infrastructure/roles/archmanweb/templates/nginx.d.conf.j2

upstream archmanweb {
    server unix:///run/uwsgi/archmanweb.sock;
}

limit_req_zone $binary_remote_addr zone=archmanweb_limit:10m rate=2r/s;
limit_req_status 429;

server {
    listen       80;
    listen       [::]:80;
    server_name  {{ archmanweb_domain }};

    access_log   /var/log/nginx/{{ archmanweb_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ archmanweb_domain }}/access.log.json json_reduced;
    error_log    /var/log/nginx/{{ archmanweb_domain }}/error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen       443 ssl;
    listen       [::]:443 ssl;
    http2        on;
    server_name  {{ archmanweb_domain }};

    access_log   /var/log/nginx/{{ archmanweb_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ archmanweb_domain }}/access.log.json json_reduced;
    error_log    /var/log/nginx/{{ archmanweb_domain }}/error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ archmanweb_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ archmanweb_domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ archmanweb_domain }}/chain.pem;

    limit_req zone=archmanweb_limit burst=10 delay=8;

    location = /favicon.ico {
        alias {{ archmanweb_dir }}/repo/collected_static/archlinux-common/favicon.ico;
    }

    location = /robots.txt {
        alias {{ archmanweb_dir }}/repo/robots.txt;
    }

    # Client-cache for Django's static assets
    location /static/ {
        expires 30d;
        add_header Pragma public;
        add_header Cache-Control "public";
        alias {{ archmanweb_dir }}/repo/collected_static/;
    }

    location / {
        access_log   /var/log/nginx/{{ archmanweb_domain }}/access.log main;
        access_log   /var/log/nginx/{{ archmanweb_domain }}/access.log.json json_main;
        include uwsgi_params;
        uwsgi_pass archmanweb;
    }
}