hom-nginx.conf

events { }

http {

  map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
  }

  # Expires map, static content cache
  map $sent_http_content_type $expires {
      default                    off;
      text/html                  epoch;
      text/css                   max;
      application/javascript     max;
      ~image/                    max;
  }

  # redirect www -> non-www

  server {
    server_name www.hom-minacademy.tk;
    return 301 $scheme://hom-minacademy.tk$request_uri;
  }

  # redirect http -> https

  server {
    listen 80;
    server_name hom-minacademy.tk;
    return 301 https://hom-minacademy.tk$request_uri;
  }

  # dynamic content cache
  # proxy_cache_path /data/nginx/cache levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=24h;

  # read the ssl certificate / key when listening on https

  server {
    listen 443 ssl http2;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy "default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';font-src 'self' fonts.gstatic.com;style-src 'self' fonts.googleapis.com;img-src *;connect-src *;" always;
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    expires $expires;

    server_name hom-minacademy.tk;

    ssl_certificate /etc/letsencrypt/live/hom-minacademy.tk/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/hom-minacademy.tk/privkey.pem;

    access_log /var/log/nginx/data-access.log combined;

    location ~* \.(?:ico|css|js|gif|jpe?g|webp|svg|png)$ {
      root /usr/share/nginx/html;
      include /etc/nginx/mime.types;
      access_log off;
      gzip_static on;
      gzip_comp_level 5;
      add_header Cache-Control "public";
    }

    # serve the static files

    location / {
      root /usr/share/nginx/html;
      include /etc/nginx/mime.types;
      try_files $uri $uri/ /index.html;
    }

    # fetch data from proxied server when /api is called

    location /api {
      proxy_pass http://server:9000;
      # proxy_cache my_cache;
      proxy_set_header X-Real-IP  $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_redirect http://server:9000 $scheme://$http_host/;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
      proxy_read_timeout 20d;
      proxy_buffering off;
    }

  }
}