mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-10 22:50:30 +02:00
Mark HegrebergandChristian Heusel
410f59cb5a
these are all the systems that the new redirect snippet can be cleanly applied to. there are a few others not included, that will need a more manual approach: - gitlab (multiple domains) - mta.sts(multiple domains) - archweb(mutltiple domains, snippets) - buildbtw(dynamic dev domains) - redirects(different structure) - public html(multiple domains) - archweb maintenence(different structure) - maintenence(different structure) some of these might be solvable by tweaking the snippet to accept multiple domains. I'll look into this Co-authored-by: Christian Heusel <christian@heusel.eu>
44 lines
1.5 KiB
Django/Jinja
44 lines
1.5 KiB
Django/Jinja
include snippets/redirect-80.conf;
|
|
|
|
server {
|
|
include snippets/listen-443.conf;
|
|
server_name {{ rebuilderd_domain }};
|
|
|
|
access_log /var/log/nginx/{{ rebuilderd_domain }}/access.log reduced;
|
|
access_log /var/log/nginx/{{ rebuilderd_domain }}/access.log.json json_reduced;
|
|
error_log /var/log/nginx/{{ rebuilderd_domain }}/error.log;
|
|
|
|
acme_certificate letsencrypt;
|
|
ssl_certificate $acme_certificate;
|
|
ssl_certificate_key $acme_certificate_key;
|
|
|
|
# Security headers
|
|
include snippets/headers.conf;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Xss-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "same-origin";
|
|
add_header Feature-Policy "geolocation 'none' ;midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'none'; payment 'none';";
|
|
add_header Content-Security-Policy "default-src 'self';";
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
root {{ rebuilder_website_loc }};
|
|
|
|
location ~* (css|js|svg)$ {
|
|
expires 30d;
|
|
include snippets/headers.conf;
|
|
add_header Pragma public;
|
|
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
|
|
}
|
|
|
|
location /api/ {
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_pass http://127.0.0.1:8484;
|
|
}
|
|
|
|
location = /api/v0/build/report {
|
|
client_max_body_size 200M;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_pass http://127.0.0.1:8484;
|
|
}
|
|
}
|