-
-
Notifications
You must be signed in to change notification settings - Fork 942
Expand file tree
/
Copy pathnginx.conf
More file actions
143 lines (126 loc) · 4.41 KB
/
nginx.conf
File metadata and controls
143 lines (126 loc) · 4.41 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types; # Required for SVG mime type
default_type application/octet-stream; # Required for SVG mime type
client_max_body_size 100M;
server {
listen 80;
server_name localhost;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1; # Required for WebSocket
proxy_set_header Upgrade $http_upgrade; # WebSocket header
proxy_set_header Connection "upgrade"; # WebSocket header
# Preserve browser host:port (e.g. localhost:5000). $host strips the port
# and breaks Next.js redirects / absolute URLs.
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_read_timeout 30m;
proxy_connect_timeout 30m;
}
location /api/v1/ {
proxy_pass http://localhost:8000;
proxy_read_timeout 30m;
proxy_connect_timeout 30m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# MCP
location /mcp/ {
proxy_pass http://localhost:8001/mcp/;
proxy_read_timeout 30m;
proxy_connect_timeout 30m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /mcp {
proxy_pass http://localhost:8001/mcp;
proxy_read_timeout 30m;
proxy_connect_timeout 30m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /docs {
proxy_pass http://localhost:8000/docs;
proxy_read_timeout 30m;
proxy_connect_timeout 30m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /openapi.json {
proxy_pass http://localhost:8000/openapi.json;
proxy_read_timeout 30m;
proxy_connect_timeout 30m;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Internal auth subrequest used to gate /app_data/* static access behind the
# FastAPI session cookie. Nginx serves these files directly via `alias` for
# performance, so auth_request is what keeps them from being public.
location = /_auth_check {
internal;
proxy_pass http://localhost:8000/api/v1/auth/verify;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-URI $request_uri;
proxy_set_header Host $host;
proxy_set_header Cookie $http_cookie;
}
# Bundled UI static assets (logos, fonts packaged with the app) are safe to
# serve unauthenticated; they contain no user data.
location /static {
alias /app/servers/fastapi/static/;
expires 1y;
add_header Cache-Control "public, immutable";
}
location /app_data/images/ {
auth_request /_auth_check;
alias /app_data/images/;
expires 1y;
add_header Cache-Control "private, max-age=31536000";
}
location /app_data/exports/ {
auth_request /_auth_check;
alias /app_data/exports/;
expires 1y;
add_header Cache-Control "private, max-age=31536000";
}
location /app_data/uploads/ {
auth_request /_auth_check;
alias /app_data/uploads/;
expires 1y;
add_header Cache-Control "private, max-age=31536000";
}
location /app_data/fonts/ {
auth_request /_auth_check;
alias /app_data/fonts/;
expires 1y;
add_header Cache-Control "private, max-age=31536000";
}
location /app_data/pptx-to-html/ {
auth_request /_auth_check;
alias /app_data/pptx-to-html/;
expires 1y;
add_header Cache-Control "private, max-age=31536000";
}
}
}