feat: Initial commit

docker/pretix/nginx/nginx.conf

@@ -0,0 +1,85 @@
+user www-data www-data;
+worker_processes auto;
+pid /var/run/nginx.pid;
+daemon off;
+worker_rlimit_nofile 262144;
+
+events {
+    worker_connections 16384;
+    multi_accept on;
+    use epoll;
+}
+
+http {
+        server_tokens off;
+        sendfile on;
+        charset utf-8;
+        tcp_nopush on;
+        tcp_nodelay on;
+
+        log_format private '[$time_local] $host "$request" $status $body_bytes_sent';
+
+        types_hash_max_size 2048;
+        server_names_hash_bucket_size 64;
+
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+        add_header X-Content-Type-Options nosniff;
+
+        access_log /var/log/nginx/access.log private;
+        error_log /var/log/nginx/error.log;
+        add_header Referrer-Policy same-origin;
+
+        gzip on;
+        gzip_disable "msie6";
+        gzip_types text/plain text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+
+        include /etc/nginx/conf.d/*.conf;
+
+    server {
+        listen 80 backlog=4096 default_server;
+        listen [::]:80 ipv6only=on default_server;
+        server_name _;
+
+        index index.php index.html;
+        root /var/www;
+
+        location /media/ {
+            alias /data/media/;
+            expires 7d;
+            access_log off;
+        }
+        location ^~ /media/cachedfiles {
+            deny all;
+            return 404;
+        }
+        location ^~ /media/invoices {
+            deny all;
+            return 404;
+        }
+        location /static/ {
+            alias /pretix/src/pretix/static.dist/;
+            access_log off;
+            expires 365d;
+            add_header Cache-Control "public";
+            add_header Access-Control-Allow-Origin "*";
+            gzip on;
+        }
+        location / {
+            # Very important:
+            #   proxy_pass http://unix:/tmp/pretix.sock:;
+            # is not the same as
+            #   proxy_pass http://unix:/tmp/pretix.sock:/;
+            # In the latter case, nginx will apply its URL parsing, in the former it doesn't.
+            # There are situations in which pretix' API will deal with "file names" containing %2F%2F, which
+            # nginx will normalize to %2F, which can break ticket validation.
+            proxy_pass http://unix:/tmp/pretix.sock:;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header Host $http_host;
+        }
+    }
+}