124 lines
3.4 KiB
Plaintext
124 lines
3.4 KiB
Plaintext
# Redirect all HTTP traffic to HTTPS
|
|
server {
|
|
server_name _;
|
|
|
|
listen {{$AIO_NGINX_PORT_HTTP}} default_server;
|
|
listen [::]:{{$AIO_NGINX_PORT_HTTP}};
|
|
|
|
access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
|
|
error_log {{$AIO_NGINX_LOGS_DIR}}/error.log;
|
|
|
|
# Ideally we want 308 (permanent + keep original method),
|
|
# but it is relatively new and not supported by some clients (e.g. cURL).
|
|
return 307 https://$host:{{$AIO_NGINX_PORT_HTTPS}}$request_uri;
|
|
}
|
|
|
|
# Serve PR-preview requests
|
|
server {
|
|
server_name "~^pr(?<pr>[1-9][0-9]*)-(?<sha>[0-9a-f]{7,40})\.";
|
|
|
|
listen {{$AIO_NGINX_PORT_HTTPS}} ssl http2;
|
|
listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl http2;
|
|
|
|
ssl_certificate {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
|
|
ssl_certificate_key {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
|
|
|
|
root {{$AIO_BUILDS_DIR}}/$pr/$sha;
|
|
disable_symlinks on from=$document_root;
|
|
index index.html;
|
|
|
|
gzip on;
|
|
gzip_comp_level 7;
|
|
gzip_types *;
|
|
|
|
access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
|
|
error_log {{$AIO_NGINX_LOGS_DIR}}/error.log;
|
|
|
|
error_page 404 /404.html;
|
|
location "=/404.html" {
|
|
internal;
|
|
}
|
|
|
|
location "~/[^/]+\.[^/]+$" {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
location / {
|
|
try_files $uri $uri/ /index.html =404;
|
|
}
|
|
}
|
|
|
|
# Handle all other requests
|
|
server {
|
|
server_name _;
|
|
|
|
listen {{$AIO_NGINX_PORT_HTTPS}} ssl http2 default_server;
|
|
listen [::]:{{$AIO_NGINX_PORT_HTTPS}} ssl http2;
|
|
|
|
ssl_certificate {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.crt;
|
|
ssl_certificate_key {{$AIO_LOCALCERTS_DIR}}/{{$AIO_DOMAIN_NAME}}.key;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
|
|
|
|
access_log {{$AIO_NGINX_LOGS_DIR}}/access.log;
|
|
error_log {{$AIO_NGINX_LOGS_DIR}}/error.log;
|
|
|
|
# Health check
|
|
location "~^/health-check/?$" {
|
|
add_header Content-Type text/plain;
|
|
return 200 '';
|
|
}
|
|
|
|
# Check PRs previewability
|
|
location "~^/can-have-public-preview/\d+/?$" {
|
|
if ($request_method != "GET") {
|
|
add_header Allow "GET";
|
|
return 405;
|
|
}
|
|
|
|
proxy_pass_request_headers on;
|
|
proxy_redirect off;
|
|
proxy_method GET;
|
|
proxy_pass http://{{$AIO_PREVIEW_SERVER_HOSTNAME}}:{{$AIO_PREVIEW_SERVER_PORT}}$request_uri;
|
|
|
|
resolver 127.0.0.1;
|
|
}
|
|
|
|
# Notify about CircleCI builds
|
|
location "~^/circle-build/?$" {
|
|
if ($request_method != "POST") {
|
|
add_header Allow "POST";
|
|
return 405;
|
|
}
|
|
|
|
proxy_pass_request_headers on;
|
|
proxy_redirect off;
|
|
proxy_method POST;
|
|
proxy_pass http://{{$AIO_PREVIEW_SERVER_HOSTNAME}}:{{$AIO_PREVIEW_SERVER_PORT}}$request_uri;
|
|
|
|
resolver 127.0.0.1;
|
|
}
|
|
|
|
# Notify about PR changes
|
|
location "~^/pr-updated/?$" {
|
|
if ($request_method != "POST") {
|
|
add_header Allow "POST";
|
|
return 405;
|
|
}
|
|
|
|
proxy_pass_request_headers on;
|
|
proxy_redirect off;
|
|
proxy_method POST;
|
|
proxy_pass http://{{$AIO_PREVIEW_SERVER_HOSTNAME}}:{{$AIO_PREVIEW_SERVER_PORT}}$request_uri;
|
|
|
|
resolver 127.0.0.1;
|
|
}
|
|
|
|
# Everything else
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|