Nginx Reverse Proxy

1# /etc/nginx/sites-available/api.usher.dev
2
3# Upstream — définir les serveurs backend
4upstream usher_api {
5  server 127.0.0.1:3000;
6  # Pour du load balancing :
7  # server 127.0.0.1:3001;
8  # server 127.0.0.1:3002;
9  keepalive 32;
10}
11
12# HTTP → redirection HTTPS
13server {
14  listen 80;
15  listen [::]:80;
16  server_name api.usher.dev;
17
18  location /.well-known/acme-challenge/ {
19    root /var/www/certbot;
20  }
21
22  location / {
23    return 301 https://$host$request_uri;
24  }
25}
26
27# HTTPS — serveur principal
28server {
29  listen 443 ssl http2;
30  listen [::]:443 ssl http2;
31  server_name api.usher.dev;
32
33  # Certificats SSL (générés par Certbot)
34  ssl_certificate     /etc/letsencrypt/live/api.usher.dev/fullchain.pem;
35  ssl_certificate_key /etc/letsencrypt/live/api.usher.dev/privkey.pem;
36  include             /etc/letsencrypt/options-ssl-nginx.conf;
37  ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;
38
39  # Headers de sécurité
40  add_header X-Frame-Options "DENY" always;
41  add_header X-Content-Type-Options "nosniff" always;
42  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
43
44  # Logs
45  access_log /var/log/nginx/api.usher.dev.access.log;
46  error_log  /var/log/nginx/api.usher.dev.error.log;
47
48  # Reverse proxy vers l'API Node.js
49  location / {
50    proxy_pass http://usher_api;
51    proxy_http_version 1.1;
52
53    proxy_set_header Upgrade $http_upgrade;
54    proxy_set_header Connection 'upgrade';   # WebSocket support
55    proxy_set_header Host $host;
56    proxy_set_header X-Real-IP $remote_addr;
57    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
58    proxy_set_header X-Forwarded-Proto $scheme;
59
60    proxy_cache_bypass $http_upgrade;
61
62    # Timeouts
63    proxy_connect_timeout 60s;
64    proxy_read_timeout    60s;
65    proxy_send_timeout    60s;
66  }
67
68  # Servir les fichiers statiques directement (sans passer par Node)
69  location /static/ {
70    alias /app/usher-api/public/;
71    expires 30d;
72    add_header Cache-Control "public, immutable";
73  }
74}