blob: 84825c2289b5f7621a694b6c87241e759faf4d1f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
## Example config for reitti
http {
# [...]
# Make sure the following path exists
proxy_cache_path /var/cache/nginx/reitti
levels=1:2 keys_zone=reitti_tiles:512m max_size=2g inactive=90d use_temp_path=off
loader_threshold=300 loader_files=200 loader_sleep=50ms
manager_threshold=300 manager_files=200 manager_sleep=50ms;
# Open file cache to reduce stat calls on cached files
open_file_cache max=200000 inactive=120s;
open_file_cache_valid 120s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
# Cache lock tuning
proxy_cache_lock on;
proxy_cache_lock_timeout 5s;
proxy_cache_lock_age 10s;
proxy_cache_background_update on;
proxy_cache_revalidate on; # Revalidate with ETag/Last-Modified when present
# Important for dynamic upstream URLs, adjust as needed
resolver 8.8.8.8 valid=300s;
upstream reitti {
server 127.0.0.1:56372;
keepalive 20;
}
server {
listen 80;
listen [::]:80 default;
return 301 https://$server_name$request_uri;
}
# See https://github.com/dedicatedcode/reitti/blob/v5.0.1/docker/tiles-cache/nginx.conf.template
server {
listen 127.0.0.1:56373; # TILES_CACHE="http://127.0.0.1:56373"
# Optional: strong client cache headers (immutable tile URLs).
# If you prefer more conservative client caching, lower to 30d or comment out.
set $tile_client_cache_control "public, max-age=31536000, immutable";
# Buffers/tuning for proxied tile responses (typically small images/PBF)
# Tune these if you see "upstream sent too big header" or buffer warnings.
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering on;
proxy_buffers 64 64k;
proxy_buffer_size 128k;
proxy_busy_buffers_size 256k;
proxy_read_timeout 30s;
proxy_connect_timeout 10s;
proxy_send_timeout 30s;
# Use the same cache key format across locations
proxy_cache_key "$scheme$proxy_host$request_uri";
# Avoid cache fragmentation by upstream compression variance
proxy_set_header Accept-Encoding "";
# Don’t let Set-Cookie poison the cache
proxy_ignore_headers Set-Cookie;
proxy_hide_header Set-Cookie;
location /custom/ {
set $custom_upstream $http_x_reitti_upstream_url;
if ($custom_upstream = "") {
return 400;
}
# Strip the /custom/ prefix so the upstream receives the correct path
rewrite ^/custom/(.*) /$1 break;
proxy_pass $custom_upstream;
proxy_set_header Host $proxy_host;
proxy_set_header User-Agent "Reitti/1.0 (+https://github.com/dedicatedcode/reitti; contact: reitti@dedicatedcode.com)";
proxy_ssl_server_name on;
proxy_cache reitti_tiles;
proxy_cache_key "$custom_upstream";
proxy_cache_valid 200 302 1y;
proxy_cache_valid 404 1m;
proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
add_header X-Cache-Status $upstream_cache_status;
add_header Cache-Control $tile_client_cache_control;
expires 1y;
}
location /health {
access_log off;
return 200 "healthy\n";
add_header Content-Type text/plain;
}
}
server {
listen 0.0.0.0:443 ssl;
listen [::]:443 ssl;
server_name reitti.domain.tld;
access_log /var/log/nginx/access.log combined;
error_log /var/log/nginx/error.log;
location / {
proxy_pass http://reitti;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
}
location /events {
proxy_pass http://reitti/events;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
# reitti uses Server-Send-Events (SSE), which utilises long-running http connections
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_connect_timeout 60s;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header Referrer-Policy "no-referrer, strict-origin-when-cross-origin";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
ssl_protocols TLSv1.2 TLSv1.3;
# EECDH+AESGCM is a weaker cipher, but we need it for Android 5.0 / 6.0 support.
ssl_ciphers "EECDH+AESGCM+SHA384:EECDH+AESGCM";
#ssl_ciphers "EECDH+AESGCM+SHA384";
ssl_prefer_server_ciphers on;
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 127.0.0.1 valid=300s;
resolver_timeout 5s;
# openssl dhparam -out /etc/ssl/dhparam.pem 4096
ssl_dhparam /etc/ssl/dhparam.pem;
ssl_certificate /etc/letsencrypt/live/reitti.domain.tld/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/reitti.domain.tld/privkey.pem;
}
}
# vi:syntax=nginx
|