64 lines
2.2 KiB
Plaintext
64 lines
2.2 KiB
Plaintext
# Complete server example. Place av-tools at /srv/www/av/ to serve it from
|
|
# https://tools.example.test/av/. Adjust only the hostname and filesystem root.
|
|
|
|
map $uri $av_tools_cache_control {
|
|
default "no-cache";
|
|
"~^/(?:.*/)?vendor/ffmpeg/0\.12\.10-reviewed-stack5m\.1/(?:st|mt)/ffmpeg-core(?:\.worker)?\.(?:js|wasm)$" "public, max-age=31536000, immutable";
|
|
"~^/(?:.*/)?assets/.*-[A-Za-z0-9_-]{8,}\.[^/]+$" "public, max-age=31536000, immutable";
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name tools.example.test;
|
|
root /srv/www;
|
|
|
|
# Configure ssl_certificate/ssl_certificate_key or the surrounding proxy.
|
|
|
|
server_tokens off;
|
|
charset utf-8;
|
|
etag on;
|
|
|
|
# Explicit types avoid serving WASM or ES modules as octet-stream.
|
|
types {
|
|
text/html html;
|
|
text/css css;
|
|
text/javascript js mjs;
|
|
application/json json;
|
|
application/wasm wasm;
|
|
image/svg+xml svg;
|
|
image/png png;
|
|
image/jpeg jpg jpeg;
|
|
image/gif gif;
|
|
image/webp webp;
|
|
image/x-icon ico;
|
|
font/woff woff;
|
|
font/woff2 woff2;
|
|
}
|
|
default_type application/octet-stream;
|
|
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
add_header X-Frame-Options "DENY" always;
|
|
add_header Cross-Origin-Opener-Policy "same-origin" always;
|
|
add_header Cross-Origin-Embedder-Policy "require-corp" always;
|
|
add_header Cross-Origin-Resource-Policy "same-origin" always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self'; img-src 'self' blob: data:; media-src 'self' blob:; font-src 'self'; style-src 'self'; object-src 'none'; frame-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'" always;
|
|
add_header Cache-Control $av_tools_cache_control always;
|
|
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_types application/json application/wasm image/svg+xml text/css text/javascript text/plain;
|
|
|
|
location = /av {
|
|
return 308 /av/;
|
|
}
|
|
|
|
# No SPA fallback is needed: all release resources are real static files.
|
|
location /av/ {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
}
|