budibase/hosting/letsencrypt/nginx-ssl.conf

server {
    listen       443 ssl default_server;
    listen  [::]:443 ssl default_server;
    server_name  _;
    error_log            /dev/stderr warn;
    access_log           /dev/stdout main;
    client_max_body_size 1000m;
    ignore_invalid_headers off;
    proxy_buffering off;
    # port_in_redirect off;

    ssl_certificate /etc/letsencrypt/live/CUSTOM_DOMAIN/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/CUSTOM_DOMAIN/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root         /var/www/html;
        break;
    }
    location = /.well-known/acme-challenge/ {
        return 404;
    }

    location /app {
        proxy_pass      http://127.0.0.1:4001;
    }

    location = / {
        proxy_pass      http://127.0.0.1:4001;
    }

    location ~ ^/(builder|app_) {
        proxy_http_version  1.1;
        proxy_set_header    Connection          $connection_upgrade;
        proxy_set_header    Upgrade             $http_upgrade;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_pass      http://127.0.0.1:4001;
    }

    location ~ ^/api/(system|admin|global)/ {
        proxy_pass      http://127.0.0.1:4002;
    }

    location /worker/ {
        proxy_pass      http://127.0.0.1:4002;
        rewrite ^/worker/(.*)$ /$1 break;
    }

    location /api/backups/ {
        # calls to export apps are limited
        limit_req zone=ratelimit burst=20 nodelay;

        # 1800s timeout for app export requests
        proxy_read_timeout 1800s;
        proxy_connect_timeout 1800s;
        proxy_send_timeout 1800s;

        proxy_http_version 1.1;
        proxy_set_header    Connection          $connection_upgrade;
        proxy_set_header    Upgrade             $http_upgrade;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;

        proxy_pass      http://127.0.0.1:4001;
    }

    location /api/ {
        # calls to the API are rate limited with bursting
        limit_req zone=ratelimit burst=20 nodelay;

        # 120s timeout on API requests
        proxy_read_timeout 120s;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;

        proxy_http_version  1.1;
        proxy_set_header    Connection          $connection_upgrade;
        proxy_set_header    Upgrade             $http_upgrade;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;

        proxy_pass      http://127.0.0.1:4001;
    }

    location /db/ {
        proxy_pass      http://127.0.0.1:5984;
        rewrite ^/db/(.*)$ /$1 break;
    }

    location /socket/ {
        proxy_http_version  1.1;
        proxy_set_header    Upgrade     $http_upgrade;
        proxy_set_header    Connection  'upgrade';
        proxy_set_header    Host        $host;
        proxy_cache_bypass  $http_upgrade;
        proxy_pass          http://127.0.0.1:4001;
    }

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;

        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;
        
        proxy_pass      http://127.0.0.1:9000;
    }

    location /files/signed/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # IMPORTANT: Signed urls will inspect the host header of the request.
        # Normally a signed url will need to be generated with a specified client host in mind.
        # To support dynamic hosts, e.g. some unknown self-hosted installation url,
        # use a predefined host header. The host 'minio-service' is also used at the time of url signing.
        proxy_set_header Host minio-service;

        proxy_connect_timeout 300;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;

        proxy_pass      http://127.0.0.1:9000;
        rewrite ^/files/signed/(.*)$ /$1 break;
    }

    client_header_timeout 60;
    client_body_timeout   60;
    keepalive_timeout     60;

    # gzip
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

}