diff options
Diffstat (limited to 'files/etc/nginx')
| -rw-r--r-- | files/etc/nginx/sites-available/webmap | 23 | ||||
| -rw-r--r-- | files/etc/nginx/snippets/ssl.conf | 7 |
2 files changed, 15 insertions, 15 deletions
diff --git a/files/etc/nginx/sites-available/webmap b/files/etc/nginx/sites-available/webmap index d5e005a..e43af57 100644 --- a/files/etc/nginx/sites-available/webmap +++ b/files/etc/nginx/sites-available/webmap @@ -65,8 +65,10 @@ server { location ^~ /assets/ { expires 7d; - brotli_static on; try_files $uri =404; + location ~ "\.(?:css|js|svg)$" { + brotli_static on; + } } location ^~ /tiles/ { expires 30m; @@ -75,6 +77,15 @@ server { # service an empty payload to save bandwidth error_page 404 /_.txt; } + location ^~ /raster/ { + expires 30m; + try_files $uri =404; + # service an empty payload to save bandwidth + error_page 404 /_.txt; + location ~ "\.json$" { + brotli_static on; + } + } location = /q { expires epoch; limit_except POST { deny all; } @@ -90,14 +101,8 @@ server { gzip on; gzip_types application/json text/plain; include uwsgi_params; - uwsgi_buffering off; uwsgi_pass unix:/run/webmap-cgi.socket; } - location = /tiles/metadata.json { - expires epoch; - brotli_static on; - try_files $uri =404; - } location = /_.txt { # cache 404 responses for 30m like for valid tiles @@ -113,8 +118,10 @@ server { add_header X-Content-Type-Options "nosniff"; add_header X-XSS-Protection "1; mode=block"; add_header Strict-Transport-Security "max-age=31557600; includeSubDomains" always; - add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; base-uri 'self'"; + add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self' data: https://minkarta.lantmateriet.se/map/; script-src 'self'; style-src 'self'; frame-ancestors 'self'; form-action 'none'; worker-src blob:; base-uri 'self'"; + expires 1h; + brotli_static on; try_files $uri $uri/ =404; } } diff --git a/files/etc/nginx/snippets/ssl.conf b/files/etc/nginx/snippets/ssl.conf index 0bce30a..b86f5e3 100644 --- a/files/etc/nginx/snippets/ssl.conf +++ b/files/etc/nginx/snippets/ssl.conf @@ -7,10 +7,3 @@ ssl_dhparam /etc/ssl/dhparams.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305; ssl_prefer_server_ciphers off; - -ssl_stapling on; -ssl_stapling_verify on; - -ssl_trusted_certificate /usr/share/lacme/ca-certificates.crt; - -resolver 127.0.0.53; |