73 lines
2.4 KiB
Nginx Configuration File
73 lines
2.4 KiB
Nginx Configuration File
# Dojo Bay, containerized for Archipelago.
|
|
#
|
|
# Adapted from the upstream project's deploy/nginx-onion.conf.example. The
|
|
# Tor hidden service, TLS-equivalent framing and moderation-queue trust
|
|
# decisions all belong to Archipelago's app gate now (it fronts every gated
|
|
# port with its own onion, strips clickjacking headers for iframe embedding,
|
|
# and enforces the manifest's auth policy) — this file keeps only what is
|
|
# still this app's own job: serving the static directory site and proxying
|
|
# its self-service API to the Node backend running in the same container.
|
|
worker_processes 1;
|
|
pid /var/run/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
sendfile on;
|
|
access_log /dev/stdout;
|
|
error_log /dev/stderr;
|
|
|
|
gzip on;
|
|
gzip_types text/css text/javascript application/javascript application/json image/svg+xml text/markdown;
|
|
|
|
server {
|
|
listen 8080;
|
|
server_name _;
|
|
root /app;
|
|
index index.html;
|
|
|
|
# The directory data is rewritten every 10 minutes by scripts/update.mjs —
|
|
# keep it fresh rather than letting a browser cache it for a day like the
|
|
# other static assets below.
|
|
location /data/ {
|
|
add_header Cache-Control "max-age=60";
|
|
default_type application/json;
|
|
}
|
|
|
|
# Code and markup must revalidate so an image update shows up immediately.
|
|
location ~* \.(html|js|css|md)$ {
|
|
add_header Cache-Control "no-cache";
|
|
}
|
|
|
|
# Large, rarely-changing assets can be cached for a day.
|
|
location ~* \.(woff2|png|svg|ico)$ {
|
|
add_header Cache-Control "max-age=86400";
|
|
}
|
|
|
|
# --- self-service backend (Auth47 submission API) ---
|
|
location /api/ {
|
|
proxy_pass http://127.0.0.1:8787;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 45s; # the connection gate + PayNym lookup probe Tor
|
|
}
|
|
|
|
# SECURITY: the backend's own source and store (sessions, payment codes,
|
|
# node API keys) live under server/ inside the web root. Never serve it.
|
|
location ^~ /server/ { return 404; }
|
|
|
|
# Serve the SPA shell for the admin route (client-side view; auth is
|
|
# enforced by the backend, this only returns the same HTML/JS).
|
|
location = /admin { try_files /index.html =404; }
|
|
|
|
location / {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
}
|
|
}
|