ivanch/ivanch.me
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

new pipeline and build improvements
Some checks failed
Homepage Build and Deploy (Test) / Build Homepage Image (push) Successful in 32s
Details
Homepage Build and Deploy (Test) / Deploy Homepage (push) Failing after 3s
Details

Browse Source
This commit is contained in:
Jose Henrique
2026-07-10 17:06:16 -03:00
parent 9410d3a7c6
commit 72c7d6c9e0
14 changed files with 1969 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
nginx.conf
View File

@@ -1,10 +1,10 @@
user nginx;
worker_processes auto;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
worker_connections 256;
use epoll;
}
@@ -12,22 +12,16 @@ http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log off;
access_log /var/log/nginx/access.log main;
# Performance optimizations
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
keepalive_timeout 15;
keepalive_requests 100;
types_hash_max_size 2048;
client_max_body_size 20M;
client_max_body_size 1m;
# Buffers & Timeouts tuning
client_body_buffer_size 16k;
client_header_buffer_size 1k;
large_client_header_buffers 4 8k;
@@ -35,17 +29,18 @@ http {
client_header_timeout 12s;
send_timeout 10s;
# Open File Cache
open_file_cache max=1000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache max=100 inactive=60s;
open_file_cache_valid 60s;
open_file_cache_min_uses 2;
open_file_cache_errors on;
open_file_cache_errors off;
# Gzip compression
gzip on;
gzip_static on;
gzip_vary on;
gzip_proxied any;
gzip_comp_level 6;
gzip_comp_level 4;
gzip_min_length 256;
gzip_disable "msie6";
gzip_types
text/plain
text/css
@@ -62,10 +57,7 @@ http {
font/woff2
application/vnd.ms-fontobject
application/x-font-ttf;
gzip_min_length 256;
gzip_disable "msie6";
# Security headers (Global default)
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
@@ -73,67 +65,33 @@ http {
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
# HTTP (port 80) Server Block
server {
listen 80;
listen [::]:80;
server_name localhost ivanch.me www.ivanch.me;
root /usr/share/nginx/html;
index index.html;
# Charset
charset utf-8;
# Custom error pages
error_page 404 /404.html;
error_page 500 502 503 504 /50x.html;
# Main location
location / {
try_files $uri $uri/ =404;
}
# Cache static assets & redeclare security headers to bypass Nginx header override gotcha
location ~* \.(jpg|jpeg|png|gif|ico|svg|webp)$ {
expires 1y;
add_header Cache-Control "public, immutable";
location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|webp|woff|woff2|ttf|otf|eot)$ {
add_header Cache-Control "public, max-age=31536000, immutable" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
access_log off;
}
location ~* \.(css|js)$ {
expires 1y;
add_header Cache-Control "public, immutable";
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
access_log off;
}
location ~* \.(woff|woff2|ttf|otf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
access_log off;
}
# HTML files - shorter cache
location ~* \.html$ {
expires 1h;
add_header Cache-Control "public, must-revalidate";
expires off;
add_header Cache-Control "no-cache, must-revalidate" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
@@ -142,19 +100,14 @@ http {
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
}
# Deny access to hidden files
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
# Deny access to backup files
location ~ ~$ {
deny all;
access_log off;
log_not_found off;
}
}
}