repo inicializado

nginx/default.conf

@@ -0,0 +1,209 @@
+server_names_hash_bucket_size 64;
+proxy_headers_hash_bucket_size 512;
+server_names_hash_max_size 512;
+large_client_header_buffers 8 64k;
+proxy_read_timeout 3600;
+proxy_connect_timeout 3600;
+
+
+# include configs for spamers, bad bots to reject
+include /customization/blacklist.conf;
+
+
+# Rate limit configurations
+limit_req_zone $binary_remote_addr zone=all:10m rate=20r/s;
+
+map $http_user_agent $limit_bots {
+    default '';
+    ~*(google|bing|yandex|msnbot|baidu|crawler|robot) $binary_remote_addr;
+}
+limit_req_zone $limit_bots zone=bots:10m rate=2r/m;
+
+# Connect to the Arches Django app running with
+# Gunicorn. Note, you need to match more than the port
+# number, you need match the Docker container NAME where
+# we've launched the Arches Djagno app.
+upstream django {
+  server arches:8000;
+}
+
+upstream mapas {
+  server pg_tilesrv:7800;
+}
+
+server {
+    listen 80;
+    charset utf-8;
+    server_name ${DEPLOY_HOST} www.${DEPLOY_HOST};
+
+    location ^~ /.well-known/acme-challenge/ {
+        default_type "text/plain";
+        autoindex on;
+        allow all;
+        root /var/www/certbot/$host;
+    }
+
+    access_log /logs/nginx/access.log;
+    error_log /logs/nginx/error.log;
+
+    proxy_read_timeout 3600;
+
+    proxy_set_header  X-Forwarded-Protocol  $scheme;
+    gzip on;
+    gzip_disable "msie6";
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/ld+json
+application/geo+json text/xml application/xml application/xml+rss
+text/javascript application/javascript text/html;
+
+    # block the evil spammers and bad bots
+    if ($bad_bot) {
+        return 444;
+    }
+    if ($bad_referer_block) {
+        return 444;
+    }
+    if ($bad_urls1) {
+        return 403;
+    }
+    if ($bad_urls2) {
+        return 403;
+    }
+    if ($bad_urls3) {
+        return 403;
+    }
+    if ($bad_urls4) {
+        return 403;
+    }
+    if ($bad_urls5) {
+        return 403;
+    }
+    if ($bad_urls6) {
+        return 403;
+    }
+
+    location /.nginx {
+        alias /var/www/html/${DEPLOY_HOST};
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+
+}
+
+
+server {
+    listen       443 ssl;
+
+    server_name ${DEPLOY_HOST} www.${DEPLOY_HOST};
+    access_log /logs/nginx/ssl_access.log;
+    error_log /logs/nginx/ssl_error.log;
+
+    proxy_set_header  X-Forwarded-Protocol  $scheme;
+    proxy_read_timeout 3600;
+
+    ssl_certificate /etc/symb_link_ssl/fullchain.pem;
+    ssl_certificate_key /etc/symb_link_ssl/privkey.pem;
+
+    include /etc/nginx/options-ssl-nginx.conf;
+
+    ssl_dhparam /etc/nginx/sites/ssl/ssl-dhparams.pem;
+
+    include /etc/nginx/hsts.conf;
+
+    # Allows upload of up to a 100MB file
+    client_max_body_size 100M;
+
+    gzip on;
+    gzip_disable "msie6";
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_buffers 16 8k;
+    gzip_http_version 1.1;
+    gzip_types text/plain text/css application/json application/ld+json
+application/geo+json text/xml application/xml application/xml+rss
+text/javascript application/javascript text/html;
+
+    # block the evil spammers and bad bots
+    if ($bad_bot) {
+        return 444;
+    }
+    if ($bad_referer_block) {
+        return 444;
+    }
+    if ($bad_urls1) {
+        return 403;
+    }
+    if ($bad_urls2) {
+        return 403;
+    }
+    if ($bad_urls3) {
+        return 403;
+    }
+    if ($bad_urls4) {
+        return 403;
+    }
+    if ($bad_urls5) {
+        return 403;
+    }
+    if ($bad_urls6) {
+        return 403;
+    }
+
+    location /pgtileserv/ {
+        proxy_pass http://mapas/;
+        proxy_set_header Host            $host;
+        proxy_set_header X-Forwarded-For $remote_addr;
+    }
+
+    location /.nginx {
+        autoindex on;
+        alias /var/www/html/${DEPLOY_HOST};
+    }
+
+    location ^~ /.well-known/acme-challenge/ {
+        default_type "text/plain";
+        autoindex on;
+        allow all;
+        root /var/www/certbot/$host;
+    }
+
+    # See the nginx docker-compose.yml where we
+    # provide this volume mapping to "static"
+    location  /static/ {
+        # Note: No rate limit
+        autoindex on;
+        allow all;
+        alias  /static_root/;
+        include  /etc/nginx/mime.types;
+    }
+
+    location / {
+        # rate limit
+        limit_req zone=all burst=30;
+        limit_req zone=bots burst=10;
+        try_files $uri @proxy_to_django;
+    }
+
+    location @proxy_to_django {
+        proxy_pass http://django;
+
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+
+        proxy_redirect off;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Host $server_name;
+
+    }
+
+}