Adriano
1921bc3302
La regex delle estensioni statiche ora richiede il prefisso /static/, non qualunque path con quell'estensione. Gli header di sicurezza del blocco server non si ereditano in un location che ha un proprio add_header (comportamento nginx): ripetuti lì. Rimossa location /uploads/: verificato che il backend non la monta, i file passano da /api/files (files.py). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
66 lines
2.2 KiB
Nginx Configuration File
66 lines
2.2 KiB
Nginx Configuration File
upstream server_backend {
|
|
server server:8000;
|
|
}
|
|
|
|
upstream client_frontend {
|
|
server client:5000;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Gzip compression
|
|
gzip on;
|
|
gzip_types text/plain text/css application/json application/javascript text/xml;
|
|
gzip_min_length 256;
|
|
|
|
# Security headers
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Max upload size
|
|
client_max_body_size 50M;
|
|
|
|
# API requests → FastAPI server
|
|
location /api/ {
|
|
proxy_pass http://server_backend;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 120s;
|
|
}
|
|
|
|
# All other requests → Flask client
|
|
location / {
|
|
proxy_pass http://client_frontend;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# Static file caching. Limitata a /static/: un add_header in questo
|
|
# location spegne l'ereditarietà di quelli del blocco server (comportamento
|
|
# nginx), quindi vanno ripetuti qui.
|
|
location ~* ^/static/.*\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf)$ {
|
|
proxy_pass http://client_frontend;
|
|
proxy_set_header Host $host;
|
|
expires 7d;
|
|
add_header Cache-Control "public, immutable";
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
}
|
|
|
|
# SSL configuration (uncomment when using Let's Encrypt)
|
|
# listen 443 ssl;
|
|
# ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
|
|
# ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
|
|
# ssl_protocols TLSv1.2 TLSv1.3;
|
|
}
|