nginx_epa_aws_ssl_dev.conf

# Nginx config for EPA AWS dev and staging with SSL.

server {
    listen 80;
    
    server_name qedlinux1dev.aws.epa.gov qed.devsecops-dev.aws.epa.gov;
    
    # Removes Nginx version from headers:
    server_tokens off;

    return 301 https://$host$request_uri;
}

# qed.epa.gov django front-end HTTPS/SSL
server {

    listen 443 ssl default_server;

    server_name qedlinux1dev.aws.epa.gov qed.devsecops-dev.aws.epa.gov;

    client_max_body_size 20M;
    client_body_buffer_size 20M;

    # HSTS Policy (max-age=60 == 1 min. 31536000 = 1 year)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Frame-Options "SAMEORIGIN";

    # Self-signed cert and key (container locations):
    ssl_certificate /etc/nginx/qed/qedlinux.pem;
    ssl_certificate_key /etc/nginx/qed/qedlinux.key;

    ssl_session_timeout  5m;

    #disable ssl2 and ssl3 per
    #https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # Diffie-Hellman file:
    ssl_dhparam /etc/nginx/qed/ssl-dhparams.pem;

    # Removes Nginx version from headers:
    server_tokens off;

    location /static_qed/ {
        alias /src/collected_static/;
    }

    location / {
        try_files $uri @uwsgi_django;
    }

    location @uwsgi_django {
        include uwsgi_params;
        uwsgi_pass uwsgi_django:8080;  # 'uwsgi_django' is the hostname given in Docker-Compose YAML 'links' section
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        uwsgi_read_timeout 600s; 
        uwsgi_send_timeout 600s;
	    proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # HSTS Policy (max-age=60 == 1 min), 31536000 = 1 year Unknown if proxy_set_header disables inheritance like add_header
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    }

    # nodejs/socket.io route:
    location /socket.io {
        proxy_pass          http://cts_nodejs:4000;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade $http_upgrade;
        proxy_set_header    Connection 'upgrade';
        proxy_set_header    Host $host;
    }

    # cyan api endpoints:
    location /cyan/app/api {
        include /etc/nginx/uwsgi_params;
        uwsgi_pass uwsgi_flask:5001;
    }

    # Cyanweb static content routing:
    location /cyanweb/assets {
        alias /src/collected_static/epa-cyano-web/assets;
    }
    location /cyanweb/leaflet {
        alias /src/collected_static/epa-cyano-web/leaflet;
    }

    # Proxy for marvinsketch iframe webservice requests:
    location /webservices/rest-v0/util {
        proxy_pass  http://qed-tomcat:8080/webservices/rest-v0/util;
    }

    # Proxy for ctsws endpoint:
    location /ctsws/rest/isvalidchemical {
        proxy_pass http://qed-tomcat:8080/ctsws/rest/isvalidchemical;
    }

    # Cyano API
    location /cyan/cyano {
        proxy_pass http://172.17.0.1:8080/cyan/cyano;  # NOTE: docker host ip (host.docker.internal coming to linux in docker engine v20)
    }
    # Cyano Admintool
    location /admintool {
        proxy_pass http://172.17.0.1:8000;
    }
    # Cyano Admintool Static
    location /static {
        proxy_pass http://172.17.0.1:8000/static; 
    }
    # Cyano Admintool Media
    location /media {
        proxy_pass http://172.17.0.1:8000/media; 
    }

    # Cyan-waterbody API
    location /waterbody {
        proxy_pass http://172.17.0.1:8085/waterbody;
    }

}

# Flask back-end
server {

    listen 7777;

    # HSTS Policy (max-age=60 == 1 min, 31536000 = 1 year)
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        try_files $uri @qed_flask;
    }

    location @qed_flask {
        include uwsgi_params;
        uwsgi_pass qed_flask:8080;  # 'uwsgi_flask' is the hostname given in Docker-Compose YAML 'links' section
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # HSTS Policy (max-age=60 == 1 min 31536000 = 1 year), Unknown if proxy_set_header disables inheritance like add_header
        # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    }
}