Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updated deploy preview workflow and docker files accordingly (test Nginx config) #4045

Open
wants to merge 8 commits into
base: staging
Choose a base branch
from
+69 −1
Open

updated deploy preview workflow and docker files accordingly (test Nginx config) #4045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8b99e73
updated deploypreview workflow and docker files accordingly
OchiengPaul442 Dec 11, 2024
e870447
updated the configurations to run one docker file
OchiengPaul442 Dec 11, 2024
f68fde6
update
OchiengPaul442 Dec 11, 2024
743f2e1
UP
OchiengPaul442 Dec 11, 2024
91d2ba6
UP
OchiengPaul442 Dec 11, 2024
c05f399
UPDATE
OchiengPaul442 Dec 11, 2024
e506d04
UPDATES
OchiengPaul442 Dec 11, 2024
19dd69c
update
OchiengPaul442 Dec 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/deploy-previews.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1222,4 +1222,4 @@ jobs:
owner: context.repo.owner,
repo: context.repo.repo,
body: 'website changes in this PR available for preview [here](${{ needs.website.outputs.url }})'
})
})
51 changes: 51 additions & 0 deletions src/website/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
user nginx;
worker_processes auto;
pid /var/run/nginx.pid;

events {
worker_connections 1024;
}

http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;

include /etc/nginx/mime.types;
default_type application/octet-stream;

access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;

# Set client body size limit to 10MB
client_max_body_size 10M;

upstream django_app {
# Gunicorn is running on 127.0.0.1:8000 inside the container
server 127.0.0.1:8000;
}

server {
listen ${PORT};
server_name _;

# Serve static files
location /static/ {
alias /usr/share/nginx/html/static/;
expires 1y;
access_log off;
add_header Cache-Control "public";
}

# Proxy all other requests to Gunicorn
location / {
proxy_pass http://django_app;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
Comment on lines +43 to +49
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Add security headers and rate limiting

The proxy configuration looks good, but missing important security headers and rate limiting.

Add these security enhancements:

# Add before the location blocks
limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;

# Add inside the location / block
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
limit_req zone=one burst=5 nodelay;

}
}
17 changes: 17 additions & 0 deletions src/website/supervisord.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
[supervisord]
nodaemon=true

[program:gunicorn]
command=gunicorn core.wsgi:application --bind 127.0.0.1:8000 --timeout 600 --workers 3 --log-level info
directory=/app
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/gunicorn.log
stderr_logfile=/var/log/supervisor/gunicorn_err.log

[program:nginx]
command=/usr/sbin/nginx -g "daemon off;"
autostart=true
autorestart=true
stdout_logfile=/var/log/supervisor/nginx.log
stderr_logfile=/var/log/supervisor/nginx_err.log
Loading