ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
88 lines
3.8 KiB
Nginx Configuration File
88 lines
3.8 KiB
Nginx Configuration File
pid /tmp/nginx.pid;
|
|
error_log /dev/stderr warn;
|
|
events { worker_connections 256; }
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
access_log /dev/stdout;
|
|
sendfile on;
|
|
client_body_temp_path /tmp/client_temp;
|
|
proxy_temp_path /tmp/proxy_temp;
|
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
scgi_temp_path /tmp/scgi_temp;
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 8080;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header Content-Security-Policy "default-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'" always;
|
|
add_header Permissions-Policy "camera=(), geolocation=(), microphone=(), payment=()" always;
|
|
# Defence-in-depth per SECURITY_THREAT_MODEL.md §4 ("HSTS when HTTPS
|
|
# deployment is stable"). TLS terminates at the external Nginx Proxy
|
|
# Manager (ADR-0010); this container only ever serves plain HTTP on
|
|
# 8080. Browsers ignore Strict-Transport-Security on a non-HTTPS
|
|
# response, so emitting it here unconditionally is safe even before/if
|
|
# this service is ever reached directly over HTTP, and it still reaches
|
|
# the browser once NPM proxies the HTTPS response through unless NPM is
|
|
# configured to strip it (verify during deployment smoke test, see
|
|
# docs/operations/DEPLOYMENT_UNRAID.md §7). `includeSubDomains` is set;
|
|
# `preload` is intentionally omitted because preload-list submission is
|
|
# effectively irreversible and should only be added once the HTTPS/DNS
|
|
# setup at the NPM edge has been stable in production for a while.
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
location = /healthz {
|
|
access_log off;
|
|
default_type text/plain;
|
|
return 200 "ok\n";
|
|
}
|
|
# Never let conventional internal-observability paths fall through to the
|
|
# SPA with a misleading HTTP 200. Pulse exposes bounded authenticated
|
|
# diagnostics below /api/v1/system/*; raw metrics/debug handlers are not a
|
|
# public web contract.
|
|
location = /metrics { access_log off; return 404; }
|
|
location ^~ /debug/ { access_log off; return 404; }
|
|
# Dependency-aware readiness must reach the API. Without this exact route,
|
|
# SPA fallback returns index.html with HTTP 200 and monitoring falsely sees
|
|
# a ready backend even when PostgreSQL or migrations are unavailable.
|
|
location = /readyz {
|
|
proxy_pass http://pulse-api:8081;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
location /api/ {
|
|
proxy_pass http://pulse-api:8081;
|
|
proxy_http_version 1.1;
|
|
# Preserve a non-default deployment port. The WebSocket library's
|
|
# same-origin check compares Origin against Host and correctly rejects
|
|
# a port-stripped Host header.
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_read_timeout 65s;
|
|
}
|
|
location ~ ^/(auth|session)/ {
|
|
proxy_pass http://pulse-api:8081;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
location / { try_files $uri $uri/ /index.html; }
|
|
}
|
|
}
|