service/nginx/http.conf

# read more here http://tautt.com/best-nginx-configuration-for-security/

# config to don't allow the browser to render the page inside an frame or iframe
# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
#add_header X-Frame-Options SAMEORIGIN;

# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
# to disable content-type sniffing on some browsers.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
#add_header X-Content-Type-Options nosniff;

# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
# this particular website if it was disabled by the user.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
#add_header X-XSS-Protection "1; mode=block";

# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
# you can tell the browser that it can only download content from the domains you explicitly allow
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
# https://www.owasp.org/index.php/Content_Security_Policy
# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
# directives for css and js(if you have inline css or js, you will need to keep it too).
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
#add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analytics.com https://s-static.ak.facebook.com https://assets.zendesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://assets.zendesk.com; font-src 'self' https://themes.googleusercontent.com; frame-src https://assets.zendesk.com https://www.facebook.com https://s-static.ak.facebook.com https://tautt.zendesk.com; object-src 'none'";

## rate limiter for certain pages to prevent brute force attacks
limit_req_zone  $binary_remote_addr  zone=http_req_limit:10m   rate=1r/s;

## custom log format
log_format http_log_custom '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time $upstream_response_time $pipe';

log_format json_log_custom escape=json
  '{'
    '"source":"nginx",'
    '"remote_user":"$remote_user",'
    '"time_local":"$time_local",'
    '"remote_addr":"$remote_addr",'
    '"proxy_x_forwarded_for":"$proxy_add_x_forwarded_for",'
    '"request":"$request",'
    '"status": "$status",'
    '"request_method": "$request_method",'
    '"body_bytes_sent":"$body_bytes_sent",'
    '"request_time":"$request_time",'
    '"upstream_response_time":"$upstream_response_time",'
    '"http_referrer":"$http_referer",'
    '"http_user_agent":"$http_user_agent"'
  '}';


server {
  listen 80 default;
  # ensure we get the proper Docker DNS resolver for load balancing.
  resolver 127.0.0.11 ipv6=off;
  server_name localhost 127.0.0.1;
  access_log      /var/log/rhodecode/nginx/rhodecode.http.access.log json_log_custom;
  error_log       /var/log/rhodecode/nginx/rhodecode.http.error.log;

  # uncomment to redirect http traffic to https
  #return 301 https://$host$request_uri;

  client_body_buffer_size     128k;
  # maximum number and size of buffers for large headers to read from client request
  large_client_header_buffers 16 256k;

  ## serve static files by nginx, recommended
  location /_static/rhodecode {
      gzip on;
      gzip_min_length  500;
      gzip_proxied     any;
      gzip_comp_level 4;
      gzip_types  text/css text/javascript text/xml text/plain text/x-component application/javascript application/json application/xml application/rss+xml font/truetype font/opentype application/vnd.ms-fontobject image/svg+xml;
      gzip_vary on;
      gzip_disable     "msie6";
      expires 60d;

      alias /var/opt/rhodecode_data/static;
  }

  ## channelstream location handler, if channelstream live chat and notifications
  ## are enable this will proxy the requests to channelstream websocket server
  location /_channelstream {
      rewrite /_channelstream/(.*) /$1 break;
      gzip                         off;
      tcp_nodelay                  off;

      proxy_connect_timeout        10;
      proxy_send_timeout           10m;
      proxy_read_timeout           10m;

      proxy_set_header             Host $host;
      proxy_set_header             X-Real-IP $remote_addr;
      proxy_set_header             X-Url-Scheme $scheme;
      proxy_set_header             X-Forwarded-Proto $scheme;
      proxy_set_header             X-Forwarded-For $proxy_add_x_forwarded_for;

      proxy_http_version           1.1;
      proxy_set_header Upgrade     $http_upgrade;
      proxy_set_header Connection  "upgrade";

      proxy_pass                   http://channelstream:9800;
  }

  ## rate limit this endpoint to prevent login page brute-force attacks
  location /_admin/login {
      limit_req  zone=http_req_limit  burst=10  nodelay;
      try_files $uri @rhodecode_http;
  }

  location / {
      include     /etc/nginx/proxy.conf;
      try_files $uri @rhodecode_http;
  }

  location @rhodecode_http {
      include     /etc/nginx/proxy.conf;
      proxy_pass  http://rhodecode:10020;
  }

  ## Custom 502 error page.
  ## Will be displayed while RhodeCode server is turned off
  error_page 502 /502.html;
  location = /502.html {
      root /var/opt/static;
  }

}