redmine-nginx/sites-available/secure.projects.example.com at 215c65ab03d402cbdc62b7cccdd357b3dce87dcf · perusio/redmine-nginx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
# -*- mode: nginx; mode: flyspell-prog; mode: autopair; ispell-local-dictionary: "american" -*-
### Configuration for secure.projects.example.com.

server {
    ## This is to avoid the spurious if for sub-domain name
    ## rewriting. See http://wiki.nginx.org/Pitfalls#Server_Name.
    listen 80;
    ## Replace the IPv6 address by your own address. The address below
    ## was stolen from the wikipedia page on IPv6.
    listen [fe80::202:b3ff:fe1e:8329]:80;
    server_name secure.projects.example.com;
    ## Use only HTTPS.
    return 301 https://secure.projects.example.com$request_uri;

} # server domain rewrite.

server {
    ## This is to avoid the spurious if for sub-domain name
    ## rewriting. See http://wiki.nginx.org/Pitfalls#Server_Name.
    listen 80;
    listen 443;
    ## Replace the IPv6 address by your own address. The address below
    ## was stolen from the wikipedia page on IPv6.
    listen [fe80::202:b3ff:fe1e:8329]:80 ipv6only=on;
    listen [fe80::202:b3ff:fe1e:8329]:443 ssl ipv6only=on;
    server_name www.secure.projects.example.com;

    ## See the keepalive_timeout directive in nginx.conf.
    ## Server certificate and key.
    ssl_certificate /etc/ssl/certs/secure.projects.example.com-cert.pem;
    ssl_certificate_key /etc/ssl/private/perusio.com-key.pem;

    ## Use only HTTPS.
    return 301 https://secure.projects.example.com$request_uri;

} # server domain rewrite.


server {
    listen 443 ssl; # IPv4 socket listening on all addresses.
    ## Replace the IPv6 address by your own address. The address below
    ## was stolen from the wikipedia page on IPv6.
    listen [fe80::202:b3ff:fe1e:8329]:443 ssl ipv6only=on;

    limit_conn arbeit 32;
    server_name secure.projects.example.com;

    ## Keep alive timeout set to a greater value for SSL/TLS.
    keepalive_timeout 75 75;

    ## Access and error logs.
    access_log /var/log/nginx/damiao_org.access.log;
    error_log /var/log/nginx/damiao_org.error.log;

    ## See the keepalive_timeout directive in nginx.conf.
    ## Server certificate and key.
    ssl_certificate /etc/ssl/certs/secure.projects.example.com-cert.pem;
    ssl_certificate_key /etc/ssl/private/perusio.com-key.pem;

    ## Strict Transport Security header for enhanced security. See
    ## http://www.chromium.org/sts.
    add_header Strict-Transport-Security "max-age=7200";

    root /usr/share/redmine/public;
    index index.html;

    ## See the blacklist.conf file at the parent dir: /etc/nginx.
    ## Deny access based on the User-Agent header.
    if ($bad_bot) {
        return 444;
    }
    ## Deny access based on the Referer header.
    if ($bad_referer) {
        return 444;
    }

    location / {
        try_files $uri @thin;
    }

    ## All static files will be served directly.
    location ~* ^.+\.(?:css|js|jpe?g|gif|htc|ico|png|html)$ {
        access_log off;
        expires 30d;
        ## No need to bleed constant updates. Send the all shebang in one
        ## fell swoop.
        tcp_nodelay off;
        ## Set the OS file cache.
        open_file_cache max=3000 inactive=120s;
        open_file_cache_valid 45s;
        open_file_cache_min_uses 2;
        open_file_cache_errors off;
    }

    ## Support for favicon. Return an 1x1 transparent GIF if it doesn't
    ## exist.
    location = /favicon.ico {
        expires 30d;
        try_files /favicon.ico @empty;
    }

    ## Return an in memory 1x1 transparent GIF.
    location @empty {
        expires 30d;
        empty_gif;
    }

    ## Location
    location @thin {
        proxy_http_version 1.1;
        proxy_set_header Connection '';
        proxy_pass http://redmine_thin;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
    }

    ## Protect .git files.
    location ^~ /.git {
        return 404;
    }

} # server HTTPS