144 lines
6.0 KiB
Plaintext
144 lines
6.0 KiB
Plaintext
# Рендерится образом nginx: envsubst подставляет ${PLATFORM_DOMAIN} и т.п.
|
||
# из окружения и кладёт результат в /etc/nginx/conf.d/default.conf (внутри http{}).
|
||
# Переменные вида $host / $http_upgrade — НЕ окруженческие, envsubst их не трогает.
|
||
|
||
large_client_header_buffers 8 128k;
|
||
client_max_body_size 5000M; # крупные загрузки (снимки, облака точек)
|
||
tcp_nopush on;
|
||
|
||
# TLS (самоподписанный сертификат на все домены). Задаём на http-уровне —
|
||
# наследуется всеми server-блоками. Файлы монтируются из ./nginx/certs.
|
||
ssl_certificate /etc/nginx/certs/selfsigned.crt;
|
||
ssl_certificate_key /etc/nginx/certs/selfsigned.key;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_session_cache shared:SSL:10m;
|
||
http2 on;
|
||
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_proxied any;
|
||
gzip_comp_level 6;
|
||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
|
||
|
||
map $http_upgrade $connection_upgrade {
|
||
default upgrade;
|
||
'' close;
|
||
}
|
||
|
||
# upstream backend { server backend:8000; } # TODO: в работе
|
||
# upstream frontend { server frontend:80; } # TODO: в работе
|
||
upstream minio_s3 { server minio:9000; }
|
||
upstream minio_console { server minio:9001; }
|
||
upstream rabbitmq_mgmt { server rabbitmq:15672; }
|
||
|
||
# Общие проксирующие заголовки. ВАЖНО: если в location задан свой proxy_set_header,
|
||
# эти НЕ наследуются — там заголовки продублированы явно.
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
|
||
# ============================ Платформа (основной домен) ====================
|
||
server {
|
||
listen 80 default_server;
|
||
listen 443 ssl default_server;
|
||
server_name ${PLATFORM_DOMAIN};
|
||
|
||
location = /healthz {
|
||
access_log off;
|
||
add_header Content-Type text/plain;
|
||
return 200 "ok\n";
|
||
}
|
||
|
||
# Django backend: REST API + админка (TODO: в работе)
|
||
# location /api/ { proxy_pass http://backend; }
|
||
# location /admin/ { proxy_pass http://backend; }
|
||
|
||
# S3-объекты (media) по относительному пути, с поддержкой Range (TODO: в работе)
|
||
# location /sarex-media-storage/ {
|
||
# proxy_set_header Host $host;
|
||
# proxy_set_header X-Real-IP $remote_addr;
|
||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||
# proxy_http_version 1.1;
|
||
# proxy_set_header Connection "";
|
||
# proxy_set_header Range $http_range;
|
||
# proxy_set_header If-Range $http_if_range;
|
||
# proxy_buffering off;
|
||
# proxy_request_buffering off;
|
||
# proxy_max_temp_file_size 0;
|
||
# proxy_pass http://minio_s3;
|
||
# }
|
||
|
||
# Frontend SPA (host-приложение само отдаёт статику и роутинг) (TODO: в работе)
|
||
# location / {
|
||
# proxy_set_header Host $host;
|
||
# proxy_set_header X-Real-IP $remote_addr;
|
||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||
# proxy_http_version 1.1;
|
||
# proxy_set_header Upgrade $http_upgrade;
|
||
# proxy_set_header Connection $connection_upgrade;
|
||
# proxy_pass http://frontend;
|
||
# }
|
||
}
|
||
|
||
# ======================= Admin: RabbitMQ management UI ======================
|
||
server {
|
||
listen 80;
|
||
listen 443 ssl;
|
||
server_name ${ADMIN_DOMAIN};
|
||
|
||
location / {
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
proxy_pass http://rabbitmq_mgmt;
|
||
}
|
||
}
|
||
|
||
# ============================== MinIO (отдельный домен) =====================
|
||
server {
|
||
listen 80;
|
||
listen 443 ssl;
|
||
server_name ${MINIO_DOMAIN};
|
||
|
||
# Веб-консоль администрирования (порт 9001). Требует у сервиса minio
|
||
# MINIO_BROWSER_REDIRECT_URL = http://<MINIO_DOMAIN>:9080/console
|
||
location = /console { return 301 /console/; } # без слэша → на /console/
|
||
location /console/ {
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection $connection_upgrade;
|
||
proxy_set_header X-NginX-Proxy true;
|
||
chunked_transfer_encoding off;
|
||
proxy_pass http://minio_console;
|
||
}
|
||
|
||
# S3 API (endpoint) на корне — Range/стриминг крупных объектов.
|
||
# Путь не переписываем, иначе ломается подпись SigV4.
|
||
location / {
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Connection "";
|
||
proxy_set_header Range $http_range;
|
||
proxy_set_header If-Range $http_if_range;
|
||
proxy_buffering off;
|
||
proxy_request_buffering off;
|
||
proxy_max_temp_file_size 0;
|
||
proxy_pass http://minio_s3;
|
||
}
|
||
}
|