forked from trent_larson/crowd-funder-for-time-pwa
4306df020f
- Fix .dockerignore to allow dist directory for Docker builds - Add uint8arrays dependency for crypto operations - Configure Vite for proper SQL worker bundling with absurd-sql - Update Dockerfile with build context documentation - Fix Nginx configuration for non-root user permissions - Remove conflicting backend proxy configuration - Add SQL worker polyfills to vite.config.common.mts Resolves Docker build failures and ensures proper SQL database functionality in containerized environment.
76 lines
2.4 KiB
Nginx Configuration File
76 lines
2.4 KiB
Nginx Configuration File
# TimeSafari Nginx Configuration
|
|
# Author: Matthew Raymer
|
|
# Description: Main nginx configuration for TimeSafari web application
|
|
#
|
|
# Features:
|
|
# - Security headers for web application
|
|
# - Gzip compression for better performance
|
|
# - Proper handling of Vue.js SPA routing
|
|
# - Static file caching optimization
|
|
# - Security hardening
|
|
|
|
# user nginx; # Commented out - nginx runs as non-root user in container
|
|
worker_processes auto;
|
|
error_log /var/log/nginx/error.log warn;
|
|
pid /tmp/nginx.pid; # Use /tmp for PID file to avoid permission issues
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
use epoll;
|
|
multi_accept on;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
|
|
# Logging format
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
access_log /var/log/nginx/access.log main;
|
|
|
|
# Performance optimizations
|
|
sendfile on;
|
|
tcp_nopush on;
|
|
tcp_nodelay on;
|
|
keepalive_timeout 65;
|
|
types_hash_max_size 2048;
|
|
client_max_body_size 16M;
|
|
|
|
# Gzip compression
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_proxied any;
|
|
gzip_comp_level 6;
|
|
gzip_types
|
|
text/plain
|
|
text/css
|
|
text/xml
|
|
text/javascript
|
|
application/json
|
|
application/javascript
|
|
application/xml+rss
|
|
application/atom+xml
|
|
image/svg+xml;
|
|
|
|
# Security headers
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self';" always;
|
|
|
|
# SharedArrayBuffer support headers for absurd-sql
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
add_header Cross-Origin-Embedder-Policy "require-corp" always;
|
|
|
|
# Rate limiting
|
|
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
|
|
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
|
|
|
|
# Include server configurations
|
|
include /etc/nginx/conf.d/*.conf;
|
|
} |