nginx.conf

# based-off /var/www/discourse/conf/nginx.sample.conf

# Additional MIME types that you'd like nginx to handle go in here
types {
    text/csv csv;
}

upstream discourse {
  server app:3000;
}

# inactive means we keep stuff around for 1440m minutes regardless of last access (1 week)
# levels means it is a 2 deep heirarchy cause we can have lots of files
# max_size limits the size of the cache
proxy_cache_path /var/cache/nginx inactive=1440m levels=1:2 keys_zone=one:10m max_size=600m;

# see: https://meta.discourse.org/t/x/74060
proxy_buffer_size 8k;

# attempt to preserve the proto, must be in http context
map $http_x_forwarded_proto $thescheme {
  default $scheme;
  https https;
}

log_format log_discourse '[$time_local] "$http_host" $remote_addr "$request" "$http_user_agent" "$sent_http_x_discourse_route" $status $bytes_sent "$http_referer" $upstream_response_time $request_time "$sent_http_x_discourse_username"';

server {

  access_log stderr log_discourse;
  error_log stderr info;

  listen 80 default_server;

  gzip on;
  gzip_vary on;
  gzip_min_length 1000;
  gzip_comp_level 5;
  gzip_types application/json text/css text/javascript application/x-javascript application/javascript image/svg+xml;
  gzip_proxied any;

  # Uncomment and configure this section for HTTPS support
  # NOTE: Put your ssl cert in your main nginx config directory (/etc/nginx)
  #
  # rewrite ^/(.*) https://enter.your.web.hostname.here/$1 permanent;
  #
  # listen 443 ssl;
  # ssl_certificate your-hostname-cert.pem;
  # ssl_certificate_key your-hostname-cert.key;
  # ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  # ssl_ciphers HIGH:!aNULL:!MD5;
  #

  server_name _;
  server_tokens off;

  sendfile on;

  keepalive_timeout 65;

  # maximum file upload size (keep up to date when changing the corresponding site setting)
  client_max_body_size 10m;

  # without weak etags we get zero benefit from etags on dynamically compressed content
  # further more etags are based on the file in nginx not sha of data
  # use dates, it solves the problem fine even cross server
  etag off;

  # prevent direct download of backups
  location ^~ /forum/backups/ {
    internal;
  }

  # bypass rails stack with a cheap 204 for favicon.ico requests
  location /forum/favicon.ico {
    return 204;
    access_log off;
    log_not_found off;
  }
 
  # only serve "relative_url_root"
  absolute_redirect off;
  location = / {
    rewrite ^/$ /forum/ redirect;
  }

  location /forum/ {
    add_header ETag "";
    
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Request-Start "t=${msec}";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $thescheme;

    # auth_basic on;
    # auth_basic_user_file /etc/nginx/htpasswd;

    location ~* (assets|plugins|uploads)/.*\.(eot|ttf|woff|woff2|ico)$ {
      expires 1y;
      add_header Cache-Control public,immutable;
      add_header Access-Control-Allow-Origin *;
      
      proxy_pass http://discourse;
      break;
    }

    location = /forum/srv/status {
      access_log off;
      log_not_found off;
      
      proxy_pass http://discourse;
      break;
    }

    # some minimal caching here so we don't keep asking
    # longer term we should increas probably to 1y
    location ~ ^/forum/javascripts/ {
      expires 1d;
      add_header Cache-Control public,immutable;
      
      proxy_pass http://discourse;
      break;
    }

    location ~ ^/forum/assets/(?<asset_path>.+)$ {
      expires 1y;
      # asset pipeline enables this
      brotli_static on;
      gzip_static on;
      add_header Cache-Control public,immutable;
      # HOOK in asset location (used for extensibility)
      # TODO I don't think this break is needed, it just breaks out of rewrite
      
      proxy_pass http://discourse;
      break;
    }

    location ~ ^/forum/plugins/ {
      expires 1y;
      add_header Cache-Control public,immutable;
      proxy_pass http://discourse;
      break;
    }

    # cache emojis
    location ~ /images/emoji/ {
      expires 1y;
      add_header Cache-Control public,immutable;
      proxy_pass http://discourse;
      break;
    }

    location ~ ^/forum/uploads/ {

      #proxy_set_header X-Sendfile-Type X-Accel-Redirect;
      #proxy_set_header X-Accel-Mapping $public/=/downloads/;
      expires 1y;
      add_header Cache-Control public,immutable;

      ## optional upload anti-hotlinking rules
      #valid_referers none blocked mysite.com *.mysite.com;
      #if ($invalid_referer) { return 403; }

      proxy_pass http://discourse;
      break;
    }

    location ~ ^/forum/admin/backups/ {
      #proxy_set_header X-Sendfile-Type X-Accel-Redirect;
      #proxy_set_header X-Accel-Mapping $public/=/downloads/;
      
      proxy_pass http://discourse;
      break;
    }

    # This big block is needed so we can selectively enable
    # acceleration for backups, avatars, sprites and so on.
    # see note about repetition above
    location ~ ^/forum/(svg-sprite/|letter_avatar/|letter_avatar_proxy/|user_avatar|highlight-js|stylesheets|theme-javascripts|favicon/proxied|service-worker) {

      # strip ports from some URLS
      rewrite /forum/(svg-sprite|user_avatar)/([^/]+):[0-9]+/(.*) /forum/$1/$2/$3;

      # if Set-Cookie is in the response nothing gets cached
      # this is double bad cause we are not passing last modified in
      proxy_ignore_headers "Set-Cookie";
      proxy_hide_header "Set-Cookie";
      proxy_hide_header "X-Discourse-Username";
      proxy_hide_header "X-Runtime";

      # note x-accel-redirect can not be used with proxy_cache
      proxy_cache one;
      proxy_cache_key "$scheme,$host,$request_uri";
      proxy_cache_valid 200 301 302 7d;
      proxy_cache_valid any 1m;

      proxy_pass http://discourse;
      break;
    }

    # we need buffering off for message bus
    location /forum/message-bus/ {
      proxy_set_header X-Request-Start "t=${msec}";
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $thescheme;
      proxy_http_version 1.1;
      proxy_buffering off;
      
      proxy_pass http://discourse;
      break;
    }

    proxy_pass http://discourse;
  }

  #location /forum/downloads/ {
  #  internal;
  #  alias $public/;
  #}

}