mirror of
https://github.com/YunoHost-Apps/funkwhale_ynh.git
synced 2024-09-03 18:36:24 +02:00
137 lines
4.3 KiB
Nginx Configuration File
137 lines
4.3 KiB
Nginx Configuration File
root __FINALPATH__/front/dist;
|
|
|
|
location / {
|
|
|
|
# global proxy conf
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_redirect off;
|
|
|
|
# websocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
# this is needed if you have file import via upload enabled
|
|
client_max_body_size 100M;
|
|
proxy_pass http://127.0.0.1:__PORT__/;
|
|
}
|
|
|
|
location /front/ {
|
|
more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
|
|
more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";
|
|
more_set_headers "Service-Worker-Allowed: /";
|
|
more_set_headers "X-Frame-Options: SAMEORIGIN";
|
|
alias __FINALPATH__/front/dist/;
|
|
expires 30d;
|
|
more_set_headers "Pragma: public";
|
|
more_set_headers "Cache-Control: public, must-revalidate, proxy-revalidate";
|
|
}
|
|
|
|
location /front/embed.html {
|
|
more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
|
|
more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";
|
|
|
|
more_set_headers "X-Frame-Options: ALLOW";
|
|
alias __FINALPATH__/front/dist/embed.html;
|
|
expires 30d;
|
|
more_set_headers "Pragma: public";
|
|
more_set_headers "Cache-Control: public, must-revalidate, proxy-revalidate";
|
|
}
|
|
|
|
location /federation/ {
|
|
|
|
# global proxy conf
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_redirect off;
|
|
|
|
# websocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_pass http://127.0.0.1:__PORT__/federation/;
|
|
}
|
|
|
|
# You can comment this if you do not plan to use the Subsonic API
|
|
location /rest/ {
|
|
|
|
# global proxy conf
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_redirect off;
|
|
|
|
# websocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_pass http://127.0.0.1:__PORT__/api/subsonic/rest/;
|
|
}
|
|
|
|
location /.well-known/ {
|
|
|
|
# global proxy conf
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host:$server_port;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
proxy_redirect off;
|
|
|
|
# websocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_pass http://127.0.0.1:__PORT__/.well-known/;
|
|
}
|
|
|
|
location /media/ {
|
|
alias __DATADIR__/media/;
|
|
}
|
|
|
|
location /_protected/media/ {
|
|
# this is an internal location that is used to serve
|
|
# audio files once correct permission / authentication
|
|
# has been checked on API side
|
|
internal;
|
|
alias __DATADIR__/media/;
|
|
}
|
|
|
|
# Comment the previous location and uncomment this one if you're storing
|
|
# media files in a S3 bucket
|
|
# location ~ /_protected/media/(.+) {
|
|
# internal;
|
|
# # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932
|
|
# proxy_set_header Authorization "";
|
|
# proxy_pass $1;
|
|
# }
|
|
|
|
location /_protected/music/ {
|
|
# this is an internal location that is used to serve
|
|
# audio files once correct permission / authentication
|
|
# has been checked on API side
|
|
# Set this to the same value as your MUSIC_DIRECTORY_PATH setting
|
|
internal;
|
|
alias __DATADIR__/music/;
|
|
}
|
|
|
|
location /staticfiles/ {
|
|
# django static files
|
|
alias __DATADIR__/static/;
|
|
}
|