cmms/nginx.conf at main · Grashjs/cmms · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Atlas CMMS — single-domain reverse proxy
#
# Routes everything through one public host:
#   /         -> frontend (React)
#   /api/     -> backend  (Spring Boot)
#   /storage/ -> minio    (object storage / attachments)
#
# The browser only ever talks to this nginx container, so CORS,
# separate DNS records, and separate certificates are unnecessary.

upstream atlas_frontend {
    server frontend:3000;
}

upstream atlas_backend {
    server api:8080;
}

upstream atlas_minio {
    server minio:9000;
}

server {
    listen 80;
    server_name _;

    client_max_body_size 200M;

    # ---- Frontend (React app) ----
    location / {
        proxy_pass http://atlas_frontend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # ---- Backend API ----
    location /api/ {
        proxy_pass http://atlas_backend/;
        # Critical for WebSockets and streaming protocols
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard proxy details
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Fix for streaming/long-polling fallbacks (prevents Nginx from buffering chunks)
        proxy_buffering off;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;

    }

    # ---- MinIO object storage ----
    location /storage/ {
        proxy_pass http://atlas_minio/;

        proxy_set_header Host minio:9000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # MinIO needs large, unbuffered uploads
        proxy_buffering off;
        client_max_body_size 500M;

    }
}

# ---------------------------------------------------------------------------
# HTTPS (recommended for production)
# ---------------------------------------------------------------------------
# Easiest path for self-hosters: keep the block above on plain HTTP and put
# this container behind Caddy, Traefik, Cloudflare Tunnel, or NGINX Proxy
# Manager for TLS termination — that's what most users already run.
#
# If you'd rather terminate TLS in this container directly with certbot,
# uncomment and adapt:
#
# server {
#     listen 443 ssl;
#     server_name cmms.example.com;
#
#     ssl_certificate     /etc/nginx/certs/fullchain.pem;
#     ssl_certificate_key /etc/nginx/certs/privkey.pem;
#
#     client_max_body_size 200M;
#     location /         { proxy_pass http://atlas_frontend; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; }
#     location /api/     { proxy_pass http://atlas_backend/;  proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; }
#     location /storage/ { proxy_pass http://atlas_minio/;    proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_buffering off; client_max_body_size 500M; }
# }