pleroma/otp/templates/pleroma.cloudflare.index.nginx.conf.j2
changeset 103 78a072bbf3c1
parent 102 5afa8c28e689
child 123 e8d0308b94b2
equal deleted inserted replaced
102:5afa8c28e689 103:78a072bbf3c1
       
     1 # default nginx site config for Pleroma
       
     2 #
       
     3 # Simple installation instructions:
       
     4 # 1. Install your TLS certificate, possibly using Let's Encrypt.
       
     5 # 2. Replace 'example.tld' with your instance's domain wherever it appears.
       
     6 # 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it
       
     7 #    in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx.
       
     8 
       
     9 proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g
       
    10                  inactive=720m use_temp_path=off;
       
    11 
       
    12 server {
       
    13     listen 80;
       
    14     server_name {{nginx_server_name}};
       
    15     return 301 https://$host$request_uri;
       
    16 }
       
    17 
       
    18 # Enable SSL session caching for improved performance
       
    19 ssl_session_cache shared:ssl_session_cache:10m;
       
    20 
       
    21 server {
       
    22     listen 443 ssl http2;
       
    23     server_name {{nginx_server_name}};
       
    24 
       
    25     ssl_certificate {{nginx_ssl_cert}};
       
    26     ssl_certificate_key {{nginx_ssl_privkey}};
       
    27     ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
       
    28 
       
    29     add_header Strict-Transport-Security "max-age=31536000" always;
       
    30 
       
    31     gzip_vary on;
       
    32     gzip_proxied any;
       
    33     gzip_comp_level 6;
       
    34     gzip_buffers 16 8k;
       
    35     gzip_http_version 1.1;
       
    36     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml;
       
    37 
       
    38     # the nginx default is 1m, not enough for large media uploads
       
    39     client_max_body_size 16m;
       
    40 
       
    41     location = / {
       
    42         return 301 http://www.$host$request_uri;
       
    43     }
       
    44 
       
    45     location / {
       
    46         try_files $uri @pleroma;
       
    47     }
       
    48 
       
    49     location @pleroma {
       
    50         add_header X-XSS-Protection "1; mode=block";
       
    51         add_header X-Permitted-Cross-Domain-Policies none;
       
    52         add_header X-Frame-Options DENY;
       
    53         add_header X-Content-Type-Options nosniff;
       
    54         add_header Referrer-Policy same-origin;
       
    55         add_header X-Download-Options noopen;
       
    56 
       
    57         add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
       
    58 
       
    59         proxy_http_version 1.1;
       
    60         proxy_set_header Upgrade $http_upgrade;
       
    61         proxy_set_header Connection "upgrade";
       
    62         proxy_set_header Host $http_host;
       
    63 
       
    64         proxy_pass {{pleroma_proxy_pass}};
       
    65 
       
    66         client_max_body_size 16m;
       
    67     }
       
    68 
       
    69     location /proxy {
       
    70         proxy_cache {{pleroma_instance}}-pleroma_media_cache;
       
    71         proxy_cache_lock on;
       
    72         proxy_ignore_client_abort on;
       
    73         proxy_pass {{pleroma_proxy_pass}};
       
    74     }
       
    75 }