Login Register

meson / rss.meson.one

Last active 3 weeks ago

Like 0
nginx rssmonster

meson revised this gist 3 weeks ago · 2faba84

1 file changed, 104 insertions

rss.meson.one (file created)
@@ -0,0 +1,104 @@
1 + map $http_upgrade $connection_upgrade {
2 + default upgrade;
3 + '' close;
4 + }
5 +
6 + # Redirect all HTTP to HTTPS
7 + server {
8 + listen 80;
9 + listen [::]:80;
10 + server_name rss.meson.one;
11 +
12 + location / {
13 + return 301 https://$host$request_uri;
14 + }
15 + }
16 +
17 + server {
18 + # HTTP/2 over TCP
19 + listen 443 ssl;
20 + listen [::]:443 ssl;
21 +
22 + # HTTP/3 over QUIC/UDP
23 + listen 443 quic;
24 + listen [::]:443 quic;
25 +
26 + http2 on;
27 + http3 on;
28 +
29 + add_header Alt-Svc 'h3=":443"; ma=86400' always;
30 +
31 + server_name rss.meson.one;
32 + root /home/www-data/rss.meson.one;
33 +
34 + include /etc/letsencrypt/options-ssl-nginx.conf;
35 + ssl_certificate /etc/letsencrypt/live/rss.meson.one/fullchain.pem;
36 + ssl_certificate_key /etc/letsencrypt/live/rss.meson.one/privkey.pem;
37 + ssl_trusted_certificate /etc/letsencrypt/live/rss.meson.one/chain.pem;
38 +
39 + # Security headers
40 + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
41 + add_header X-Frame-Options "SAMEORIGIN" always;
42 + add_header X-Content-Type-Options "nosniff" always;
43 + add_header Referrer-Policy "strict-origin-when-cross-origin" always;
44 + add_header X-XSS-Protection "1; mode=block" always;
45 +
46 + # Logging
47 + access_log /var/log/nginx/rss.meson.one.log combined if=$loggable;
48 + error_log /var/log/nginx/_error_rss.meson.one.log warn;
49 +
50 + # Gzip for the Vue SPA assets and JSON API responses
51 + gzip on;
52 + gzip_vary on;
53 + gzip_comp_level 5;
54 + gzip_min_length 256;
55 + gzip_types application/javascript application/json text/css text/plain
56 + application/xml text/xml image/svg+xml font/woff2;
57 +
58 + # Allow larger bodies (OPML imports, avatar uploads, etc.)
59 + client_max_body_size 20m;
60 +
61 + # --- Fever / Google Reader API + MCP endpoint: no buffering, longer timeouts ---
62 + location ~ ^/(api/fever|api/greader|mcp) {
63 + proxy_pass http://127.0.0.1:3030;
64 + proxy_http_version 1.1;
65 +
66 + proxy_set_header Host $host;
67 + proxy_set_header X-Real-IP $remote_addr;
68 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
69 + proxy_set_header X-Forwarded-Proto $scheme;
70 +
71 + proxy_buffering off;
72 + proxy_read_timeout 300s;
73 + proxy_send_timeout 300s;
74 + }
75 +
76 + # --- Everything else: main app + REST API ---
77 + location / {
78 + proxy_pass http://127.0.0.1:3030;
79 + proxy_http_version 1.1;
80 +
81 + proxy_set_header Host $host;
82 + proxy_set_header X-Real-IP $remote_addr;
83 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
84 + proxy_set_header X-Forwarded-Proto $scheme;
85 +
86 + # Dynamic WebSocket support (only upgrades when client requests it)
87 + proxy_set_header Upgrade $http_upgrade;
88 + proxy_set_header Connection $connection_upgrade;
89 +
90 + proxy_connect_timeout 60s;
91 + proxy_read_timeout 60s;
92 + proxy_send_timeout 60s;
93 +
94 + proxy_buffer_size 16k;
95 + proxy_buffers 8 16k;
96 + proxy_busy_buffers_size 32k;
97 +
98 + }
99 +
100 + # Deny access to hidden files
101 + location ~ /\.(?!well-known) {
102 + deny all;
103 + }
104 + }