nginx.prod.conf

worker_processes 4;

events {worker_connections 1024;}


http {
  proxy_cache_path /data/cache/docs levels=1:2 keys_zone=visa_docs_cache:10m max_size=10g inactive=60m use_temp_path=off;

  # don't send the nginx version number in error pages and Server header
  server_tokens off;

  # config to don't allow the browser to render the page inside an frame or iframe
  # and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
  # if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
  # https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
  add_header X-Frame-Options SAMEORIGIN;

  # when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
  # to disable content-type sniffing on some browsers.
  # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
  # currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
  # http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
  # 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
  add_header X-Content-Type-Options nosniff;

  # This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
  # It's usually enabled by default anyway, so the role of this header is to re-enable the filter for 
  # this particular website if it was disabled by the user.
  # https://www.owasp.org/index.php/List_of_useful_HTTP_headers
  add_header X-XSS-Protection "1; mode=block";

  # Redirect all non-https request to https
  server {
    listen 80 default_server;
    listen [::]:80 default_server;
    return 301 https://$host$request_uri;
  }

  server {

    listen 443 ssl;

    ssl_certificate     /etc/nginx/certs/web.crt;
    ssl_certificate_key /etc/nginx/certs/web.key;

    # enable session resumption to improve https performance
    # http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # config to enable HSTS(HTTP Strict Transport Security) https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security
    # to avoid ssl stripping https://en.wikipedia.org/wiki/SSL_stripping#SSL_stripping
    # also https://hstspreload.org/
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";

    gzip on;
    gzip_proxied any;
    gzip_types text/plain application/javascript application/x-javascript text/javascript text/xml text/css; 
    gzip_vary on;

    # Angular App
    location / {
      proxy_pass       http://web:80;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
    }

    # Documentation
    location ~ ^/api/docs/(.*)$ {
      # TODO put here your documentation URL
      proxy_pass https://code.ill.fr/docs/visa-docs/-/raw/master/$1;
      # We will use a cache of 3 hours for storing the documents retrieved from gitlab (gitlab can be a bit slow at times)
      proxy_cache visa_docs_cache;
      proxy_cache_valid 200 302  180m;
      proxy_cache_valid 404      1m;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
    } 


    # Rest API Server
    location /api {
      proxy_pass       http://api:8086/api;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
    }

    # GraphQL API Server
    location /graphql {
      proxy_pass       http://api:8086/graphql;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
    }

    # Stop jupyter being launched in 'classic' mode in a new window: redirect back to visa
    location ~ /jupyter/([0-9]+)/tree {
      return 301 /instances/$1/jupyter;
    }

    # Jupyter proxy Server
    location /jupyter {
      client_max_body_size 2M;
      try_files /nonexistent @jupyter$http_upgrade;
    }

    # Jupyter HTTP requests
    location @jupyter {
      proxy_pass       http://jupyter-proxy:8088;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
    }

    # Jupyter websocket requests
    location @jupyterwebsocket {
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_http_version 1.1;
      proxy_redirect off;
      proxy_pass       http://jupyter-proxy:8088;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;
    }

    # Remote desktop connections
    location /ws/vdi {
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_http_version 1.1;
          proxy_redirect off;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header Host $http_host;
          proxy_pass http://api:8087/socket.io;
    }
  }
}