Skip to content
Mathieu Rousseau edited this page May 15, 2018 · 2 revisions

Nginx configuration

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    tcp_nopush     on;

    keepalive_timeout  65;
    
    gzip_comp_level 5;
    gzip on;

    gzip_types application/javascript application/json application/manifest+json image/svg+xml image/x-icon text/css;
	
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-available/*;

    # cache connection credentials  
    # for faster tls handshake 
    ssl_session_cache shared:SSL:5m;
    ssl_session_timeout 1h;
}

auth api

server {
	listen 80;
	listen [::]:80;
	
	server_name auth.streamwave.be;
	
	return 301 https://$server_name$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name auth.streamwave.be;
	
	
        ssl_certificate /etc/letsencrypt/live/auth.streamwave.be/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/auth.streamwave.be/privkey.pem;

        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/letsencrypt/live/auth.streamwave.be/fullchain.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

	location / {
		proxy_pass http://localhost:3000;
		proxy_set_header X-Forwarded-Proto https;
   		proxy_set_header Upgrade $http_upgrade;
   		proxy_set_header Connection 'upgrade';
   		proxy_set_header Host $host;
   		proxy_cache_bypass $http_upgrade;
	} 
}

library api

server {
	listen 80;
	listen [::]:80;
	
	server_name api.streamwave.be;
	
	return 301 https://$server_name$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name api.streamwave.be;
	
	ssl_certificate /etc/letsencrypt/live/api.streamwave.be/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/api.streamwave.be/privkey.pem;

        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/letsencrypt/live/api.streamwave.be/fullchain.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

	location /v1/ {
		rewrite ^/v1(/.*)$ $1 break;
		proxy_pass http://localhost:5000;
		proxy_set_header X-Forwarded-Proto https;
	   	proxy_set_header Upgrade $http_upgrade;	
	        proxy_set_header Connection 'upgrade';
   		proxy_set_header Host $host;
   		proxy_cache_bypass $http_upgrade;
	}
}

streamwave

server {
	listen 80;
	listen [::]:80;
	
	server_name streamwave.be www.streamwave.be;

	return 301 https://www.streamwave.be$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	
	server_name www.streamwave.be;
	
	ssl_certificate /etc/letsencrypt/live/www.streamwave.be/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.streamwave.be/privkey.pem;

        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/letsencrypt/live/www.streamwave.be/fullchain.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
        
	location ~* (sw\.js)$ {
		root /var/www/streamwave/dist;
		add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
		expires off;
		access_log off;
		proxy_no_cache 1;
	}

	location ~* \.(?:css|js|jpg|jpeg|png|svg|json)$ {
		root /var/www/streamwave/dist;
		add_header Cache-Control "public";
		expires 1y;
		access_log off;
	}
	
	location / {
		root /var/www/streamwave/dist;
		try_files $uri /index.html;	
	}
}

cdn

server {
	listen 80;
	listen [::]:80;
	
	server_name cdn.streamwave.be;
	
	return 301 https://$server_name$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	server_name cdn.streamwave.be;
	
	ssl_certificate /etc/letsencrypt/live/cdn.streamwave.be/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/cdn.streamwave.be/privkey.pem;
	
	ssl_stapling on;
	ssl_stapling_verify on;
	ssl_trusted_certificate /etc/letsencrypt/live/cdn.streamwave.be/fullchain.pem;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_prefer_server_ciphers on;
	ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

	location / {
		if ($request_method ~* "(GET)") {
      			add_header "Access-Control-Allow-Origin"  *;
    			add_header "Access-Control-Expose-Headers" "Content-Length";
		}	

   		if ($request_method = OPTIONS ) {
      			add_header "Access-Control-Allow-Origin"  *;
      			add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS, HEAD";
      			add_header "Access-Control-Allow-Headers" "Authorization, Origin, X-Requested-With, Content-Type, Accept, Range";
			add_header "Access-Control-Expose-Headers" "Content-Length, X-From-Cache";
      			return 200;
    		}
		expires 3600;
		root /var/www/assets/CDN;
	}
}

staging server

Pull-requests are validated against Lighthouse using Lighthouse-CI and Travis. In order to do that I have to upload my PR on a staging server.

server {
	listen 80;
	listen [::]:80;
	
	server_name streamwave.be www.streamwave.be;

	return 301 https://staging.streamwave.be$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	
	server_name staging.streamwave.be;
	
	ssl_certificate /etc/letsencrypt/live/staging.streamwave.be/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/staging.streamwave.be/privkey.pem;

        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/letsencrypt/live/staging.streamwave.be/fullchain.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
        
	location ~* (sw\.js)$ {
		root /var/www/staging/streamwave/dist;
		add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
		expires off;
		access_log off;
		proxy_no_cache 1;
	}
	
	location ~* \.(?:css|js|jpg|jpeg|png|svg|json)$ {
		root /var/www/staging/streamwave/dist;
		add_header Cache-Control "public";
		expires 1y;
		access_log off;
	}
	
	location / {
		root /var/www/staging/streamwave/dist;
		try_files $uri /index.html;	
	}
}

Clone this wiki locally