e4499f44b7
Co-authored-by: Yurii Vlasov <yv@itsvit.org> Reviewed-on: https://kolaente.dev/vikunja/frontend/pulls/3018 Reviewed-by: konrad <k@knt.li> Co-authored-by: Yurii Vlasov <yuriy@vlasov.pro> Co-committed-by: Yurii Vlasov <yuriy@vlasov.pro>
72 lines
2.1 KiB
Plaintext
72 lines
2.1 KiB
Plaintext
server {
|
|
listen ${VIKUNJA_HTTP_PORT};
|
|
listen [::]:${VIKUNJA_HTTP_PORT};
|
|
## Needed when behind HAProxy with SSL termination + HTTP/2 support
|
|
listen ${VIKUNJA_HTTP2_PORT} default_server http2 proxy_protocol;
|
|
listen [::]:${VIKUNJA_HTTP2_PORT} default_server http2 proxy_protocol;
|
|
|
|
server_name _;
|
|
expires $expires;
|
|
root /usr/share/nginx/html;
|
|
access_log /dev/stdout ${VIKUNJA_LOG_FORMAT};
|
|
# security headers
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "no-referrer-when-downgrade" always;
|
|
add_header Content-Security-Policy "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
|
|
add_header Permissions-Policy "interest-cohort=()" always;
|
|
|
|
# . files
|
|
location ~ /\.(?!well-known) {
|
|
deny all;
|
|
}
|
|
|
|
# assume that everything else is handled by the application router, by injecting the index.html.
|
|
location / {
|
|
autoindex off;
|
|
expires off;
|
|
add_header Cache-Control "public, max-age=0, s-maxage=0, must-revalidate" always;
|
|
try_files $uri /index.html =404;
|
|
}
|
|
|
|
# favicon.ico
|
|
location = /favicon.ico {
|
|
log_not_found off;
|
|
access_log off;
|
|
}
|
|
|
|
# robots.txt
|
|
location = /robots.txt {
|
|
log_not_found off;
|
|
access_log off;
|
|
expires -1; # no-cache
|
|
}
|
|
|
|
location = /ready {
|
|
return 200 "";
|
|
access_log off;
|
|
expires -1; # no-cache
|
|
}
|
|
|
|
# all assets contain hash in filename, cache forever
|
|
location ^~ /assets/ {
|
|
add_header Cache-Control "public, max-age=31536000, s-maxage=31536000, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# all workbox scripts are compiled with hash in filename, cache forever3
|
|
location ^~ /workbox- {
|
|
add_header Cache-Control "public, max-age=31536000, s-maxage=31536000, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# assets, media
|
|
location ~* .(txt|webmanifest|css|js|mjs|map|svg|jpg|jpeg|png|ico|ttf|woff|woff2|wav)$ {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
error_page 500 502 503 504 /50x.html;
|
|
location = /50x.html { }
|
|
|
|
}
|