45 lines
1.8 KiB
Nginx Configuration File
45 lines
1.8 KiB
Nginx Configuration File
# Static serving for the ModelForge operator console.
|
|
#
|
|
# The console is a single-page application that talks to the control plane directly from the
|
|
# browser, so this server only ever returns files from its own build output. It proxies nothing,
|
|
# which keeps it out of the request path between an operator and an authenticated admin route.
|
|
#
|
|
# nginx only inherits `add_header` into a location that declares none of its own, so the security
|
|
# headers are included in every location rather than set once on the server. Setting them at the
|
|
# server level alone silently drops them from exactly the responses that matter most.
|
|
server {
|
|
listen 3000;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
server_tokens off;
|
|
|
|
# The console holds an operator credential in memory. These headers cost nothing and remove
|
|
# the easiest ways to get someone else's script or frame near it.
|
|
include /etc/nginx/conf.d/security-headers.inc;
|
|
|
|
# Hashed assets are immutable; the entry document must never be cached, or an operator can be
|
|
# left driving a console that no longer matches the control plane it is talking to.
|
|
location /assets/ {
|
|
include /etc/nginx/conf.d/security-headers.inc;
|
|
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location = /index.html {
|
|
include /etc/nginx/conf.d/security-headers.inc;
|
|
add_header Cache-Control "no-store" always;
|
|
}
|
|
|
|
location / {
|
|
include /etc/nginx/conf.d/security-headers.inc;
|
|
add_header Cache-Control "no-store" always;
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
# Nothing else is served: no directory listings, no dotfiles, no source maps by path guess.
|
|
location ~ /\. {
|
|
deny all;
|
|
}
|
|
}
|