Skip to content
GitLab
Switch branch/tag
Find file BlameHistoryPermalink
nginx.conf 3.08 KiB
1 
map $http_upgrade $connection_upgrade {
2 
  default upgrade;
3 
  ''      close;
4 
}
5
6 
upstream backend {
7 
    server 127.0.0.1:3000 fail_timeout=0;
8 
}
9
10 
upstream streaming {
11 
    server 127.0.0.1:4000 fail_timeout=0;
12 
}
13
14 
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=1g;
15
16 
server {
17 
  listen 80;
18 
  listen [::]:80;
19 
  server_name example.com;
20 
  root /home/mastodon/live/public;
21 
  location /.well-known/acme-challenge/ { allow all; }
22 
  location / { return 301 https://$host$request_uri; }
23 
}
24
25 
server {
26 
  listen 443 ssl http2;
27 
  listen [::]:443 ssl http2;
28 
  server_name example.com;
29
30 
  ssl_protocols TLSv1.2 TLSv1.3;
31 
  ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA;
32 
  ssl_prefer_server_ciphers on;
33 
  ssl_session_cache shared:SSL:10m;
34 
  ssl_session_tickets off;
35
36 
  # Uncomment these lines once you acquire a certificate:
37 
  # ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
38 
  # ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
39
40 
  keepalive_timeout    70;
41 
  sendfile             on;
42 
  client_max_body_size 80m;
43
44 
  root /home/mastodon/live/public;
45
46 
  gzip on;
47 
  gzip_disable "msie6";
48 
  gzip_vary on;
49 
  gzip_proxied any;
50 
  gzip_comp_level 6;
51 
  gzip_buffers 16 8k;
52 
  gzip_http_version 1.1;
53 
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/x-icon;
54
55 
  location / {
56 
    try_files $uri @proxy;
57 
  }
58
59 
  location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
60 
    add_header Cache-Control "public, max-age=31536000, immutable";
61 
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
62 
    try_files $uri @proxy;
63 
  }
64
65 
  location /sw.js {
66 
    add_header Cache-Control "public, max-age=0";
67 
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
68 
    try_files $uri @proxy;
69 
  }
70
7172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114
location @proxy { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Proxy ""; proxy_pass_header Server; proxy_pass http://backend; proxy_buffering on; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_cache CACHE; proxy_cache_valid 200 7d; proxy_cache_valid 410 24h; proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504; add_header X-Cached $upstream_cache_status; tcp_nodelay on; } location /api/v1/streaming { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Proxy ""; proxy_pass http://streaming; proxy_buffering off; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; tcp_nodelay on; } error_page 500 501 502 503 504 /500.html; }