4cbebff43b
Introduces .dockerignore, production Dockerfile and nginx config for frontend, and refactors docker-compose.yml for multi-service deployment. Updates backend and frontend code to support public API tagging, improves refund handling, adds test email endpoint, and migrates Orval config to TypeScript. Removes unused frontend Dockerfile and updates dependencies for React Query and Orval.
76 lines
2.9 KiB
Nginx Configuration File
76 lines
2.9 KiB
Nginx Configuration File
# nginx.conf
|
|
worker_processes auto;
|
|
user nginx;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
client_max_body_size 50m;
|
|
|
|
sendfile on;
|
|
keepalive_timeout 65;
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# -------------------------
|
|
# React frontend
|
|
# -------------------------
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
location / {
|
|
try_files $uri /index.html;
|
|
# Ensure CSP is present on SPA document responses too
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://api.paylibo.com; connect-src 'self' http://127.0.0.1:8000 http://localhost:8000 ws: wss: https://api.paylibo.com; font-src 'self' data:" always;
|
|
}
|
|
|
|
# -------------------------
|
|
# Django backend API
|
|
# -------------------------
|
|
|
|
# Serve Django static and media volumes mounted into the container
|
|
location /static/ {
|
|
alias /app/collectedstaticfiles/;
|
|
}
|
|
|
|
location /media/ {
|
|
alias /app/media/;
|
|
}
|
|
|
|
# Same-origin proxy for API -> avoids CORS and allows cookies
|
|
location /api {
|
|
return 301 /api/;
|
|
}
|
|
location /api/ {
|
|
proxy_pass http://backend:8000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_buffering off;
|
|
client_max_body_size 50m;
|
|
|
|
# Ensure CSP is also present on proxied responses
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://api.paylibo.com; connect-src 'self' http://127.0.0.1:8000 http://localhost:8000 ws: wss: https://api.paylibo.com; font-src 'self' data:" always;
|
|
}
|
|
|
|
# -------------------------
|
|
# Security headers
|
|
# -------------------------
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Minimal, valid CSP for development (apply on all responses)
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://api.paylibo.com; connect-src 'self' http://127.0.0.1:8000 http://localhost:8000 ws: wss: https://api.paylibo.com; font-src 'self' data:" always;
|
|
}
|
|
}
|