You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
36 lines
1.6 KiB
Plaintext
36 lines
1.6 KiB
Plaintext
# SiMS HQ console — host nginx vhost. Same name as its home in nginx
|
|
# (/etc/nginx/conf.d/sims.hq.conf), so it's one name end to end. Install as:
|
|
# sudo cp deploy/sims.hq.conf /etc/nginx/conf.d/sims.hq.conf
|
|
# sudo nginx -t && sudo systemctl reload nginx
|
|
# Reuses the *.simssoftware.in wildcard cert; proxies to the HQ container on 127.0.0.1:5182.
|
|
# The public /share/:token links go through here too (token-guarded, rate-limited, revocable).
|
|
server {
|
|
listen 80;
|
|
server_name hq.simssoftware.in;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
server {
|
|
listen 443 ssl;
|
|
server_name hq.simssoftware.in;
|
|
|
|
ssl_certificate /etc/ssl/sims/sims.crt;
|
|
ssl_certificate_key /etc/ssl/sims/sims.key;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
# APEX CSV import + PDF uploads exceed nginx's 1 MB default, which would 413.
|
|
client_max_body_size 1000M;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:5182;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
# REPLACE, do not append (D24 red-team). With the app's `trust proxy 1`, Express
|
|
# reads the last X-Forwarded-For hop as the client IP. $proxy_add_x_forwarded_for
|
|
# would append to a CLIENT-SUPPLIED header, letting a caller inject a fake IP and
|
|
# bypass the per-IP login/reveal rate limiters. $remote_addr is the real socket
|
|
# peer and cannot be forged, so the app always keys limits on the true client.
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|