argoyleandClaude Opus 5.5
1646ee1bc3
The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se context on the runners). Deploys now go to the Frostmoln production cluster (namespace schemas), the way the sites do. Frostmoln enforces restricted Pod Security: the pod runs as the image's non-root user with a matching securityContext. The prod-only manifests move to the prod-frostmoln target; the ALB ingress becomes a Traefik one with a Let's Encrypt certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
72 lines
2.0 KiB
Nginx Configuration File
72 lines
2.0 KiB
Nginx Configuration File
worker_processes auto;
|
|
|
|
error_log /var/log/nginx/error.log notice;
|
|
pid /tmp/nginx.pid;
|
|
|
|
events {
|
|
worker_connections 1024;
|
|
}
|
|
|
|
http {
|
|
# Writable by the unprivileged (uid 101) worker.
|
|
client_body_temp_path /tmp/client_temp;
|
|
proxy_temp_path /tmp/proxy_temp_path;
|
|
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
scgi_temp_path /tmp/scgi_temp;
|
|
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
types {
|
|
application/manifest+json webmanifest;
|
|
}
|
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
|
'$status $body_bytes_sent "$http_referer" '
|
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
|
|
|
sendfile on;
|
|
keepalive_timeout 65;
|
|
|
|
server {
|
|
listen 8080;
|
|
server_name localhost;
|
|
root /usr/share/nginx/html;
|
|
index index.html index.htm;
|
|
access_log off;
|
|
|
|
# Security headers
|
|
include /etc/nginx/security_headers.conf;
|
|
|
|
# Health check endpoint for Kubernetes
|
|
location = /health {
|
|
return 200 '{"status":"UP"}';
|
|
}
|
|
|
|
# all assets contain hash in filename, cache forever
|
|
location ^~ /assets/ {
|
|
include /etc/nginx/security_headers.conf;
|
|
add_header Cache-Control "public, max-age=31536000, s-maxage=31536000, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
# Nuxt generated files
|
|
location /_nuxt/ {
|
|
access_log /var/log/nginx/access.log main;
|
|
include /etc/nginx/security_headers.conf;
|
|
autoindex off;
|
|
expires off;
|
|
add_header Cache-Control "public, max-age=31536000, s-maxage=31536000, immutable";
|
|
}
|
|
|
|
# Main application - SPA mode
|
|
location / {
|
|
access_log /var/log/nginx/access.log main;
|
|
include /etc/nginx/security_headers.conf;
|
|
autoindex off;
|
|
expires off;
|
|
add_header Cache-Control "public, max-age=0, s-maxage=0, must-revalidate" always;
|
|
try_files $uri $uri/ /index.html =404;
|
|
}
|
|
}
|
|
}
|