nginx_production.conf

# Nginx configuration for Smart AI Trading Strategy Optimizer
# This file should be copied to C:\nginx-1.28.0\conf\nginx.conf

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # Hide nginx version from headers and error pages
    server_tokens off;
    
    # To completely remove "nginx" from Server header, uncomment the following line
    # (requires headers-more-nginx-module to be installed)
    # more_clear_headers 'Server';

    sendfile        on;
    keepalive_timeout  65;
    
    # Logging format for better debugging
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for" '
                    'rt=$request_time uct="$upstream_connect_time" '
                    'uht="$upstream_header_time" urt="$upstream_response_time"';
    
    access_log logs/access.log main;
    error_log logs/error.log warn;

    # Gzip compression for better performance and SEO
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml text/javascript application/json application/javascript application/xml+rss application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;

    # HTTP server
    # برای فعال‌سازی HTTPS، بخش HTTPS را uncomment کنید و مسیر گواهینامه‌ها را تنظیم کنید
    server {
        listen 80;
        server_name myaibaz.ir www.myaibaz.ir;
        
        # Custom error pages (without nginx branding)
        error_page 403 /403.html;
        error_page 404 /404.html;
        location = /403.html {
            root html;
            internal;
        }
        location = /404.html {
            root html;
            internal;
        }
        
        # افزایش buffer size برای درخواست‌های بزرگ
        client_max_body_size 100M;
        
        # Robots.txt and Sitemap.xml - serve before redirect (important for SEO)
        # Search engines need access to these files even on HTTP
        location = /robots.txt {
            root html;
            try_files $uri /robots.txt;
            access_log off;
            log_not_found off;
            expires 1d;
            add_header Cache-Control "public, max-age=86400";
        }

        location = /sitemap.xml {
            root html;
            try_files $uri /sitemap.xml;
            access_log off;
            log_not_found off;
            expires 1d;
            add_header Cache-Control "public, max-age=86400";
            add_header Content-Type "application/xml; charset=utf-8";
        }
        
        # Redirect HTTP to HTTPS (except robots.txt and sitemap.xml)
        location / {
            return 301 https://$server_name$request_uri;
        }

        # Backend API proxy
        location /api/ {
            # Use upstream for better error handling
            proxy_pass http://127.0.0.1:8000/api/;
            
            # Set Host to localhost so Django accepts the request
            # The original host is preserved in X-Forwarded-Host for reference
            proxy_set_header Host localhost;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            # Preserve original host for logging/reference
            proxy_set_header X-Forwarded-Host $host;
            
            # Error handling - retry on connection errors
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_next_upstream_tries 2;
            proxy_next_upstream_timeout 10s;
            
            # CORS headers - Allow requests from any origin (since we're using same-origin via proxy)
            # Django CORS middleware will handle the actual CORS validation
            add_header 'Access-Control-Allow-Origin' $http_origin always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always;
            add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, X-CSRFToken, X-Requested-With' always;
            add_header 'Access-Control-Max-Age' '86400' always;
            
            # Handle preflight OPTIONS requests
            # OPTIONS requests should be handled by nginx, not forwarded to backend
            if ($request_method = 'OPTIONS') {
                add_header 'Access-Control-Allow-Origin' $http_origin always;
                add_header 'Access-Control-Allow-Credentials' 'true' always;
                add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always;
                add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, X-CSRFToken, X-Requested-With' always;
                add_header 'Access-Control-Max-Age' '86400' always;
                add_header 'Content-Type' 'text/plain charset=UTF-8';
                add_header 'Content-Length' 0;
                # Return 204 immediately without proxying to backend
                return 204;
            }
            
            # Timeout settings (increased for internet access with higher latency)
            # Increased timeouts to handle slower internet connections
            proxy_connect_timeout 60s;
            proxy_send_timeout 90s;
            proxy_read_timeout 90s;
            
            # Buffer settings
            proxy_buffering off;
            proxy_request_buffering off;
            
            # Block API endpoints from search engines
            add_header X-Robots-Tag "noindex, nofollow" always;
            
            # Error pages
            proxy_intercept_errors off;
            
            # Logging for debugging
            access_log logs/api_access.log;
            error_log logs/api_error.log warn;
        }
        
        # Frontend admin routes - must come before Django admin block
        # These routes are handled by React Router, not Django admin
        location ~ ^/admin/(users|security|settings) {
            root html;
            index index.html;
            try_files $uri $uri/ /index.html;
            add_header Cache-Control "no-cache, no-store, must-revalidate";
        }
        
        # Django admin panel - only accessible from localhost
        # This matches /admin/ but not /admin/users, /admin/security, /admin/settings
        location /admin/ {
            # Restrict to localhost only
            allow 127.0.0.1;
            allow ::1;
            deny all;
            
            proxy_pass http://127.0.0.1:8000/admin/;
            proxy_set_header Host localhost;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            # Block admin panel from search engines
            add_header X-Robots-Tag "noindex, nofollow" always;
        }

        # Static files (Django static files)
        location /static/ {
            proxy_pass http://127.0.0.1:8000/static/;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        # Media files (user uploads)
        location /media/ {
            proxy_pass http://127.0.0.1:8000/media/;
            expires 30d;
            add_header Cache-Control "public";
        }

        # Health check endpoint
        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }

    # HTTPS server - فعال شده با Cloudflare Origin Certificate
    server {
        listen 443 ssl;
        http2 on;
        server_name myaibaz.ir www.myaibaz.ir;
        
        # SSL certificate paths - Cloudflare Origin Certificate
        ssl_certificate C:/nginx-1.28.0/conf/ssl/myaibaz.ir.crt;
        ssl_certificate_key C:/nginx-1.28.0/conf/ssl/myaibaz.ir.key;
    #     
        # SSL configuration for security
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        
        # Custom error pages (without nginx branding)
        error_page 403 /403.html;
        error_page 404 /404.html;
        location = /403.html {
            root html;
            internal;
        }
        location = /404.html {
            root html;
            internal;
        }
        
        # افزایش buffer size برای درخواست‌های بزرگ
        client_max_body_size 100M;
        
        # Security headers for SEO and security
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        
        # Robots.txt and Sitemap.xml
        location = /robots.txt {
            root html;
            try_files $uri /robots.txt;
            access_log off;
            log_not_found off;
            expires 1d;
            add_header Cache-Control "public, max-age=86400";
        }
        
        location = /sitemap.xml {
            root html;
            try_files $uri /sitemap.xml;
            access_log off;
            log_not_found off;
            expires 1d;
            add_header Cache-Control "public, max-age=86400";
            add_header Content-Type "application/xml; charset=utf-8";
        }
        
        # Frontend - React App
        location / {
            root html;
            index index.html;
            try_files $uri $uri/ /index.html;
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header X-Robots-Tag "index, follow" always;
        }
        
        # Backend API proxy
        location /api/ {
            proxy_pass http://127.0.0.1:8000/api/;
            proxy_set_header Host localhost;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-Host $host;
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_next_upstream_tries 2;
            proxy_next_upstream_timeout 10s;
            add_header 'Access-Control-Allow-Origin' $http_origin always;
            add_header 'Access-Control-Allow-Credentials' 'true' always;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always;
            add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, X-CSRFToken, X-Requested-With' always;
            add_header 'Access-Control-Max-Age' '86400' always;
            if ($request_method = 'OPTIONS') {
                add_header 'Access-Control-Allow-Origin' $http_origin always;
                add_header 'Access-Control-Allow-Credentials' 'true' always;
                add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, PATCH, OPTIONS' always;
                add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, X-CSRFToken, X-Requested-With' always;
                add_header 'Access-Control-Max-Age' '86400' always;
                add_header 'Content-Type' 'text/plain charset=UTF-8';
                add_header 'Content-Length' 0;
                return 204;
            }
            proxy_connect_timeout 60s;
            proxy_send_timeout 90s;
            proxy_read_timeout 90s;
            proxy_buffering off;
            proxy_request_buffering off;
            add_header X-Robots-Tag "noindex, nofollow" always;
            proxy_intercept_errors off;
            access_log logs/api_access.log;
            error_log logs/api_error.log warn;
        }
        
        # Frontend admin routes - must come before Django admin block
        # These routes are handled by React Router, not Django admin
        location ~ ^/admin/(users|security|settings) {
            root html;
            index index.html;
            try_files $uri $uri/ /index.html;
            add_header Cache-Control "no-cache, no-store, must-revalidate";
        }
        
        # Django admin panel - only accessible from localhost
        # This matches /admin/ but not /admin/users, /admin/security, /admin/settings
        location /admin/ {
            # Restrict to localhost only
            allow 127.0.0.1;
            allow ::1;
            deny all;
            
            proxy_pass http://127.0.0.1:8000/admin/;
            proxy_set_header Host localhost;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-Host $host;
            add_header X-Robots-Tag "noindex, nofollow" always;
        }
        
        # Static files
        location /static/ {
            proxy_pass http://127.0.0.1:8000/static/;
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
        
        # Media files
        location /media/ {
            proxy_pass http://127.0.0.1:8000/media/;
            expires 30d;
            add_header Cache-Control "public";
        }
        
        # Health check endpoint
        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }
}