143 lines
5.2 KiB
Plaintext
143 lines
5.2 KiB
Plaintext
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name helloayanova.com www.helloayanova.com;
|
|
location ^~ /.well-known/acme-challenge {
|
|
root /usr/share/nginx/html;
|
|
default_type text/plain;
|
|
allow all;
|
|
}
|
|
location / {
|
|
rewrite ^ https://$host$request_uri? permanent;
|
|
}
|
|
}
|
|
#https://helloayanova.com
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_name helloayanova.com;
|
|
server_tokens off;
|
|
ssl_certificate /etc/letsencrypt/live/helloayanova.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/helloayanova.com/privkey.pem;
|
|
ssl_buffer_size 8k;
|
|
ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
|
|
ssl_ecdh_curve secp384r1;
|
|
ssl_session_tickets off;
|
|
# OCSP stapling
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
resolver 8.8.8.8;
|
|
location ^~ /.well-known/acme-challenge {
|
|
root /usr/share/nginx/html;
|
|
default_type text/plain;
|
|
allow all;
|
|
}
|
|
return 301 https://www.helloayanova.com$request_uri;
|
|
}
|
|
#https://www.helloayanova.com
|
|
#This is the "web" server for static files outside of AyaNova app server
|
|
server {
|
|
server_name www.helloayanova.com;
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_tokens off;
|
|
ssl on;
|
|
ssl_buffer_size 8k;
|
|
ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
|
|
ssl_ecdh_curve secp384r1;
|
|
ssl_session_tickets off;
|
|
# OCSP stapling
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
resolver 8.8.8.8 8.8.4.4;
|
|
ssl_certificate /etc/letsencrypt/live/helloayanova.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/helloayanova.com/privkey.pem;
|
|
location ^~ /.well-known/acme-challenge {
|
|
root /usr/share/nginx/html;
|
|
default_type text/plain;
|
|
allow all;
|
|
}
|
|
|
|
|
|
location / {
|
|
#security headers
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
#CSP
|
|
add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com https://ajax.googleapis.com; img-src 'self'; style-src 'self' https://maxcdn.bootstrapcdn.com; font-src 'self' data: https://maxcdn.bootstrapcdn.com; form-action 'self'; upgrade-insecure-requests;" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
}
|
|
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
}
|
|
|
|
#https://v8.helloayanova.com, https://test.helloayanova.com helloayanova
|
|
server {
|
|
server_name test.helloayanova.com v8.helloayanova.com;
|
|
listen 443 ssl http2;
|
|
listen [::]:443 ssl http2;
|
|
server_tokens off;
|
|
ssl on;
|
|
ssl_buffer_size 8k;
|
|
ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
|
|
ssl_ecdh_curve secp384r1;
|
|
ssl_session_tickets off;
|
|
# OCSP stapling
|
|
ssl_stapling on;
|
|
ssl_stapling_verify on;
|
|
resolver 8.8.8.8 8.8.4.4;
|
|
ssl_certificate /etc/letsencrypt/live/helloayanova.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/helloayanova.com/privkey.pem;
|
|
location ^~ /.well-known/acme-challenge {
|
|
root /usr/share/nginx/html;
|
|
default_type text/plain;
|
|
allow all;
|
|
}
|
|
|
|
location / {
|
|
#security headers
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
|
|
#CSP
|
|
#https://developers.google.com/web/fundamentals/security/csp/
|
|
add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self' 'unsafe-inline' https://apis.google.com; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; font-src 'self' https://fonts.googleapis.com/ https://fonts.gstatic.com; form-action 'self'; upgrade-insecure-requests;" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
#This is "ayanova" because it's the docker network and port
|
|
proxy_pass http://ayanova:7575;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $http_host;
|
|
proxy_cache_bypass $http_upgrade;
|
|
|
|
#These timeouts are only required for large trial data generation which should be re-coded to start the process and return immediately
|
|
#AS of alpha-4 large data generation on D.O. takes 1'04'' so setting these to 3 minutes as a safe margin
|
|
|
|
proxy_connect_timeout 180;
|
|
proxy_send_timeout 180;
|
|
proxy_read_timeout 180;
|
|
send_timeout 180;
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|