stackhead/ansible/templates/nginx.conf.j2 at 3a7da5a3afc1c04471a84491237ea72ca4dcf6d1 · getstackhead/stackhead · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
{# This templates sets includes and maps from vendor/server-configs-nginx/nginx.conf #}
{# This is the same as roles/geerlingguy.nginx/templates/nginx.conf.j2 but extending that did not work #}
{# the only change is that block http_begin is provided #}

user  {{ nginx_user }};

error_log  {{ nginx_error_log }};
pid        {{ nginx_pidfile }};

{% block worker %}
worker_processes  {{ nginx_worker_processes }};
{% endblock %}

{% if nginx_extra_conf_options %}
{{ nginx_extra_conf_options }}
{% endif %}

{% block events %}
events {
    worker_connections  {{ nginx_worker_connections }};
    multi_accept {{ nginx_multi_accept }};
}
{% endblock %}

http {
{% block http_begin %}
  # Enable gzip compression.
  include /etc/nginx/h5bp/web_performance/compression.conf;

  # Specify file cache expiration.
  include /etc/nginx/h5bp/web_performance/cache_expiration.conf;

  # Add X-XSS-Protection for HTML documents.
  # /etc/nginx/h5bp/security/x-xss-protection.conf
  map $sent_http_content_type $x_xss_protection {
    #           (1)    (2)
    ~*text/html "1; mode=block";
  }

  # Add X-Frame-Options for HTML documents.
  # /etc/nginx/h5bp/security/x-frame-options.conf
  map $sent_http_content_type $x_frame_options {
    ~*text/html DENY;
  }

  # Add Content-Security-Policy for HTML documents.
  # /etc/nginx/h5bp/security/content-security-policy.conf
  map $sent_http_content_type $content_security_policy {
    ~*text/html "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests";
  }

  # Add Referrer-Policy for HTML documents.
  # /etc/nginx/h5bp/security/referrer-policy.conf.conf
  map $sent_http_content_type $referrer_policy {
    ~*text/html "strict-origin-when-cross-origin";
  }

  # Add X-UA-Compatible for HTML documents.
  # /etc/nginx/h5bp/internet_explorer/x-ua-compatible.conf
  map $sent_http_content_type $x_ua_compatible {
    ~*text/html "IE=edge";
  }

  # Add Access-Control-Allow-Origin.
  # /etc/nginx/h5bp/cross-origin/requests.conf
  map $sent_http_content_type $cors {
    # Images
    ~*image/ "*";

    # Web fonts
    ~*font/                         "*";
    ~*application/vnd.ms-fontobject "*";
    ~*application/x-font-ttf        "*";
    ~*application/font-woff         "*";
    ~*application/x-font-woff       "*";
    ~*application/font-woff2        "*";
  }
{% endblock %}

{% block http_basic %}
    include       {{ nginx_mime_file_path }};
    default_type  application/octet-stream;

    server_names_hash_bucket_size {{ nginx_server_names_hash_bucket_size }};

    client_max_body_size {{ nginx_client_max_body_size }};

    log_format  main  {{ nginx_log_format|indent(23) }};

    access_log  {{ nginx_access_log }};

    sendfile        {{ nginx_sendfile }};
    tcp_nopush      {{ nginx_tcp_nopush }};
    tcp_nodelay     {{ nginx_tcp_nodelay }};

    keepalive_timeout  {{ nginx_keepalive_timeout }};
    keepalive_requests {{ nginx_keepalive_requests }};

    server_tokens {{ nginx_server_tokens }};
{% if nginx_proxy_cache_path %}
    proxy_cache_path {{ nginx_proxy_cache_path }};
{% endif %}
{% endblock %}

{% block http_gzip %}
    # gzip on;
{% endblock %}

{% if nginx_extra_http_options %}
    {{ nginx_extra_http_options|indent(4, False) }}
{% endif %}

{% block http_upstream %}
{% for upstream in nginx_upstreams %}
    upstream {{ upstream.name }} {
{% if upstream.strategy is defined %}
        {{ upstream.strategy }};
{% endif %}
{% for server in upstream.servers %}
        server {{ server }};
{% endfor %}
{% if upstream.keepalive is defined %}
        keepalive {{ upstream.keepalive }};
{% endif %}
    }
{% endfor %}
{% endblock %}

{% block http_includes %}
    include {{ nginx_conf_path }}/*.conf;
{% if nginx_conf_path != nginx_vhost_path %}
    include {{ nginx_vhost_path }}/*;
{% endif %}
{% endblock %}

    {% block http_end %}{% endblock %}
}