55 lines
1.4 KiB
Nginx Configuration File
55 lines
1.4 KiB
Nginx Configuration File
map $arg_download $media_disposition {
|
|
default "";
|
|
"1" "attachment";
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
location /static/ {
|
|
alias /app/staticfiles/;
|
|
expires 30d;
|
|
add_header Cache-Control "public, immutable";
|
|
access_log off;
|
|
}
|
|
|
|
location ^~ /media/branding/ {
|
|
alias /app/media/branding/;
|
|
expires 7d;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
access_log off;
|
|
}
|
|
|
|
# Financial evidence requires a current authenticated application permission check.
|
|
# Never expose it through bearer-style signed media links.
|
|
location ^~ /protected-media/payments/ {
|
|
return 404;
|
|
}
|
|
|
|
# These files require an authenticated application check on every request.
|
|
location ^~ /protected-media/dispatch-responses/ {
|
|
return 404;
|
|
}
|
|
|
|
location /protected-media/ {
|
|
alias /app/media/;
|
|
secure_link $arg_md5,$arg_expires;
|
|
secure_link_md5 "$secure_link_expires$uri ${MEDIA_SIGNING_SECRET}";
|
|
if ($secure_link = "") { return 403; }
|
|
if ($secure_link = "0") { return 410; }
|
|
add_header Content-Disposition $media_disposition always;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
expires -1;
|
|
}
|
|
|
|
location = /healthz/ {
|
|
default_type application/json;
|
|
return 200 '{"status":"ok"}';
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|