ackandClaude Fable 5.1
95c80d04c9
Assembled from the development repository by tools/make_release.sh. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
40 lines
1.7 KiB
Plaintext
40 lines
1.7 KiB
Plaintext
# nginx server block for a Kokkoja web site: the client's files at
|
|
# https://kokkoja.andykopra.com/ and the relay at wss://kokkoja.andykopra.com/relay.
|
|
# Installed by deploy/setup_vps.sh as /etc/nginx/sites-available/kokkoja.
|
|
#
|
|
# This is the plain HTTP form. certbot --nginx -d kokkoja.andykopra.com
|
|
# adds the TLS listener and turns this block into a redirect.
|
|
|
|
server {
|
|
listen 80;
|
|
server_name kokkoja.andykopra.com;
|
|
|
|
root /var/www/kokkoja;
|
|
index index.html;
|
|
|
|
# The relay. The client connects to <relay address>/room/<room id>,
|
|
# so /relay/room/<id> here becomes /room/<id> at the relay.
|
|
location /relay/ {
|
|
proxy_pass http://127.0.0.1:8770/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
# The relay pings every 20 seconds; a quiet lesson must not be cut off.
|
|
proxy_read_timeout 1h;
|
|
proxy_send_timeout 1h;
|
|
}
|
|
|
|
location / {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
# The client is a few small files that change with every deployment:
|
|
# browsers ask whether they have changed rather than keeping old ones.
|
|
add_header Cache-Control "no-cache" always;
|
|
# The client loads nothing from anywhere else, and may not be framed.
|
|
add_header Content-Security-Policy "default-src 'self'; connect-src 'self' wss://kokkoja.andykopra.com; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
}
|