133 lines
4.3 KiB
Plaintext
133 lines
4.3 KiB
Plaintext
# Edge proxy (185.170.196.188) block for aego.akarpov.ru. The route to mainserv is slow and drops,
|
|
# so the edge serves the static site from its own copy: aego-wasm-sync keeps /var/www/aego-site/current
|
|
# (from the site archive) and /var/www/aego-wasm/<version>/ (the wasm binaries) up to date. Anything
|
|
# missing there, such as a version that has not arrived yet, goes to mainserv through the proxy.
|
|
# Install: /etc/nginx/sites-enabled/aego-edge.conf, then nginx -t && systemctl reload nginx.
|
|
map $http_accept_encoding $aego_edge_enc {
|
|
"~*\bbr\b" ".br";
|
|
"~*gzip" ".gz";
|
|
default "";
|
|
}
|
|
|
|
map $aego_edge_enc $aego_edge_ce {
|
|
".br" "br";
|
|
".gz" "gzip";
|
|
default "";
|
|
}
|
|
|
|
map $arg_v $aego_edge_cache {
|
|
"" "public, max-age=300";
|
|
default "public, max-age=31536000, immutable";
|
|
}
|
|
|
|
map $uri $aego_edge_coop {
|
|
"~^/play/" "same-origin";
|
|
default "";
|
|
}
|
|
|
|
map $uri $aego_edge_coep {
|
|
"~^/play/" "require-corp";
|
|
default "";
|
|
}
|
|
|
|
map $sent_http_content_type $aego_edge_page_cache {
|
|
"~^text/html" "public, max-age=60";
|
|
default $aego_edge_cache;
|
|
}
|
|
|
|
server {
|
|
include snippets/maintenance.conf;
|
|
listen 127.0.0.1:18443 ssl proxy_protocol;
|
|
server_name aego.akarpov.ru;
|
|
ssl_certificate /etc/letsencrypt/live/aego.akarpov.ru/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/aego.akarpov.ru/privkey.pem;
|
|
|
|
set_real_ip_from 127.0.0.1;
|
|
real_ip_header proxy_protocol;
|
|
|
|
root /var/www/aego-site/current;
|
|
gzip_static on;
|
|
gzip_vary on;
|
|
absolute_redirect off;
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
location ~ ^/(try|play|demo)/[A-Za-z0-9_.-]+\.wasm$ {
|
|
root /var/www/aego-wasm;
|
|
types { }
|
|
default_type application/wasm;
|
|
add_header Cache-Control "public, max-age=31536000, immutable" always;
|
|
add_header Content-Encoding $aego_edge_ce always;
|
|
add_header Vary Accept-Encoding always;
|
|
add_header Cross-Origin-Opener-Policy $aego_edge_coop always;
|
|
add_header Cross-Origin-Embedder-Policy $aego_edge_coep always;
|
|
add_header X-Cache-Status EDGE always;
|
|
if ($arg_v !~ "^[0-9a-f]{6,64}$") {
|
|
return 404;
|
|
}
|
|
try_files /$arg_v$uri$aego_edge_enc @aego_origin;
|
|
}
|
|
|
|
location ~ ^/install\.(sh|ps1)$ {
|
|
default_type text/plain;
|
|
add_header Cache-Control "no-cache" always;
|
|
add_header X-Cache-Status EDGE always;
|
|
try_files $uri @aego_origin;
|
|
}
|
|
|
|
# Pages live at clean URLs; /a/index.html -> /a/, /a/b.html -> /a/b.
|
|
location ~ \.(html|json)$ {
|
|
if ($request_uri ~ "^(.*/)index\.html(\?.*)?$") {
|
|
return 301 $1$is_args$args;
|
|
}
|
|
if ($request_uri ~ "^(.+)\.html(\?.*)?$") {
|
|
return 301 $1$is_args$args;
|
|
}
|
|
add_header Cache-Control "public, max-age=60" always;
|
|
add_header X-Cache-Status EDGE always;
|
|
add_header Cross-Origin-Opener-Policy $aego_edge_coop always;
|
|
add_header Cross-Origin-Embedder-Policy $aego_edge_coep always;
|
|
try_files $uri @aego_origin;
|
|
}
|
|
|
|
location = / {
|
|
add_header Cache-Control "public, max-age=60" always;
|
|
add_header X-Cache-Status EDGE always;
|
|
try_files /index.html @aego_origin;
|
|
}
|
|
|
|
location ^~ /__edge/ {
|
|
return 404;
|
|
}
|
|
|
|
location ~ ^/(play|demo|try)$ {
|
|
return 301 $uri/$is_args$args;
|
|
}
|
|
|
|
location / {
|
|
add_header Cache-Control $aego_edge_page_cache always;
|
|
add_header Cross-Origin-Opener-Policy $aego_edge_coop always;
|
|
add_header Cross-Origin-Embedder-Policy $aego_edge_coep always;
|
|
add_header X-Cache-Status EDGE always;
|
|
try_files $uri $uri.html $uri/index.html @aego_origin;
|
|
}
|
|
|
|
location @aego_origin {
|
|
add_header X-Cache-Status $upstream_cache_status always;
|
|
proxy_pass https://ru_origin;
|
|
proxy_ssl_server_name on;
|
|
proxy_ssl_name $host;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_cache akarpov;
|
|
proxy_cache_key $scheme$host$request_uri;
|
|
proxy_cache_lock on;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
}
|