diff --git a/docker/tna-python/Dockerfile b/docker/tna-python/Dockerfile index 4ab61ac..6be4196 100644 --- a/docker/tna-python/Dockerfile +++ b/docker/tna-python/Dockerfile @@ -148,7 +148,7 @@ RUN mkdir -p /app; \ # allows us to use a reverse proxy and serve # the app securely through HTTPS # ========================================== -COPY lib/nginx.conf /etc/nginx/conf.d +COPY lib/nginx.conf /etc/nginx/nginx.conf # ========================================== # Set $HOME env var to be the home directory diff --git a/docker/tna-python/lib/nginx.conf b/docker/tna-python/lib/nginx.conf index 6bcbb05..52bd777 100644 --- a/docker/tna-python/lib/nginx.conf +++ b/docker/tna-python/lib/nginx.conf @@ -1,34 +1,49 @@ -# generated 2024-11-07, Mozilla Guideline v5.7, nginx 1.26.0, OpenSSL 3.0.13, modern configuration, no OCSP -# https://ssl-config.mozilla.org/#server=nginx&version=1.26.0&config=modern&openssl=3.0.13&ocsp=false&guideline=5.7 +worker_processes auto; +pid /run/nginx.pid; +error_log /var/log/nginx/error.log; -server { - listen 443 ssl; - listen [::]:443 ssl; - http2 on; +events { + worker_connections 768; +} + +http { + sendfile on; + tcp_nopush on; + types_hash_max_size 2048; - ssl_certificate /etc/nginx/ssl/req.pem; - ssl_certificate_key /etc/nginx/ssl/key.pem; - ssl_session_timeout 1d; - ssl_session_cache shared:MozSSL:10m; # about 40000 sessions + include /etc/nginx/mime.types; + default_type application/octet-stream; - # modern configuration ssl_protocols TLSv1.3; ssl_prefer_server_ciphers off; - - location / { - proxy_pass http://localhost:8080; - proxy_redirect off; - # proxy_redirect http://localhost:8080/ $scheme://$http_host/; - proxy_set_header Host $host; - # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-For $remote_addr; - # proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Real-IP $remote_addr; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - proxy_read_timeout 20d; - proxy_buffering off; + + access_log /var/log/nginx/access.log; + + server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + + ssl_certificate /etc/nginx/ssl/req.pem; + ssl_certificate_key /etc/nginx/ssl/key.pem; + ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; # about 40000 sessions + + location / { + proxy_pass http://localhost:8080; + proxy_redirect off; + # proxy_redirect http://localhost:8080/ $scheme://$http_host/; + proxy_set_header Host $host; + # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-For $remote_addr; + # proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + # proxy_set_header Connection $connection_upgrade; + proxy_read_timeout 20d; + proxy_buffering off; + } } -} +} \ No newline at end of file