diff --git a/infrastructure/nginx/nginx.conf b/infrastructure/nginx/nginx.conf index afa01c9..0286b05 100644 --- a/infrastructure/nginx/nginx.conf +++ b/infrastructure/nginx/nginx.conf @@ -5,48 +5,65 @@ error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; events { - worker_connections 1024; + worker_connections 4096; } http { include /etc/nginx/mime.types; default_type application/octet-stream; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; + ssl_session_cache shared:SSL:50m; + ssl_session_timeout 1d; + ssl_session_tickets off; ssl_protocols TLSv1.2 TLSv1.3; - ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256; + ssl_ecdh_curve X25519:secp521r1:secp384r1; ssl_prefer_server_ciphers on; - ssl_ecdh_curve secp384r1; ssl_stapling on; ssl_stapling_verify on; - resolver 1.1.1.1 1.0.0.1 valid=300s; + resolver 1.1.1.1 1.0.0.1 8.8.8.8 valid=300s; + resolver_timeout 5s; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-XSS-Protection "1; mode=block" always; + add_header X-XSS-Protection "0"; add_header Referrer-Policy "strict-origin-when-cross-origin" always; - add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; form-action 'self'; object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline';" always; + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; + add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; img-src 'self' data: https:; style-src 'self' 'unsafe-inline' https:; font-src 'self' https:; frame-ancestors 'none'; form-action 'self'; object-src 'none'; base-uri 'self';" always; sendfile on; tcp_nopush on; tcp_nodelay on; - keepalive_timeout 65; - client_body_timeout 12; - client_header_timeout 12; + keepalive_timeout 75; + client_body_timeout 15; + client_header_timeout 15; reset_timedout_connection on; - send_timeout 10; + send_timeout 15; - client_body_buffer_size 16K; - client_header_buffer_size 1K; - client_max_body_size 8M; - large_client_header_buffers 4 8K; + client_body_buffer_size 128k; + client_header_buffer_size 4k; + client_max_body_size 100M; + large_client_header_buffers 4 16k; gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; - gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss; + gzip_min_length 1024; + gzip_types + text/plain + text/css + text/xml + text/javascript + application/json + application/javascript + application/x-javascript + application/xml + application/xml+rss + font/woff + font/woff2 + image/svg+xml; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' @@ -58,36 +75,33 @@ http { server { listen 80 default_server; + listen [::]:80 default_server; server_name _; return 301 https://$host$request_uri; } server { listen 443 ssl http2 default_server; - server_name _; - ssl_certificate /etc/nginx/certs/fullchain.pem; - ssl_certificate_key /etc/nginx/certs/privkey.pem; - return 204; - } - - server { - listen 443 ssl http2; - server_name _; + listen [::]:443 ssl http2 default_server; + server_name prod-team-15-2pc0i3lc.final.prodcontest.ru; ssl_certificate /etc/nginx/certs/fullchain.pem; ssl_certificate_key /etc/nginx/certs/privkey.pem; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + location / { proxy_pass http://frontend:80; - - add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; - add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"; - + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; + proxy_cache_bypass $http_upgrade; proxy_hide_header X-Powered-By; proxy_connect_timeout 75s; @@ -97,34 +111,35 @@ http { location /api { proxy_pass http://backend:8080; - + proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; - add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; - add_header Access-Control-Allow-Origin "$http_origin" always; - add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always; - add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; - add_header Access-Control-Expose-Headers "Content-Length,Content-Range" always; - - proxy_connect_timeout 75s; - proxy_send_timeout 600s; - proxy_read_timeout 600s; - - proxy_buffering off; - proxy_request_buffering off; - if ($request_method = 'OPTIONS') { add_header 'Access-Control-Allow-Origin' "$http_origin"; add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS'; - add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization'; + add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With'; add_header 'Access-Control-Max-Age' 1728000; - add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Type' 'text/plain; charset=UTF-8'; add_header 'Content-Length' 0; return 204; } + + add_header 'Access-Control-Allow-Origin' "$http_origin" always; + add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always; + add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Requested-With' always; + add_header 'Access-Control-Allow-Credentials' 'true' always; + + proxy_buffering off; + proxy_request_buffering off; + client_max_body_size 100M; + } + + error_page 404 = @notfound; + location @notfound { + return 444; } } }