nginx.conf
1,577 bytes
| 1 | limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=10r/m; |
|---|---|
| 2 | |
| 3 | server { |
| 4 | listen 80; |
| 5 | server_name _; |
| 6 | root /usr/share/nginx/html; |
| 7 | index index.html; |
| 8 | client_max_body_size 7m; |
| 9 | |
| 10 | add_header X-Content-Type-Options nosniff always; |
| 11 | add_header X-Frame-Options DENY always; |
| 12 | add_header Referrer-Policy strict-origin-when-cross-origin always; |
| 13 | add_header Permissions-Policy "camera=(self), geolocation=(self), microphone=()" always; |
| 14 | add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: blob: https:; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always; |
| 15 | |
| 16 | location = /healthz { |
| 17 | access_log off; |
| 18 | default_type text/plain; |
| 19 | return 200 "ok\n"; |
| 20 | } |
| 21 | |
| 22 | location = /api/v1/auth/login { |
| 23 | limit_req zone=auth_limit burst=5 nodelay; |
| 24 | include /etc/nginx/proxy-common.conf; |
| 25 | } |
| 26 | |
| 27 | location = /api/v1/auth/register { |
| 28 | limit_req zone=auth_limit burst=3 nodelay; |
| 29 | include /etc/nginx/proxy-common.conf; |
| 30 | } |
| 31 | |
| 32 | location /api/ { |
| 33 | include /etc/nginx/proxy-common.conf; |
| 34 | } |
| 35 | |
| 36 | location /uploads/ { |
| 37 | include /etc/nginx/proxy-common.conf; |
| 38 | expires 7d; |
| 39 | add_header Cache-Control "public, immutable"; |
| 40 | add_header X-Content-Type-Options nosniff always; |
| 41 | } |
| 42 | |
| 43 | location /assets/ { |
| 44 | try_files $uri =404; |
| 45 | expires 1y; |
| 46 | add_header Cache-Control "public, immutable"; |
| 47 | } |
| 48 | |
| 49 | location / { |
| 50 | try_files $uri $uri/ /index.html; |
| 51 | } |
| 52 | } |
| 53 | |