Initial LisgloSIPS V2 implementation

infra/server-b/s05/nginx/lisglosips-global.conf

@@ -0,0 +1,13 @@
+server_tokens off;
+
+limit_req_zone $binary_remote_addr zone=lisglosips_api_per_ip:10m rate=20r/s;
+limit_req_zone $binary_remote_addr zone=lisglosips_auth_per_ip:10m rate=5r/m;
+limit_conn_zone $binary_remote_addr zone=lisglosips_conn_per_ip:10m;
+limit_req_status 429;
+limit_conn_status 429;
+
+map $http_upgrade $lisglosips_connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+

infra/server-b/s05/nginx/lisglosips-proxy.conf

@@ -0,0 +1,15 @@
+proxy_http_version 1.1;
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Request-ID $request_id;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $lisglosips_connection_upgrade;
+proxy_connect_timeout 3s;
+proxy_send_timeout 30s;
+proxy_read_timeout 30s;
+proxy_buffering on;
+proxy_buffer_size 8k;
+proxy_buffers 8 16k;
+

infra/server-b/s05/nginx/lisglosips-security-headers.conf

@@ -0,0 +1,7 @@
+add_header Strict-Transport-Security "max-age=300" always;
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-Frame-Options "DENY" always;
+add_header Referrer-Policy "same-origin" always;
+add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'; object-src 'none'" always;
+

infra/server-b/s05/nginx/lisglosips-tls.conf

@@ -0,0 +1,8 @@
+ssl_certificate /etc/lisglosips/pki/certs/server.crt;
+ssl_certificate_key /etc/lisglosips/pki/private/server.key;
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+ssl_session_cache shared:LisgloSIPSTLS:10m;
+ssl_session_timeout 1d;
+ssl_session_tickets off;
+

infra/server-b/s05/nginx/lisglosips.conf

@@ -0,0 +1,68 @@
+upstream lisglosips_api {
+    server 127.0.0.1:3000 max_fails=3 fail_timeout=5s;
+    keepalive 32;
+}
+
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+    return 308 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    server_name _;
+
+    include /etc/nginx/snippets/lisglosips-tls.conf;
+
+    root /opt/lisglosips/current/public;
+    index index.html;
+    client_max_body_size 2m;
+    max_ranges 1;
+
+    include /etc/nginx/snippets/lisglosips-security-headers.conf;
+
+    limit_conn lisglosips_conn_per_ip 30;
+
+    location = /healthz {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        proxy_pass http://lisglosips_api;
+        access_log off;
+    }
+
+    location = /api/auth/login {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        limit_req zone=lisglosips_auth_per_ip burst=3 nodelay;
+        proxy_pass http://lisglosips_api;
+    }
+
+    location /api/ {
+        include /etc/nginx/snippets/lisglosips-proxy.conf;
+        limit_req zone=lisglosips_api_per_ip burst=40 nodelay;
+        proxy_pass http://lisglosips_api;
+    }
+
+    location /_recordings/ {
+        internal;
+        alias /data/recordings/;
+        autoindex off;
+        include /etc/nginx/snippets/lisglosips-security-headers.conf;
+        add_header Accept-Ranges bytes always;
+    }
+
+    location /assets/ {
+        try_files $uri =404;
+        expires 7d;
+        include /etc/nginx/snippets/lisglosips-security-headers.conf;
+        add_header Cache-Control "public, immutable";
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+        expires -1;
+        include /etc/nginx/snippets/lisglosips-security-headers.conf;
+        add_header Cache-Control "no-store";
+    }
+}