122 lines
4.2 KiB
Plaintext
122 lines
4.2 KiB
Plaintext
# djmaster HTTP-only Nginx template
|
|
# Use this when another front-facing proxy/terminator handles TLS and you want
|
|
# Nginx to listen on port 80 (cleartext) and proxy to local backends.
|
|
|
|
# Map for websocket upgrade handling
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name ${UI_HOST};
|
|
|
|
client_max_body_size 512M;
|
|
client_body_timeout 300s;
|
|
keepalive_timeout 65;
|
|
|
|
# Frontend (UI) — proxy to your UI backend (webpack dev or static server)
|
|
# Set UI_BACKEND_HOST to 192.168.1.15 (or 127.0.0.1) when rendering
|
|
location / {
|
|
proxy_pass http://${UI_BACKEND_HOST}:3000;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-Port $server_port;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 120s;
|
|
}
|
|
|
|
# WebSocket endpoint (HMR / app ws) — ensure upgrades are forwarded
|
|
location /ws {
|
|
proxy_pass http://${UI_BACKEND_HOST}:3000;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_read_timeout 3600s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# Microserver for OAuth and config persistence
|
|
location /fb-server/ {
|
|
proxy_pass http://${MICROSERVER_HOST}:3002/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 120s;
|
|
}
|
|
|
|
# WHIP Ingest API and WHEP relay (egress). If your egress listens elsewhere,
|
|
# adjust ${WHIP_HOST} and ports accordingly.
|
|
location /api/whip/ {
|
|
proxy_pass http://${WHIP_HOST}:3005/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
location /whep/ {
|
|
proxy_pass http://${WHIP_HOST}:3005/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
# WHIP ingest (POST with SDP) — forward to livekit-ingress/internal target
|
|
location /w/ {
|
|
proxy_pass http://${LIVEKIT_INGRESS_HOST}/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
# yt-dlp stream extractor and metadata proxies
|
|
location /yt-stream/ {
|
|
proxy_pass http://${YTDLP_HOST}/;
|
|
proxy_set_header Host ${YTDLP_HOST};
|
|
proxy_http_version 1.1;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 300s;
|
|
}
|
|
|
|
location /yt-titles/ {
|
|
proxy_pass http://${YTDLP_TITLES_HOST}/;
|
|
proxy_set_header Host ${YTDLP_TITLES_HOST};
|
|
proxy_http_version 1.1;
|
|
proxy_buffering off;
|
|
proxy_read_timeout 120s;
|
|
}
|
|
|
|
# Basic security headers
|
|
add_header X-Frame-Options "SAMEORIGIN";
|
|
add_header X-Content-Type-Options "nosniff";
|
|
add_header Referrer-Policy "no-referrer-when-downgrade";
|
|
add_header X-XSS-Protection "1; mode=block";
|
|
}
|