first

docker/nginx.conf

@@ -0,0 +1,43 @@
+map $arg_download $media_disposition {
+    default "";
+    "1"     "attachment";
+}
+
+server {
+    listen 80;
+    server_name _;
+
+    location /static/ {
+        alias /app/staticfiles/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        access_log off;
+    }
+
+    location ^~ /media/branding/ {
+        alias /app/media/branding/;
+        expires 7d;
+        add_header X-Content-Type-Options nosniff always;
+        access_log off;
+    }
+
+    location /protected-media/ {
+        alias /app/media/;
+        secure_link $arg_md5,$arg_expires;
+        secure_link_md5 "$secure_link_expires$uri ${MEDIA_SIGNING_SECRET}";
+        if ($secure_link = "") { return 403; }
+        if ($secure_link = "0") { return 410; }
+        add_header Content-Disposition $media_disposition always;
+        add_header X-Content-Type-Options nosniff always;
+        expires -1;
+    }
+
+    location = /healthz/ {
+        default_type application/json;
+        return 200 '{"status":"ok"}';
+    }
+
+    location / {
+        return 404;
+    }
+}