Revert config

pythondigest · May 27, 2016 · 9674f62 · 9674f62
1 parent 604aedf
commit 9674f62
Show file tree

Hide file tree

Showing 2 changed files with 71 additions and 16 deletions.
diff --git a/deploy/nginx.conf b/deploy/nginx.conf
@@ -1,30 +1,65 @@
 server {
     listen 80;
-    server_name dev.pythondgest.ru;
+    server_name pythondigest.ru;
+    return 301 https://$host$request_uri;
+}
+
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name pythondgest.ru;
     charset utf-8;
 
-    pagespeed off;
+    pagespeed on;
     pagespeed FileCachePath /var/ngx_pagespeed_cache;
 
-    error_log /var/log/nginx/dev.pythondigest-error.log;
-    access_log /var/log/nginx/dev.pythondigest-access.log;
+    ssl_certificate /etc/letsencrypt/live/pythondigest.ru/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/pythondigest.ru/privkey.pem;
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:5m;
+    ssl_session_tickets off;
+
+    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+    ssl_dhparam /opt/dhparam.pem;
+
+    ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
+    ssl_prefer_server_ciphers on;
+
+    # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
+    # add_header Strict-Transport-Security max-age=15768000;
+
+    # OCSP Stapling ---
+    # fetch OCSP records from URL in ssl_certificate and cache them
+    ssl_stapling on;
+    ssl_stapling_verify on;
+    resolver 8.8.4.4 8.8.8.8 valid=300s;
+    resolver_timeout 10s;
 
-    root /home/pythondigest/dev.pythondigest.ru;
+    ## verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/pythondigest.ru/chain.pem;
+
+    error_log /var/log/nginx/pythondigest-error.log;
+    access_log /var/log/nginx/pythondigest-access.log;
+
+    root /home/pythondigest/pythondigest.ru;
 
     location /favicon.ico {
-        return http://dev.pythondigest.ru/static/img/favicon.ico;
+        return http://pythondigest.ru/static/img/favicon.ico;
     }
 
     location ~* .(jpg|jpeg|png|gif|ico|css|js)$ {
         expires 365d;
     }
 
     location = /robots.txt {
-        alias /home/pythondigest/dev.pythondigest.ru/repo/robots.txt ;
+        alias /home/pythondigest/pythondigest.ru/repo/robots.txt ;
     }
 
     location = /humans.txt {
-        alias /home/pythondigest/dev.pythondigest.ru/repo/humans.txt ;
+        alias /home/pythondigest/pythondigest.ru/repo/humans.txt ;
     }
 
 
@@ -36,15 +71,35 @@ server {
 
     location ~* ^(/admin) {
         #uwsgi_cache off;
-        uwsgi_pass 127.0.0.1:8888;
+        uwsgi_pass 127.0.0.1:8000;
         include uwsgi_params;
         pagespeed off;
     }
 
     location / {
-        uwsgi_pass 127.0.0.1:8888;
+        uwsgi_pass 127.0.0.1:8000;
         include uwsgi_params;
     }
 
 
+
+
+    # Needs to exist and be writable by nginx.  Use tmpfs for best performance.
+    pagespeed FileCachePath /var/ngx_pagespeed_cache;
+
+    # Ensure requests for pagespeed optimized resources go to the pagespeed handler
+    # and no extraneous headers get set.
+    location ~ "\.pagespeed\.([a-z]\.)?[a-z]{2}\.[^.]{10}\.[^.]+" {
+        add_header "" "";
+    }
+    location ~ "^/pagespeed_static/" { }
+    location ~ "^/ngx_pagespeed_beacon$" { }
+
+    location /ngx_pagespeed_statistics { }
+    location /ngx_pagespeed_global_statistics {  }
+    location /ngx_pagespeed_message { }
+    location /pagespeed_console {  }
+    location ~ ^/pagespeed_admin { }
+    location ~ ^/pagespeed_global_admin { }
+
 }
diff --git a/deploy/uwsgi.ini b/deploy/uwsgi.ini
@@ -1,14 +1,14 @@
 [uwsgi]
 plugin = python3
-chdir = /home/pythondigest/dev.pythondigest.ru/repo
-touch-reload = /home/pythondigest/dev.pythondigest.ru/touchme
+chdir = /home/pythondigest/pythondigest.ru/repo
+touch-reload = /home/pythondigest/pythondigest.ru/touchme
 vacuum = true
-max-requests = 100
+max-requests = 5000
 buffer-size = 32768
-virtualenv = /home/pythondigest/dev.pythondigest.ru/env
-socket = 127.0.0.1:8888
+virtualenv = /home/pythondigest/pythondigest.ru/env
+socket = 127.0.0.1:8000
 env = DJANGO_SETTINGS_MODULE=conf.settings
 module = django.core.wsgi:get_wsgi_application()
 uid = www-data
 gid = www-data
-workers = 1
+workers = 2