nginx.conf

# Nginx configuration for GNU Mailman 3 for COmanage Registry Dockerfile
#
# Portions licensed to the University Corporation for Advanced Internet
# Development, Inc. ("UCAID") under one or more contributor license agreements.
# See the NOTICE file distributed with this work for additional information
# regarding copyright ownership.
#
# UCAID licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with the
# License. You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

user  www-data;
worker_processes  1;
include /etc/nginx/modules-enabled/*.conf;

error_log  /var/log/nginx/error.log info;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;

    upstream mailman-core {
        # The name of the server is 'mailman-core' and matches the name
        # of the service in the compose file.
        server mailman-core:8001 fail_timeout=0;
    }

    upstream mailman-web {
        # The name of the server is 'mailman-core' and matches the name
        # of the service in the compose file.
        server mailman-web:8000 fail_timeout=0;
    }

    server {
        listen 80;
        server_name %%SERVER_NAME%%;
        return 301 https://$server_name$request_uri;
    }

    server {
        listen                    443 ssl;
        server_name               %%SERVER_NAME%%;
        ssl_certificate           /etc/nginx/https.crt;
        ssl_certificate_key       /etc/nginx/https.key;
        ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        ssl_ciphers               AES256+EECDH:AES256+EDH:!aNULL;
        ssl_dhparam               /etc/nginx/dhparam.pem;
        ssl_session_cache         shared:SSL:10m;
        ssl_session_timeout       24h;
        ssl_buffer_size           1400;
        ssl_session_tickets       off;
        ssl_stapling              on;
        ssl_stapling_verify       on;
        resolver                  8.8.4.4 8.8.8.8 valid=300s;
        resolver_timeout          10s;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        location /api/ {
            proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header       X-Forwarded-Proto https;
            proxy_set_header       Host $http_host;
            proxy_redirect         off;
            proxy_pass             http://mailman-core/;
            proxy_intercept_errors on;

            subs_filter_types application/json;
            subs_filter '"self_link": "http://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:8001' '"self_link": "https://$host/api' [r];
        }

        location /static/ {
            alias /opt/mailman-web-data/static/;
        }

        location / {
            include uwsgi_params;
            proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header       X-Forwarded-Proto https;
            proxy_set_header       Host $http_host;
            proxy_redirect         off;
            proxy_pass             http://mailman-web;
        }

    }
}