Skip to content

Commit 5fd831e

Browse files
deep-divdeep-div
committed
cc
1 parent 739bc17 commit 5fd831e

1 file changed

Lines changed: 94 additions & 93 deletions

File tree

‎nginx/config/prod.conf‎

Lines changed: 94 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -1,110 +1,111 @@
1-
https {
2-
log_format custom '$remote_addr - $server_addr [$time_local] '
3-
'"$request" $status $body_bytes_sent '
4-
'"$http_referer" "$http_user_agent"';
5-
access_log /var/log/nginx/access.log custom;
6-
# ===============================
7-
# DEFAULT DENY HTTP & HTTPS
8-
# ===============================
9-
server {
10-
listen 80 default_server;
11-
server_name _;
12-
return 444;
13-
}
14-
server {
15-
listen 443 ssl default_server;
16-
server_name _;
17-
ssl_reject_handshake on;
18-
}
19-
# ===============================
20-
# HTTP → HTTPS
21-
# ===============================
22-
server {
23-
listen 80;
24-
server_name coldemailgenrator.online www.coldemailgenrator.online;
25-
return 301 https://$host$request_uri;
26-
}
27-
# ===============================
28-
# PUBLIC ACCESS (FRONTEND)
29-
# ===============================
1+
# ===============================
2+
# LOGGING
3+
# ===============================
4+
log_format custom '$remote_addr - $server_addr [$time_local] '
5+
'"$request" $status $body_bytes_sent '
6+
'"$http_referer" "$http_user_agent"';
7+
access_log /var/log/nginx/access.log custom;
8+
# ===============================
9+
# DEFAULT DENY HTTP & HTTPS
10+
# ===============================
11+
server {
12+
listen 80 default_server;
13+
server_name _;
14+
return 444;
15+
}
16+
server {
17+
listen 443 ssl default_server;
18+
server_name _;
19+
ssl_reject_handshake on;
20+
}
21+
# ===============================
22+
# HTTP → HTTPS
23+
# ===============================
24+
server {
25+
listen 80;
26+
server_name coldemailgenrator.online www.coldemailgenrator.online;
27+
return 301 https://$host$request_uri;
28+
}
29+
# ===============================
30+
# PUBLIC ACCESS (FRONTEND)
31+
# ===============================
3032

31-
upstream frontend_upstream {
32-
server frontend:8501; # service name + internal port
33-
}
34-
server {
35-
listen 443 ssl http2;
36-
server_name coldemailgenrator.online www.coldemailgenrator.online;
33+
upstream frontend_upstream {
34+
server frontend:8501; # service name + internal port
35+
}
36+
server {
37+
listen 443 ssl http2;
38+
server_name coldemailgenrator.online www.coldemailgenrator.online;
3739

38-
ssl_certificate /etc/letsencrypt/live/coldemailgenrator.online/fullchain.pem;
39-
ssl_certificate_key /etc/letsencrypt/live/coldemailgenrator.online/privkey.pem;
40+
ssl_certificate /etc/letsencrypt/live/coldemailgenrator.online/fullchain.pem;
41+
ssl_certificate_key /etc/letsencrypt/live/coldemailgenrator.online/privkey.pem;
4042

41-
ssl_protocols TLSv1.2 TLSv1.3;
42-
ssl_ciphers HIGH:!aNULL:!MD5;
43-
44-
# ===============================
45-
# SECURITY HEADERS
46-
# ===============================
47-
add_header X-Frame-Options "DENY" always;
48-
add_header X-Content-Type-Options "nosniff" always;
49-
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
50-
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
51-
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
43+
ssl_protocols TLSv1.2 TLSv1.3;
44+
ssl_ciphers HIGH:!aNULL:!MD5;
45+
46+
# ===============================
47+
# SECURITY HEADERS
48+
# ===============================
49+
add_header X-Frame-Options "DENY" always;
50+
add_header X-Content-Type-Options "nosniff" always;
51+
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
52+
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
53+
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
5254

53-
location / {
54-
proxy_pass http://frontend_upstream;
55+
location / {
56+
proxy_pass http://frontend_upstream;
5557

56-
proxy_set_header Host $host;
57-
proxy_set_header X-Real-IP $remote_addr;
58-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
59-
proxy_set_header X-Forwarded-Proto $scheme;
58+
proxy_set_header Host $host;
59+
proxy_set_header X-Real-IP $remote_addr;
60+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
61+
proxy_set_header X-Forwarded-Proto $scheme;
6062

61-
proxy_http_version 1.1;
62-
proxy_set_header Upgrade $http_upgrade;
63-
proxy_set_header Connection "upgrade";
63+
proxy_http_version 1.1;
64+
proxy_set_header Upgrade $http_upgrade;
65+
proxy_set_header Connection "upgrade";
6466

65-
proxy_buffering off;
66-
}
67+
proxy_buffering off;
6768
}
69+
}
6870

69-
# ===============================
70-
# HTTP → HTTPS (MONITORING)
71-
# ===============================
72-
server {
73-
listen 80;
74-
server_name monitoring.coldemailgenrator.online;
75-
return 301 https://$host$request_uri;
76-
}
77-
# ===============================
78-
# PRIVATE VPN MONITORING (IP ONLY)
79-
# ===============================
71+
# ===============================
72+
# HTTP → HTTPS (MONITORING)
73+
# ===============================
74+
server {
75+
listen 80;
76+
server_name monitoring.coldemailgenrator.online;
77+
return 301 https://$host$request_uri;
78+
}
79+
# ===============================
80+
# PRIVATE VPN MONITORING (IP ONLY)
81+
# ===============================
8082

81-
server {
82-
listen 443 ssl http2;
83-
server_name monitoring.coldemailgenrator.online;
83+
server {
84+
listen 443 ssl http2;
85+
server_name monitoring.coldemailgenrator.online;
8486

85-
ssl_certificate /etc/letsencrypt/live/coldemailgenrator.online/fullchain.pem;
86-
ssl_certificate_key /etc/letsencrypt/live/coldemailgenrator.online/privkey.pem;
87+
ssl_certificate /etc/letsencrypt/live/coldemailgenrator.online/fullchain.pem;
88+
ssl_certificate_key /etc/letsencrypt/live/coldemailgenrator.online/privkey.pem;
8789

88-
# VPN ONLY
89-
allow 172.16.100.0/27;
90-
allow 172.17.0.0/16; # Docker bridge subnet
91-
deny all;
90+
# VPN ONLY
91+
allow 172.16.100.0/27;
92+
allow 172.17.0.0/16; # Docker bridge subnet
93+
deny all;
9294

93-
location /monitoring/prometheus/ {
94-
proxy_pass http://prometheus:9090;
95-
proxy_set_header Host $host;
96-
proxy_set_header X-Forwarded-Proto https;
97-
proxy_set_header X-Forwarded-Prefix /monitoring/prometheus;
98-
proxy_redirect off;
99-
}
95+
location /monitoring/prometheus/ {
96+
proxy_pass http://prometheus:9090;
97+
proxy_set_header Host $host;
98+
proxy_set_header X-Forwarded-Proto https;
99+
proxy_set_header X-Forwarded-Prefix /monitoring/prometheus;
100+
proxy_redirect off;
101+
}
100102

101-
location /monitoring/grafana/ {
102-
proxy_pass http://grafana:3000;
103-
proxy_set_header Host $host;
104-
proxy_set_header X-Forwarded-Proto https;
105-
proxy_set_header X-Forwarded-Prefix /monitoring/grafana;
106-
proxy_redirect off;
107-
}
103+
location /monitoring/grafana/ {
104+
proxy_pass http://grafana:3000;
105+
proxy_set_header Host $host;
106+
proxy_set_header X-Forwarded-Proto https;
107+
proxy_set_header X-Forwarded-Prefix /monitoring/grafana;
108+
proxy_redirect off;
108109
}
109110
}
110111

0 commit comments

Comments
 (0)