aurweb/docker/config/nginx.conf

daemon off;
user root;
worker_processes auto;
pid /var/run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 256;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 4096;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    access_log /dev/stdout;
    error_log /dev/stderr;

    gzip on;

    upstream asgi_backend {
        server fastapi:8000;
    }

    upstream cgit-php {
        server cgit-php:3000;
    }

    upstream cgit-fastapi {
        server cgit-fastapi:3000;
    }

    upstream smartgit {
        server unix:/var/run/smartgit/smartgit.sock;
    }

    server {
        listen 8443 ssl http2;
        server_name localhost default_server;

        ssl_certificate /etc/ssl/certs/web.cert.pem;
        ssl_certificate_key /etc/ssl/private/web.key.pem;

        root /aurweb/web/html;
        index index.php;

        location ~ "^/([a-z0-9][a-z0-9.+_-]*?)(\.git)?/(git-(receive|upload)-pack|HEAD|info/refs|objects/(info/(http-)?alternates|packs)|[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(pack|idx))$" {
            include      uwsgi_params;
            uwsgi_pass   smartgit;
            uwsgi_modifier1 9;
            uwsgi_param  SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
            uwsgi_param  PATH_INFO /aur.git/$3;
            uwsgi_param  GIT_HTTP_EXPORT_ALL "";
            uwsgi_param  GIT_NAMESPACE $1;
            uwsgi_param  GIT_PROJECT_ROOT /aurweb;
        }

        location ~ ^/cgit {
            include uwsgi_params;
            rewrite ^/cgit/([^?/]+/[^?]*)?(?:\?(.*))?$ /cgit.cgi?url=$1&$2 last;
            uwsgi_modifier1 9;
            uwsgi_param CGIT_CONFIG /etc/cgitrc;
            uwsgi_pass uwsgi://cgit-php;
        }

        location ~ ^/[^/]+\.php($|/) {
            fastcgi_pass   php-fpm:9000;
            fastcgi_index  index.php;
            fastcgi_split_path_info ^(/[^/]+\.php)(/.*)$;
            fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
            fastcgi_param  PATH_INFO        $fastcgi_path_info;
            include        fastcgi_params;
        }

        location ~ .+\.(css|js?|jpe?g|png|svg|ico)/?$ {
            try_files $uri =404;
        }

        location ~ .* {
            rewrite ^/(.*)$ /index.php/$1 last;
        }

    }

    server {
        listen 8444 ssl http2;
        server_name localhost default_server;

        ssl_certificate /etc/ssl/certs/web.cert.pem;
        ssl_certificate_key /etc/ssl/private/web.key.pem;

        location ~ ^/[^\/]+\.gz$ {
            # Override mime type to text/plain.
            types { text/plain gz; }
            default_type text/plain;

            # Filesystem location of .gz archives.
            root /var/lib/aurweb/archives;

            # When we match this block, fix-up trying without a trailing slash.
            try_files $uri $uri/ =404;

            # Caching headers.
            expires    max;
            add_header Content-Encoding gzip;
            add_header Cache-Control public;
            add_header Last-Modified "";
            add_header ETag "";
        }

        location ~ "^/([a-z0-9][a-z0-9.+_-]*?)(\.git)?/(git-(receive|upload)-pack|HEAD|info/refs|objects/(info/(http-)?alternates|packs)|[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(pack|idx))$" {
            include      uwsgi_params;
            uwsgi_pass   smartgit;
            uwsgi_modifier1 9;
            uwsgi_param  SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
            uwsgi_param  PATH_INFO /aur.git/$3;
            uwsgi_param  GIT_HTTP_EXPORT_ALL "";
            uwsgi_param  GIT_NAMESPACE $1;
            uwsgi_param  GIT_PROJECT_ROOT /aurweb;
        }

        location ~ ^/cgit {
            include uwsgi_params;
            rewrite ^/cgit/([^?/]+/[^?]*)?(?:\?(.*))?$ /cgit.cgi?url=$1&$2 last;
            uwsgi_modifier1 9;
            uwsgi_param CGIT_CONFIG /etc/cgitrc;
            uwsgi_pass uwsgi://cgit-fastapi;
        }

        location / {
            proxy_pass http://asgi_backend;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Protocol ssl;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-Ssl on;
        }
    }

    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }
}