Hi..
Thanks for the reply..
Does it mean that the requests for static files (e.g. under /priv) are no longer hitting the Phoenix server (here bandit)?
Are you setting this config on Phoenix side or Nginx side? I guess it’s on Nginx.. Then the config for static assets on Phoenix becomes somehow useless, right?
For reverse proxy and SSL I was using traefik but I also want to add caching and static assets serving..
So I guess I’ll also switch to Nginx..
Do you think you can share your nginx file (or just the main parts)?
Sanjibukai
0
conradwt
Hi, I’m sorry about not replying sooner. Anyway, the static assets will be served by Nginx. The Nginx configurations will be set within Nginx. Here are some of the main parts to consider:
# Redirect HTTP to HTTPS
server {
listen 80;
server_name your_domain.com;
return 301 https://$host$request_uri;
}
# HTTPS server block
server {
listen 443 ssl;
server_name your_domain.com;
# SSL certificate and key
ssl_certificate /etc/letsencrypt/live/your_domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/your_domain.com/privkey.pem;
# SSL settings
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
# Root directory for your Phoenix application's static assets
root /path/to/your/phoenix/app/priv/static;
# Proxy requests to Phoenix application
location / {
proxy_pass http://127.0.0.1:4000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# WebSocket support for /live endpoint
location /live {
proxy_pass http://127.0.0.1:4000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
# Static file caching
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
expires max;
add_header Cache-Control "public";
}
}
The ciphers are a moving target but one can use the following site to assess your overall SSL webserver config:
1
julismz
What’s the point in separate the sockets from the rest of the request? Why one can’t add socket support to / directly, has it some disadvantage?
By the way, did you ever try it against a K8s cluster? Didn’t face any issues with stickies sessions?
On the other hand, is it a mistake to delegate to cloudflare the SSL part and have one less problem keeping in mind to renew certs, creates it, config, etc? I noticed that, in general, people prefer to have their own certs and 443 port…
0