend` ports match your wizard config +- `client_max_body_size` matches your wizard config +- You replace `your.domain` where pertinent +- You point the `root` folder to your uploads folder + + +```nginx +upstream backend { + server 127.0.0.1:5000; +} + +upstream frontend { + server 127.0.0.1:5005; +} + +server { + listen 80; + listen [::]:80; + server_name your.domain; + + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name your.domain; + + ssl_certificate /path/to/certificate.pem; + ssl_certificate_key /path/to/certificate.key; + ssl_trusted_certificate /path/to/certificate.pem; + + access_log /var/log/nginx/your.domain.access.log; + error_log /var/log/nginx/your.domain.error.log; + + # Security + ssl_session_timeout 1d; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128- + GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SH + A:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM + -SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS'; + ssl_prefer_server_ciphers on; + add_header X-XSS-Protection "1; mode=block"; + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8 8.8.4.4 valid=300s; + resolver_timeout 5s; + + client_max_body_size 90M; + client_body_timeout 600s; + + location / { + add_header Access-Control-Allow-Origin *; + root /path/to/your/uploads; + try_files $uri @proxy; + } + + location @proxy { + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $http_host; + proxy_set_header X-NginX-Proxy true; + proxy_pass http://frontend; + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_redirect off; + proxy_set_header X-Forwarded-Proto $scheme; + } + + location /api { + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $http_host; + proxy_set_header X-NginX-Proxy true; + proxy_pass http://backendbeta; + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_redirect off; + proxy_set_header X-Forwarded-Proto $scheme; + } +} +``` -- cgit v1.2.3 From 36b11f00273a53aa5bb392a4363c48ffe0b45e01 Mon Sep 17 00:00:00 2001 From: Kana Date: Fri, 1 Mar 2019 00:40:13 +0900 Subject: Update nginx.md --- docs/nginx.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs/nginx.md') diff --git a/docs/nginx.md b/docs/nginx.md index 436dcfb..592e8f6 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -80,7 +80,7 @@ server { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header X-NginX-Proxy true; - proxy_pass http://backendbeta; + proxy_pass http://backend; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; -- cgit v1.2.3 From 5df8485c5e81d16a3b1a4195b629dbd72d11dfb5 Mon Sep 17 00:00:00 2001 From: Pitu Date: Sun, 10 May 2020 21:51:49 +0900 Subject: updated nginx sample config --- docs/nginx.md | 31 +++---------------------------- 1 file changed, 3 insertions(+), 28 deletions(-) (limited to 'docs/nginx.md') diff --git a/docs/nginx.md b/docs/nginx.md index 592e8f6..48aaa26 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -1,9 +1,8 @@ ### Nginx config for SSL -Make sure that: -- `backend` and `frontend` ports match your wizard config +Make sure that: +- `backend` port matches your wizard config - `client_max_body_size` matches your wizard config - You replace `your.domain` where pertinent -- You point the `root` folder to your uploads folder ```nginx @@ -11,10 +10,6 @@ upstream backend { server 127.0.0.1:5000; } -upstream frontend { - server 127.0.0.1:5005; -} - server { listen 80; listen [::]:80; @@ -55,27 +50,7 @@ server { client_max_body_size 90M; client_body_timeout 600s; - location / { - add_header Access-Control-Allow-Origin *; - root /path/to/your/uploads; - try_files $uri @proxy; - } - - location @proxy { - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $http_host; - proxy_set_header X-NginX-Proxy true; - proxy_pass http://frontend; - proxy_redirect off; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_redirect off; - proxy_set_header X-Forwarded-Proto $scheme; - } - - location /api { + location /api { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; -- cgit v1.2.3 From e0c35a7d7402ad6915a89bf8c167508eac5046be Mon Sep 17 00:00:00 2001 From: Pitu Date: Mon, 11 May 2020 01:07:44 +0900 Subject: fix: nginx config --- docs/nginx.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs/nginx.md') diff --git a/docs/nginx.md b/docs/nginx.md index 48aaa26..bdf1112 100644 --- a/docs/nginx.md +++ b/docs/nginx.md @@ -50,7 +50,7 @@ server { client_max_body_size 90M; client_body_timeout 600s; - location /api { + location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; -- cgit v1.2.3