1
map $http_upgrade $connection_upgrade {
2
  default upgrade;
3
  ''      close;
4
}
5

6
server {
7
  listen 80;
8
  listen [::]:80;
9
  server_name example.com;
10
  root /home/mastodon/live/public;
11
  # Useful for Let's Encrypt
12
  location /.well-known/acme-challenge/ { allow all; }
13
  location / { return 301 https://$host$request_uri; }
14
}
15

16
server {
17
  listen 443 ssl http2;
18
  listen [::]:443 ssl http2;
19
  server_name example.com;
20

21
  ssl_protocols TLSv1.2;
22
  ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA;
23
  ssl_prefer_server_ciphers on;
24
  ssl_session_cache shared:SSL:10m;
25

26
  ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
27
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
28

29
  keepalive_timeout    70;
30
  sendfile             on;
31
  client_max_body_size 8m;
32

33
  root /home/mastodon/live/public;
34

35
  gzip on;
36
  gzip_disable "msie6";
37
  gzip_vary on;
38
  gzip_proxied any;
39
  gzip_comp_level 6;
40
  gzip_buffers 16 8k;
41
  gzip_http_version 1.1;
42
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
43

44
  add_header Strict-Transport-Security "max-age=31536000";
45

46
  location / {
47
    try_files $uri @proxy;
48
  }
49

50
  location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
51
    add_header Cache-Control "public, max-age=31536000, immutable";
52
    try_files $uri @proxy;
53
  }
54

55
  location /sw.js {
56
    add_header Cache-Control "public, max-age=0";
57
    try_files $uri @proxy;
58
  }
59

60
  location @proxy {
61
    proxy_set_header Host $host;
62
    proxy_set_header X-Real-IP $remote_addr;
63
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
64
    proxy_set_header X-Forwarded-Proto https;
65
    proxy_set_header Proxy "";
66
    proxy_pass_header Server;
67

68
    proxy_pass http://127.0.0.1:3000;
69
    proxy_buffering off;
70
    proxy_redirect off;
71
    proxy_http_version 1.1;
72
    proxy_set_header Upgrade $http_upgrade;
73
    proxy_set_header Connection $connection_upgrade;
74

75
    tcp_nodelay on;
76
  }
77

78
  location /api/v1/streaming {
79
    proxy_set_header Host $host;
80
    proxy_set_header X-Real-IP $remote_addr;
81
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
82
    proxy_set_header X-Forwarded-Proto https;
83
    proxy_set_header Proxy "";
84

85
    proxy_pass http://127.0.0.1:4000;
86
    proxy_buffering off;
87
    proxy_redirect off;
88
    proxy_http_version 1.1;
89
    proxy_set_header Upgrade $http_upgrade;
90
    proxy_set_header Connection $connection_upgrade;
91

92
    tcp_nodelay on;
93
  }
94

95
  error_page 500 501 502 503 504 /500.html;
96
}