246 lines
7.1 KiB
Plaintext
246 lines
7.1 KiB
Plaintext
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=STATIC:10m inactive=24h max_size=1g;
|
|
proxy_connect_timeout 1s;
|
|
|
|
server_tokens off;
|
|
|
|
server {
|
|
listen 80 default;
|
|
|
|
rewrite ^ https://$host$request_uri permanent;
|
|
}
|
|
|
|
server {
|
|
listen 443 default ssl http2;
|
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_dhparam /etc/nginx/ssl/dhparams-4096.pem;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
ssl_certificate /etc/nginx/ssl/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
|
|
|
|
ssl_client_certificate /srv/PKI/shared/ca.pem;
|
|
ssl_trusted_certificate /srv/PKI/shared/ca.pem;
|
|
ssl_verify_client optional;
|
|
|
|
root /srv/htdocs-frontend/;
|
|
|
|
error_page 401 /welcome.html;
|
|
error_page 403 404 /e404.html;
|
|
error_page 413 /e413.html;
|
|
error_page 500 502 504 /e500.html;
|
|
|
|
add_header Strict-Transport-Security max-age=31536000;
|
|
add_header X-Frame-Options deny;
|
|
add_header Content-Security-Policy "script-src 'unsafe-inline' 'self' 'unsafe-eval'; img-src 'self' data:; style-src 'unsafe-inline' 'self'; font-src 'self'; default-src 'self'";
|
|
add_header X-Xss-Protection "1; mode=block";
|
|
add_header X-Content-Type-Options nosniff;
|
|
add_header Referrer-Policy strict-origin;
|
|
add_header Feature-Policy "accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'none'; encrypted-media 'none'; fullscreen 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture 'none'; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'; wake-lock 'none'; xr-spatial-tracking 'none'";
|
|
|
|
location = / {
|
|
include fic-auth.conf;
|
|
}
|
|
location = /auth {
|
|
internal;
|
|
proxy_pass https://163.5.55.58/remote.php/webdav/;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Host "owncloud.srs.epita.fr";
|
|
proxy_set_header Content-Length "";
|
|
proxy_set_header X-Original-URI $request_uri;
|
|
}
|
|
location = /index.html {
|
|
include fic-auth.conf;
|
|
}
|
|
location = /welcome.html {
|
|
internal;
|
|
if ($http_accept ~ "^application/json") {
|
|
rewrite ^/(.*).html$ /$1.json;
|
|
}
|
|
}
|
|
location = /e404.html {
|
|
internal;
|
|
if ($http_accept ~ "^application/json") {
|
|
rewrite ^/(.*).html$ /$1.json;
|
|
}
|
|
}
|
|
location = /e413.html {
|
|
internal;
|
|
if ($http_accept ~ "^application/json") {
|
|
rewrite ^/(.*).html$ /$1.json;
|
|
}
|
|
}
|
|
location = /e500.html {
|
|
internal;
|
|
if ($http_accept ~ "^application/json") {
|
|
rewrite ^/(.*).html$ /$1.json;
|
|
}
|
|
}
|
|
|
|
location ~ ^/([A-Z]|_/) {
|
|
include fic-auth.conf;
|
|
|
|
rewrite ^/.*$ /index.html;
|
|
}
|
|
|
|
location /edit {
|
|
include fic-auth.conf;
|
|
|
|
rewrite ^/.*$ /index.html;
|
|
}
|
|
location /issues {
|
|
include fic-auth.conf;
|
|
|
|
rewrite ^/.*$ /index.html;
|
|
}
|
|
location /rank {
|
|
include fic-auth.conf;
|
|
|
|
rewrite ^/.*$ /index.html;
|
|
}
|
|
location /tags/ {
|
|
include fic-auth.conf;
|
|
|
|
rewrite ^/.*$ /index.html;
|
|
}
|
|
location /register {
|
|
include fic-auth.conf;
|
|
|
|
rewrite ^/.*$ /index.html;
|
|
}
|
|
location /rules {
|
|
include fic-auth.conf;
|
|
|
|
rewrite ^/.*$ /index.html;
|
|
}
|
|
|
|
location /files/ {
|
|
alias /srv/FILES/;
|
|
sendfile on;
|
|
tcp_nodelay on;
|
|
gzip_static always;
|
|
}
|
|
|
|
location /wait.json {
|
|
include fic-auth.conf;
|
|
|
|
root /srv/TEAMS/$team/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location /stats.json {
|
|
root /srv/TEAMS/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location /my.json {
|
|
include fic-auth.conf;
|
|
|
|
root /srv/TEAMS/$team/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
|
|
if (!-f /srv/startingblock/started) {
|
|
rewrite ^/.* /wait.json;
|
|
}
|
|
}
|
|
location /issues.json {
|
|
include fic-auth.conf;
|
|
|
|
root /srv/TEAMS/$team/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location /scores.json {
|
|
include fic-auth.conf;
|
|
|
|
root /srv/TEAMS/$team/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location = /events.json {
|
|
root /srv/TEAMS/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location = /teams.json {
|
|
root /srv/TEAMS/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location = /themes.json {
|
|
root /srv/TEAMS/;
|
|
expires epoch;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location = /challenge.json {
|
|
root /srv/SETTINGSDIST/;
|
|
expires epoch;
|
|
add_header X-FIC-time $msec;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
location = /settings.json {
|
|
root /srv/SETTINGSDIST/;
|
|
expires epoch;
|
|
add_header X-FIC-time $msec;
|
|
add_header Cache-Control no-cache;
|
|
}
|
|
|
|
location /submit/ {
|
|
include fic-auth.conf;
|
|
|
|
proxy_pass http://receiver:8080/submission;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-FIC-Team $team;
|
|
proxy_redirect off;
|
|
}
|
|
location /issue {
|
|
include fic-auth.conf;
|
|
|
|
proxy_pass http://receiver:8080;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-FIC-Team $team;
|
|
proxy_redirect off;
|
|
}
|
|
location /chname {
|
|
include fic-auth.conf;
|
|
|
|
proxy_pass http://receiver:8080;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-FIC-Team $team;
|
|
proxy_redirect off;
|
|
}
|
|
location /registration {
|
|
include fic-auth.conf;
|
|
|
|
proxy_pass http://receiver:8080;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-FIC-Team $team;
|
|
proxy_redirect off;
|
|
}
|
|
location /reset_progress {
|
|
include fic-auth.conf;
|
|
|
|
proxy_pass http://receiver:8080;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-FIC-Team $team;
|
|
proxy_redirect off;
|
|
}
|
|
location /openhint/ {
|
|
include fic-auth.conf;
|
|
|
|
proxy_pass http://receiver:8080;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-FIC-Team $team;
|
|
proxy_redirect off;
|
|
}
|
|
location /wantchoices/ {
|
|
include fic-auth.conf;
|
|
|
|
proxy_pass http://receiver:8080;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-FIC-Team $team;
|
|
proxy_redirect off;
|
|
}
|
|
}
|