File size: 3,271 Bytes
0e76632 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 | events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
# Rate limiting zone
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
upstream mac_api {
server mac:8000;
keepalive 32;
}
# ── HTTP → HTTPS redirect ────────────────────────────────
server {
listen 80;
server_name _;
return 301 https://$host$request_uri;
}
# ── HTTPS server ─────────────────────────────────────────
server {
listen 443 ssl http2;
server_name _;
# SSL — replace with your cert paths (or use Certbot / self-signed)
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# Security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy strict-origin-when-cross-origin always;
# Max upload size
client_max_body_size 512m;
# SvelteKit frontend
root /app;
location / {
try_files $uri $uri/ /index.html;
}
location /_app/immutable/ {
expires 1y;
add_header Cache-Control "public, immutable";
}
location = /sw.js {
add_header Service-Worker-Allowed /;
add_header Cache-Control "no-cache, no-store, must-revalidate";
}
location = /manifest.json {
add_header Cache-Control "public, max-age=3600";
}
# API proxy
location /api/ {
limit_req zone=api burst=30 nodelay;
proxy_pass http://mac_api;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Connection "";
# SSE streaming
proxy_buffering off;
proxy_cache off;
proxy_read_timeout 300s;
}
# WebSocket proxy (notebook kernels)
location /ws/ {
proxy_pass http://mac_api;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_read_timeout 86400s;
}
# Docs
location ~ ^/(docs|redoc|openapi\.json) {
proxy_pass http://mac_api;
proxy_set_header Host $host;
}
# Health check
location /nginx-health {
return 200 'ok';
add_header Content-Type text/plain;
}
}
}
|