forked from CGM_Public/pretix_original
602947a3d7
* Include some missing security headers This change adds the following security headers: * X-Content-Type-Options to prevent content type sniffing * Referrer-Policy to prevent leaking referrer information when navigating away from the instance * Migrate from Docker sample to manual configuration Migrate the additional security headers from the Docker configuration sample to the manual configuration guide.
76 lines
1.8 KiB
Nginx Configuration File
76 lines
1.8 KiB
Nginx Configuration File
user www-data www-data;
|
|
worker_processes 1;
|
|
pid /var/run/nginx.pid;
|
|
daemon off;
|
|
|
|
events {
|
|
worker_connections 768;
|
|
}
|
|
|
|
http {
|
|
server_tokens off;
|
|
sendfile on;
|
|
charset utf-8;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
client_max_body_size 100M;
|
|
|
|
log_format private '[$time_local] $host "$request" $status $body_bytes_sent';
|
|
|
|
types_hash_max_size 2048;
|
|
server_names_hash_bucket_size 64;
|
|
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
add_header X-Content-Type-Options nosniff;
|
|
|
|
access_log /var/log/nginx/access.log private;
|
|
error_log /var/log/nginx/error.log;
|
|
add_header Referrer-Policy same-origin
|
|
|
|
gzip on;
|
|
gzip_disable "msie6";
|
|
gzip_types text/plain text/html text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml;
|
|
gzip_vary on;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_buffers 16 8k;
|
|
|
|
include /etc/nginx/conf.d/*.conf;
|
|
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 ipv6only=on default_server;
|
|
server_name _;
|
|
index index.php index.html;
|
|
root /var/www;
|
|
|
|
location /media/ {
|
|
alias /data/media/;
|
|
expires 7d;
|
|
access_log off;
|
|
}
|
|
location ^~ /media/cachedfiles {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
location ^~ /media/invoices {
|
|
deny all;
|
|
return 404;
|
|
}
|
|
location /static/ {
|
|
alias /pretix/src/pretix/static.dist/;
|
|
access_log off;
|
|
expires 365d;
|
|
add_header Cache-Control "public";
|
|
}
|
|
location / {
|
|
proxy_pass http://unix:/tmp/pretix.sock:/;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Host $http_host;
|
|
}
|
|
}
|
|
}
|
|
|
|
|