nginx.conf

access_log /var/www/snapfile/logs/nginx_access.log;
error_log /var/www/snapfile/logs/nginx_err.log;

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

upstream backend {
    server localhost:8080;
}

server {
    listen       80;
    listen       [::]:80;
    server_name snapfile.yanxurui.cc; # works for both snapfile.yanxurui.cc and www.snapfile.yanxurui.cc
    return 301 https://$host$request_uri;
}

server {
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    server_name snapfile.yanxurui.cc;

    client_max_body_size 1024m;
    client_body_buffer_size 1m;
    limit_req zone=mylimit burst=5 nodelay;

    # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;
    
    root /var/www/snapfile/static;

    ssl_certificate /etc/letsencrypt/live/snapfile.yanxurui.cc/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/snapfile.yanxurui.cc/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    
    # serve static files
    # internal redirect from / to /index.html
    location / {
    }

    # restricted to only logged users
    location = /index.html {
        auth_request /auth;
        # tell client to redirect on 401
        # it's also possible to construct the redirect URL manually
        error_page 401 = @login_required;
    }
    location @login_required {
        return 302 /login.html;
    }

    # APIs handled by python backend
    location ~ ^/(signup|login|logout|auth|files)$ {
        proxy_pass http://backend;

        # do not save to the temp file when uploading
        proxy_request_buffering off;

        # support chunked transfer encoding
        # otherwise the request body will be buffered
        proxy_http_version 1.1;

        # do not buffer when downloading files from upstream
        proxy_buffering off;
    }

    # websocket proxy
    location /ws {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_read_timeout 3600s;
    }

    # handle requests redirected by the "X-Accel-Redirect" response header field from an upstream server;
    location /download {
        internal;
        alias /var/www/snapfile/files;
    }

    error_page 404 /404.html;
        location = /40x.html {
    }

    error_page 500 502 503 504 /50x.html;
        location = /50x.html {
    }
}