File size: 1,773 Bytes
be56d87 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 |
events {
worker_connections 1024;
}
http {
# Basic security settings
server_tokens off; # Don't show nginx version
client_max_body_size 10M; # Limit request size
client_body_timeout 12;
client_header_timeout 12;
upstream gradio_app {
server llmdataparser:7860;
keepalive 32;
}
server {
listen 80;
server_name localhost;
# Enhanced security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-always" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
location / {
proxy_pass http://gradio_app;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# WebSocket support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Timeouts
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
# Security
proxy_buffering on;
proxy_buffer_size 8k;
proxy_buffers 8 8k;
}
# Deny access to hidden files
location ~ /\. {
deny all;
return 404;
}
}
}
|