ai-autoedit/nginx.conf at main · pawkor/ai-autoedit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
user root;
worker_processes 4;
events { worker_connections 1024; }

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    tcp_nopush      on;
    keepalive_timeout 65;
    gzip on;
    gzip_types text/plain text/css application/json application/javascript;

    # WebSocket upgrade map
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      '';
    }

    # Upstream uvicorn
    upstream app {
        server autoframe:8000;
        keepalive 32;
    }

    server {
        listen 443 ssl;
        http2 on;

        ssl_certificate     /etc/nginx/certs/cert.pem;
        ssl_certificate_key /etc/nginx/certs/key.pem;
        ssl_protocols       TLSv1.2 TLSv1.3;
        ssl_ciphers         HIGH:!aNULL:!MD5;
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_buffer_size     64k;

        location ^~ /js/ {
            root /app/webapp/static;
            include /etc/nginx/mime.types;
            add_header Cache-Control "no-cache, must-revalidate";
        }

        location ^~ /css/ {
            root /app/webapp/static;
            include /etc/nginx/mime.types;
            add_header Cache-Control "no-cache, must-revalidate";
        }

        # Fonts: long cache (content never changes)
        location ~* \.(woff2?)$ {
            proxy_pass http://app;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";
            add_header Cache-Control "public, max-age=604800";
        }

        # Serve extracted frames directly from disk (no Python involved)
        location ~* /_autoframe/frames/[^/]+\.jpg$ {
            root /;
            add_header Cache-Control "public, max-age=604800";
        }

        # Serve result/source video files directly from /data (sendfile, native range requests)
        location ~* ^/data/.*\.(mp4|mov|webm|m4v|mkv)$ {
            root /;
            add_header Cache-Control "public, max-age=86400";
            add_header Accept-Ranges bytes;
            tcp_nodelay on;
            send_timeout 300s;
        }

        location / {
            proxy_pass http://app;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            add_header Cache-Control "no-cache, must-revalidate";
        }
    }

    # Port 80: metrics-only for Prometheus scraping (all other paths → 404)
    server {
        listen 80;
        location = /metrics {
            proxy_pass http://app/metrics;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header Connection "";
        }
        location / {
            return 404;
        }
    }
}