penpot_web.conf
View Options

	# -------------------------------------------------------------
	# Configuration for Docker PaaS front-end nginx
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
	# Source file: roles/paas-docker/nginx/files/vhosts/penpot_web.conf
	# -------------------------------------------------------------
	#
	# <auto-generated>
	# This file is managed by our rOPS SaltStack repository.
	#
	# Changes to this file may cause incorrect behavior
	# and will be lost if the state is redeployed.
	# </auto-generated>

	# -------------------------------------------------------------
	# Proxy cache
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	proxy_cache_path /srv/{{ args["realm"] }}/cache levels=2:2 keys_zone=penpot:20m;
	proxy_cache_methods GET HEAD;
	proxy_cache_valid any 48h;
	proxy_cache_key "$host$request_uri";

	# -------------------------------------------------------------
	# Application - {{ fqdn }}
	# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	server {
	listen 80;
	listen [::]:80;
	server_name {{ fqdn }};

	include includes/letsencrypt;

	return 301 https://$host$request_uri;
	}

	server {
	server_name {{ fqdn }};

	include includes/tls;
	ssl_certificate /srv/letsencrypt/etc/live/{{ fqdn }}/fullchain.pem;
	ssl_certificate_key /srv/letsencrypt/etc/live/{{ fqdn }}/privkey.pem;

	include includes/letsencrypt;

	client_max_body_size 100M;
	charset utf-8;

	proxy_http_version 1.1;
	proxy_set_header Host $http_host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Scheme $scheme;
	proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

	etag off;

	location @handle_redirect {
	set $redirect_uri "$upstream_http_location";
	set $redirect_host "$upstream_http_x_host";
	set $redirect_cache_control "$upstream_http_cache_control";

	proxy_buffering off;

	proxy_set_header Host "$redirect_host";
	proxy_hide_header etag;
	proxy_pass $redirect_uri;

	add_header x-internal-redirect "$redirect_uri";
	add_header x-cache-control "$redirect_cache_control";
	add_header cache-control "$redirect_cache_control";
	}

	location /assets {
	proxy_pass http://localhost:{{ app_port }}/assets;
	recursive_error_pages on;
	proxy_intercept_errors on;
	error_page 301 302 307 = @handle_redirect;
	}

	location /internal/gfonts/css {
	resolver 8.8.8.8 8.8.4.4;
	proxy_pass https://fonts.googleapis.com/css?$args;
	proxy_hide_header Access-Control-Allow-Origin;
	proxy_hide_header Cross-Origin-Resource-Policy;
	proxy_hide_header Link;
	proxy_hide_header Alt-Svc;
	proxy_hide_header Cache-Control;
	proxy_hide_header Expires;

	proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;

	proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
	proxy_set_header Host "fonts.googleapis.com";
	proxy_set_header Accept "/";

	proxy_cache penpot;

	add_header Access-Control-Allow-Origin $http_origin;
	add_header Cache-Control max-age=86400;
	add_header X-Cache-Status $upstream_cache_status;
	}

	location /internal/assets {
	internal;
	alias /srv/{{ args["realm"] }}/assets;
	add_header x-internal-redirect "$upstream_http_x_accel_redirect";
	}

	location /api/export {
	proxy_pass {{ args["services"]["exporter"] }};
	}

	location /api {
	proxy_pass http://localhost:{{ app_port }}/api;
	}

	location /ws/notifications {
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection 'upgrade';
	proxy_pass http://localhost:{{ app_port }}/ws/notifications;
	}

	location / {
	location ~ ^/internal/gfonts/font/(?<font_file>.+) {
	resolver 8.8.8.8 8.8.4.4;
	proxy_pass https://fonts.gstatic.com/s/$font_file;

	proxy_hide_header Access-Control-Allow-Origin;
	proxy_hide_header Cross-Origin-Resource-Policy;
	proxy_hide_header Link;
	proxy_hide_header Alt-Svc;
	proxy_hide_header Cache-Control;
	proxy_hide_header Expires;
	proxy_hide_header Cross-Origin-Opener-Policy;
	proxy_hide_header Report-To;

	proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;

	proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
	proxy_set_header Host "fonts.gstatic.com";
	proxy_set_header Accept "/";

	proxy_cache penpot;

	add_header Access-Control-Allow-Origin $http_origin;
	add_header Cache-Control max-age=86400;
	add_header X-Cache-Status $upstream_cache_status;
	}

	location ~* \.(js\|css).*$ {
	add_header Cache-Control "max-age=86400" always; # 24 hours
	}

	location ~* \.(html).*$ {
	add_header Cache-Control "no-cache, max-age=0" always;
	}

	location ~ ^/(/\|css\|fonts\|images\|js\|wasm) {
	}

	location ~ ^/[^/]+/(.*)$ {
	return 301 " /404";
	}

	root /srv/{{ args["realm"] }}/public;
	try_files $uri /index.html$is_args$args =404;
	}

	root /var/wwwroot-502/_default;
	error_page 502 /502.html;
	location /502.html {}
	}

File Metadata

Mime Type: text/plain
Expires: Thu, Sep 18, 19:01 (7 h, 21 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 2991324
Default Alt Text: penpot_web.conf (5 KB)

penpot_web.conf
No OneTemporary
Actions

penpot_web.conf
View Options

File Metadata

Event Timeline

penpot_web.confNo OneTemporaryActions

penpot_web.confView Options

File Metadata

Event Timeline

penpot_web.conf
No OneTemporary
Actions

penpot_web.conf
View Options