documentation/nginx.conf at develop · decidim/documentation · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# Path without a trailing slash, for pretty-URL handling below.
map $uri $uri_noslash {
  ~^(.+)/$  $1;
  default   "";
}

server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;

  # Do not advertise the nginx version, and emit relative redirects. TLS is
  # terminated by Traefik in front of this container, so nginx would otherwise
  # build absolute redirects with `http://`.
  server_tokens off;
  absolute_redirect off;

  # Applied to every location that does not declare its own add_header. The
  # /admin/ location below re-declares these without the CSP, since Sveltia
  # needs its CDN and GitHub origins.
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
  add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; frame-src https://www.youtube.com; media-src 'self'; form-action 'self'" always;

  location ^~ /.well-known/ { try_files $uri =404; }

  # The CMS is a separate, script-heavy SPA. Serve it without the docs CSP so
  # its CDN scripts and GitHub/auth API calls are not blocked. Re-declaring any
  # add_header here stops the server-level headers (including the CSP) from
  # being inherited, so the non-CSP headers are repeated.
  location ^~ /admin/ {
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
    try_files $uri $uri/ =404;
  }

  # Pretty URLs: strip a trailing slash when the matching ".html" file exists,
  # otherwise serve the directory index.
  location ~ ^(/.+)/$ {
    if (-f "${document_root}${uri_noslash}.html") {
      return 301 $uri_noslash;
    }
    try_files ${uri_noslash}/index.html ${uri_noslash}/index.htm @redirects;
  }

  location = / { try_files /index.html =404; }

  location / {
    if (-d "${document_root}${uri}") {
      return 301 $uri/;
    }
    try_files $uri $uri/index.html $uri.html @redirects;
  }

  # Ported from supplemental_ui/_redirects. Reached only when no file matches,
  # matching Netlify's "static files shadow redirects" behaviour. The
  # (?!develop/) guard stops the "/en/develop/*" rule from looping on itself,
  # so unresolvable paths fall through to 404 like the current Netlify site.
  location @redirects {
    rewrite ^/en/(admin|configure|contribute|customize|features|install|publications|releases|services|understand|whitepaper)/(.*)$ /en/develop/$1/$2 permanent;
    rewrite ^/en/develop/(?!develop/)(.*)$ /en/develop/develop/$1 permanent;
    rewrite ^/(en/v0\.27|en/v0\.26|en/develop)/index\.html$ /$1/ permanent;
    rewrite ^/social-contract/en/.*$ /en/understand/social-contract/ permanent;
    rewrite ^/features/(en|es|ca)/(.*)$ /en/features/$2 permanent;
    rewrite ^/features/?$ /en/features/general-description/ permanent;
    rewrite ^/whitepaper/en/.*$ /en/whitepaper/ permanent;
    rewrite ^/deploy-and-admin/en/get-decidim/?$ /en/install/ permanent;
    rewrite ^/admin-manual/en/(.*)$ /en/admin/$1 permanent;
    rewrite ^/develop/en/?$ /en/develop/guide/ permanent;
    rewrite ^/develop/en/advanced/(.*)$ /en/develop/$1 permanent;
    rewrite ^/init/en/?$ /en/ permanent;
    return 404;
  }

  location = /404.html { internal; }
  error_page 404 /404.html;

  location ~* \.(css|js|svg|png|jpe?g|gif|ico|woff2?|ttf|eot|webp)$ {
    expires 7d; try_files $uri =404;
  }

  gzip on;
  gzip_types text/plain text/css application/javascript application/json image/svg+xml application/xml;
}