51 lines
1.6 KiB
Nginx Configuration File
51 lines
1.6 KiB
Nginx Configuration File
|
upstream {{ site_name }}_django_wsgi {
|
||
|
|
keepalive 2; # Cache 2 connections.
|
||
|
|
server unix:/run/{{ site_name }}/django_uwsgi.sock;
|
||
|
|
}
|
||
|
|
|
||
|
|
# server {
|
||
|
|
# listen 80;
|
||
|
|
# server_name {{ env.domain }};
|
||
|
|
# return 301 https://{{ env.domain }}$request_uri;
|
||
|
|
# }
|
||
|
|
|
||
|
|
server {
|
||
|
|
listen 80; # 443 ssl http2;
|
||
|
|
server_name {{ env.domain }};
|
||
|
|
client_max_body_size 50M;
|
||
|
|
|
||
|
|
ssl_certificate /etc/letsencrypt/live/{{ env.domain }}/fullchain.pem;
|
||
|
|
ssl_certificate_key /etc/letsencrypt/live/{{ env.domain }}/privkey.pem;
|
||
|
|
|
||
|
|
# Ask for HTTPS for 180 days.
|
||
|
|
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains";
|
||
|
|
|
||
|
|
# Advise browsers not to use content type sniffing to reduce chance of XSS attacks.
|
||
|
|
add_header X-Content-Type-Options nosniff;
|
||
|
|
|
||
|
|
# Advise browser to only load external content from these sites.
|
||
|
|
add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval'";
|
||
|
|
|
||
|
|
location / {
|
||
|
|
# Django web application including static files (via WhiteNoise).
|
||
|
|
uwsgi_pass {{ site_name }}_django_wsgi;
|
||
|
|
include uwsgi_params;
|
||
|
|
|
||
|
|
# Disable gzip compression when where traffic might be over SSL
|
||
|
|
# to avoid an attack that may compromise Django's CSRF
|
||
|
|
# protection. See:
|
||
|
|
# https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/
|
||
|
|
gzip off;
|
||
|
|
}
|
||
|
|
|
||
|
|
location /media/ {
|
||
|
|
# User-uploaded files and generated reports.
|
||
|
|
alias {{ project_dir }}/media/;
|
||
|
|
expires 1y;
|
||
|
|
}
|
||
|
|
|
||
|
|
location /.well-known/ {
|
||
|
|
# Used for "acmi-challenge".
|
||
|
|
alias {{ project_dir }}/htdocs/.well-known/;
|
||
|
|
}
|
||
|
|
}
|