48 lines
1.5 KiB
Nginx Configuration File
48 lines
1.5 KiB
Nginx Configuration File
# Companion status UI, served from inside the qortal container.
|
|
#
|
|
# Runs as the image's uid 1000 on a read-only root: every writable path is
|
|
# under the /tmp tmpfs. Published on 127.0.0.1:12390 only; the app gate
|
|
# fronts and authenticates it (manifest: auth: gated).
|
|
worker_processes 1;
|
|
pid /tmp/nginx/nginx.pid;
|
|
error_log stderr warn;
|
|
|
|
events { worker_connections 64; }
|
|
|
|
http {
|
|
include /etc/nginx/mime.types;
|
|
default_type application/octet-stream;
|
|
access_log off;
|
|
server_tokens off;
|
|
|
|
client_body_temp_path /tmp/nginx/body;
|
|
proxy_temp_path /tmp/nginx/proxy;
|
|
fastcgi_temp_path /tmp/nginx/fastcgi;
|
|
uwsgi_temp_path /tmp/nginx/uwsgi;
|
|
scgi_temp_path /tmp/nginx/scgi;
|
|
|
|
server {
|
|
listen 12390;
|
|
listen [::]:12390;
|
|
root /usr/share/qortal-ui;
|
|
|
|
# Read-only window onto Core's public API, limited to exactly what the
|
|
# page renders. Nothing here carries the API key, so even a wider
|
|
# list could not reach a key-guarded route.
|
|
location ~ ^/core/(admin/status|admin/info|peers|blocks/height)$ {
|
|
limit_except GET { deny all; }
|
|
proxy_pass http://127.0.0.1:12391/$1;
|
|
proxy_set_header X-API-KEY "";
|
|
proxy_connect_timeout 3s;
|
|
proxy_read_timeout 15s;
|
|
add_header Cache-Control "no-store" always;
|
|
}
|
|
location /core/ { return 404; }
|
|
|
|
location / {
|
|
add_header Cache-Control "no-cache";
|
|
try_files $uri /index.html;
|
|
}
|
|
}
|
|
}
|