blob: 9776b8fc914eb421292cfa879316bf05be100a99 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
#daemon off; ##Included in CMD
error_log /dev/stdout info;
worker_processes 1;
# user nobody nogroup;
pid /tmp/nginx.pid;
events {
worker_connections 1024;
accept_mutex off;
}
http {
include mime.types;
default_type application/octet-stream;
access_log /dev/stdout combined;
sendfile on;
client_max_body_size 16m;
large_client_header_buffers 4 2k;
limit_req_zone $binary_remote_addr zone=login_ip:10m rate=30r/m;
limit_conn_zone $binary_remote_addr zone=conn_per_ip:10m;
limit_conn conn_per_ip 100;
upstream app_server {
# For a TCP configuration:
server layersapp:5000 fail_timeout=0;
}
server {
listen 80 default;
server_name _;
keepalive_timeout 5;
# path for static files
root /usr/share/nginx/html;
return 301 https://layers.openembedded.org$request_uri;
}
server {
listen 80;
server_name layers.openembedded.org;
keepalive_timeout 5;
# path for static files
root /usr/share/nginx/html;
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
location /favicon.ico {
return 301 http://layers.openembedded.org/static/img/favicon.ico;
}
location /admin {
return 301 https://layers.openembedded.org$request_uri;
}
location /accounts/login {
return 301 https://layers.openembedded.org$request_uri;
}
location / {
try_files $uri @proxy_to_app;
}
location @proxy_to_app {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_redirect off;
proxy_pass http://app_server;
}
}
server {
listen 443 ssl default;
server_name _;
ssl_certificate /etc/letsencrypt/live/layers.openembedded.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/layers.openembedded.org/privkey.pem;
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:ECDHE-ECDSA-AES128-CCM:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-CCM:AES128-CCM:AES128-SHA256:AES256-CCM:AES256-SHA256:DHE-RSA-AES128-CCM:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-CCM:DHE-RSA-AES256-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA256:!aNULL:!eNULL;
ssl_ecdh_curve prime256v1;
ssl_session_cache shared:SSL:12m;
ssl_session_timeout 12m;
gzip off;
keepalive_timeout 5;
# path for static files
root /usr/share/nginx/html;
return 301 https://layers.openembedded.org$request_uri;
}
server {
listen 443 ssl;
server_name layers.openembedded.org;
ssl_certificate /etc/letsencrypt/live/layers.openembedded.org/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/layers.openembedded.org/privkey.pem;
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:AES128-GCM-SHA256:ECDHE-ECDSA-AES128-CCM:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-CCM:AES128-CCM:AES128-SHA256:AES256-CCM:AES256-SHA256:DHE-RSA-AES128-CCM:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-CCM:DHE-RSA-AES256-SHA256:DHE-DSS-AES128-GCM-SHA256:DHE-DSS-AES128-SHA256:DHE-DSS-AES256-SHA256:!aNULL:!eNULL;
ssl_ecdh_curve prime256v1;
ssl_session_cache shared:SSL:12m;
ssl_session_timeout 12m;
gzip off;
keepalive_timeout 20;
# path for static files
root /usr/share/nginx/html;
location /favicon.ico {
return 301 https://layers.openembedded.org/static/img/favicon.ico;
}
location / {
try_files $uri @proxy_to_app;
}
location /accounts/login {
limit_req zone=login_ip burst=5;
try_files $uri @proxy_to_app;
}
location @proxy_to_app {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_redirect off;
proxy_pass http://app_server;
}
}
}
|
