@@ -362,6 +362,16 @@ server {
362
362
listen [::]:80;
363
363
server_name $DOMAIN ;
364
364
365
+ # WebSocket path exceptions to avoid 301 redirect loop
366
+ location = /ws {
367
+ return 301 https://\$ host\$ request_uri;
368
+ }
369
+
370
+ location /ws/ {
371
+ return 301 https://\$ host\$ request_uri;
372
+ }
373
+
374
+ # All other HTTP requests get redirected to HTTPS
365
375
location / {
366
376
return 301 https://\$ host\$ request_uri;
367
377
}
@@ -393,17 +403,66 @@ server {
393
403
add_header X-XSS-Protection "1; mode=block";
394
404
add_header Strict-Transport-Security "max-age=63072000" always;
395
405
396
- location / {
397
- proxy_pass http://unix:$SOCKET_FILE ;
406
+ # WebSocket without trailing slash
407
+ location = /ws {
408
+ proxy_pass http://127.0.0.1:8765;
409
+ proxy_http_version 1.1;
410
+
411
+ # Extended timeouts for long-running connections (up to 24 hours)
412
+ proxy_read_timeout 86400s;
413
+ proxy_send_timeout 86400s;
414
+
415
+ # Disable proxy buffering for real-time data
416
+ proxy_buffering off;
417
+
418
+ # WebSocket headers
419
+ proxy_set_header Upgrade \$ http_upgrade;
420
+ proxy_set_header Connection "upgrade";
421
+
422
+ # Other headers
398
423
proxy_set_header Host \$ host;
399
424
proxy_set_header X-Real-IP \$ remote_addr;
400
425
proxy_set_header X-Forwarded-For \$ proxy_add_x_forwarded_for;
401
426
proxy_set_header X-Forwarded-Proto \$ scheme;
402
- proxy_redirect off;
427
+ proxy_set_header X-Forwarded-Host \$ host;
428
+ }
429
+
430
+ # WebSocket with trailing slash
431
+ location /ws/ {
432
+ proxy_pass http://127.0.0.1:8765/;
433
+ proxy_http_version 1.1;
403
434
435
+ # Extended timeouts for long-running connections (up to 24 hours)
436
+ proxy_read_timeout 86400s;
437
+ proxy_send_timeout 86400s;
438
+
439
+ # Disable proxy buffering for real-time data
440
+ proxy_buffering off;
441
+
442
+ # WebSocket headers
443
+ proxy_set_header Upgrade \$ http_upgrade;
444
+ proxy_set_header Connection "upgrade";
445
+
446
+ # Other headers
447
+ proxy_set_header Host \$ host;
448
+ proxy_set_header X-Real-IP \$ remote_addr;
449
+ proxy_set_header X-Forwarded-For \$ proxy_add_x_forwarded_for;
450
+ proxy_set_header X-Forwarded-Proto \$ scheme;
451
+ proxy_set_header X-Forwarded-Host \$ host;
452
+ }
453
+
454
+ # Main app (Gunicorn UDS)
455
+ location / {
456
+ proxy_pass http://unix:$SOCKET_FILE ;
404
457
proxy_http_version 1.1;
458
+
405
459
proxy_set_header Upgrade \$ http_upgrade;
406
460
proxy_set_header Connection "upgrade";
461
+ proxy_set_header Host \$ host;
462
+ proxy_set_header X-Real-IP \$ remote_addr;
463
+ proxy_set_header X-Forwarded-For \$ proxy_add_x_forwarded_for;
464
+ proxy_set_header X-Forwarded-Proto \$ scheme;
465
+ proxy_redirect off;
407
466
}
408
467
}
409
468
EOL
0 commit comments