YunoHost-Apps/funkwhale_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/funkwhale_ynh.git synced 2024-09-03 18:36:24 +02:00
Code Issues Activity Actions 1

Merge pull request #226 from YunoHost-Apps/fix_nginx

Browse source 
Fix nginx
This commit is contained in:
Thomas 2023-06-03 22:20:00 +02:00 committed by GitHub
commit fe71a2dd50
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 28 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
conf/env.prod
View file

@ -159,7 +159,6 @@ LDAP_ROOT_DN=ou=users,dc=yunohost,dc=org
LDAP_USER_ATTR_MAP=username:uid LDAP_USER_ATTR_MAP=username:uid
FUNKWHALE_FRONTEND_PATH=__INSTALL_DIR__/front/dist FUNKWHALE_FRONTEND_PATH=__INSTALL_DIR__/front/dist
FUNKWHALE_SPA_HTML_ROOT=__INSTALL_DIR__/front/dist/index.html
# Nginx related configuration # Nginx related configuration
NGINX_MAX_BODY_SIZE=100M NGINX_MAX_BODY_SIZE=100M

65
conf/nginx.conf
View file

@ -1,6 +1,6 @@
root __INSTALL_DIR__/front/dist; root __INSTALL_DIR__/front/dist;
location / { location /api/ {
# global proxy conf # global proxy conf
proxy_set_header Host $host; proxy_set_header Host $host;
@ -18,29 +18,21 @@ location / {
# this is needed if you have file import via upload enabled # this is needed if you have file import via upload enabled
client_max_body_size 100M; client_max_body_size 100M;
proxy_pass http://127.0.0.1:__PORT__/; proxy_pass http://127.0.0.1:__PORT__;
} }
location /front/ { location / {
more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";
more_set_headers "Service-Worker-Allowed: /";
more_set_headers "X-Frame-Options: SAMEORIGIN";
alias __INSTALL_DIR__/front/dist/; alias __INSTALL_DIR__/front/dist/;
expires 30d; expires 1d;
more_set_headers "Pragma: public"; try_files $uri $uri/ /index.html;
more_set_headers "Cache-Control: public, must-revalidate, proxy-revalidate";
} }
location /front/embed.html { location /embed.html {
more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:"; add_header Content-Security-Policy "connect-src https: http: 'self'; default-src 'self'; script-src 'self' unpkg.com 'unsafe-inline' 'unsafe-eval'; style-src https: http: 'self' 'unsafe-inline'; img-src https: http: 'self' data:; font-src https: http: 'self' data:; object-src 'none'; media-src https: http: 'self' data:";
more_set_headers "Referrer-Policy: strict-origin-when-cross-origin"; add_header Referrer-Policy "strict-origin-when-cross-origin";
more_set_headers "X-Frame-Options: ALLOW";
alias __INSTALL_DIR__/front/dist/embed.html; alias __INSTALL_DIR__/front/dist/embed.html;
expires 30d; expires 1d;
more_set_headers "Pragma: public";
more_set_headers "Cache-Control: public, must-revalidate, proxy-revalidate";
} }
location /federation/ { location /federation/ {
@ -98,33 +90,32 @@ location /.well-known/ {
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade; proxy_set_header Connection $connection_upgrade;
proxy_pass http://127.0.0.1:__PORT__/.well-known/; proxy_pass http://127.0.0.1:__PORT__;
} }
location /media/__sized__/ { location /media/__sized__/ {
alias __DATA_DIR__/data/media/__sized__/; alias __DATA_DIR__/data/media/__sized__/;
add_header Acces-Control-Allow-Origin '*';
} }
location /media/attachments/ { location /media/attachments/ {
alias __DATA_DIR__/data/media/attachments/; alias __DATA_DIR__/data/media/attachments/;
add_header Access-Control-Allow-Origin '*';
} }
location /_protected/media/ { # This is an internal location that is used to serve
# this is an internal location that is used to serve # media (uploaded) files once correct permission / authentication
# audio files once correct permission / authentication # has been checked on API side.
# has been checked on API side # Comment the "NON-S3" commented lines and uncomment "S3" commented lines
internal; # if you're storing media files in a S3 bucket.
alias __DATA_DIR__/data/media/; #location ~ /_protected/media/(.+) {
} # internal;
# alias ${MEDIA_ROOT}/$1; # NON-S3
# Comment the previous location and uncomment this one if you're storing # # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932.
# media files in a S3 bucket # proxy_set_header Authorization ""; # S3
# location ~ /_protected/media/(.+) { # proxy_pass $1; # S3
# internal; # add_header Access-Control-Allow-Origin '*';
# # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932 #}
# proxy_set_header Authorization "";
# proxy_pass $1;
# }
location /_protected/music/ { location /_protected/music/ {
# this is an internal location that is used to serve # this is an internal location that is used to serve
@ -133,9 +124,9 @@ location /_protected/music/ {
# Set this to the same value as your MUSIC_DIRECTORY_PATH setting # Set this to the same value as your MUSIC_DIRECTORY_PATH setting
internal; internal;
alias __DATA_DIR__/data/music/; alias __DATA_DIR__/data/music/;
add_header Access-Control-Allow-Origin '*';
} }
location /staticfiles/ { location /manifest.json {
# django static files return 302 /api/v1/instance/spa-manifest.json;
alias __DATA_DIR__/data/static/;
} }