programapi/deploy/nginx.conf.j2 at 6f6798a2e7c44bd8530e5ae53d4e59e2055699bb · EuroPython/programapi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
user nginx;
worker_processes 1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type  application/octet-stream;

    map $remote_addr $remote_addr_anon {
        ~(?P<ip>\d+\.\d+\.\d+)\.    $ip.0;
        ~(?P<ip>[^:]+:[^:]+):       $ip::;
        # IP addresses to not anonymize (such as your server)
        127.0.0.1                   $remote_addr;
        ::1                         $remote_addr;
        #w.x.y.z                     $remote_addr;
        #a:b:c:d::e:f                $remote_addr;
        default                     0.0.0.0;
    }

    log_format anonymized '$remote_addr_anon - $remote_user [$time_local] '
        '"$request" $status $body_bytes_sent '
        '"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  anonymized;

    keepalive_timeout 65;
    sendfile on;


    # To drop all the connections that don't use the valid host name
    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;

        ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem;

        include /etc/letsencrypt/options-ssl-nginx.conf;

        server_name _;

        return 444;
    }

    server {
        listen 80;
        server_name {{ domain_name }} www.{{ domain_name }};

        location /.well-known/acme-challenge/ {
            root /var/www/certbot;
        }

        location / {
            return 301 https://$server_name$request_uri;
        }
    }

    server {
        listen 443 ssl;
        server_name {{ domain_name }} www.{{ domain_name }};

        ssl_certificate /etc/letsencrypt/live/{{ domain_name }}/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/{{ domain_name }}/privkey.pem;

        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        location /2024 {
            alias /usr/share/static/europython-2024;
        }
    }
}