Configurer Nginx pour GeoNature

Notes : dans notre exemple, nous utiliserons un adresse web de type <alias>.<domaine-sinp> (Ex. : expert.silene.eu) comme adresse principale de GeoNature. L'adresse web geonature.<domaine-sinp> (Ex: geonature.silene.eu) devra être redirigé vers <alias>.<domaine-sinp>.

Créer un fichier de configuration : vi /etc/nginx/sites-available/geonature.conf

Y placer le contenu suivant :

server {
    listen 80;
    listen [::]:80;
 
    server_name <alias>.<domaine-sinp>;
    root /home/geonat/www/geonature/frontend/dist;
 
    location ^~ "/api/" {
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
 
        # WARNING: up timeout to 300s for Synthese downloading (See bug )
        # Set timeout like Gunicorn in GeoNature config/settings.ini file
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s; 
        proxy_pass http://127.0.0.1:8000/;# ATTENTION : bien mettre un slash final ! Sinon => 404
    }
}

Créer un lien depuis les sites actifs : cd /etc/nginx/sites-enabled/ ; ln -s ../sites-available/geonature.conf geonature.conf

Tester la config et relancer Nginx si OK : nginx -t && nginx -s reload

Modifier les redirections (geonature.<domaine-sinp> → <alias>.<domaine-sinp>) pour qu'au final le fichier geonature.conf contienne :

server {
    listen 443 ssl http2; # managed by Certbot
    listen [::]:443 ssl http2; # managed by Certbot
 
    server_name <alias>.<domaine-sinp>;
    root /home/geonat/www/geonature/frontend/dist;
 
    # GeoNature Angular App
    # No cache for index.html Angular App and config/locale json files
    location ~* "^/index.html|.*\.json$" {
        expires -1;
        add_header Cache-Control "no-store";
    }
    # Favicon
    location "/favicon.ico" {
        expires 1y;
        add_header Cache-Control "public, no-transform";
    }
    # JS and CSS
    location ~* "^/[^/]+\.[0-9a-f]{20}\.(?:js|css)$" {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }   
    # Images
    location ~* "^/[^/]+\.[0-9a-f]{20}\.(?:gif|jpe?g|png|svg)$" {
        expires 1y;
        add_header Cache-Control "public, no-transform, immutable";
    }
    # Fonts
    location ~* "^/[^/]+\.[0-9a-f]{20}\.(?:woff2?|eot|ttf)$" {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
 
    # GeoNature API
    location ^~ "/api/" {
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
 
        # WARNING: up timeout to 300s for Synthese downloading (See bug )
        # Set timeout like Gunicorn in GeoNature config/settings.ini file
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s; 
        proxy_pass http://127.0.0.1:8000/;# ATTENTION : bien mettre un slash final ! Sinon => 404
    }
 
    # Alias for Export module
    location "/exports/schedules" {
        alias /home/geonat/www/geonature/backend/static/exports/schedules;
    }   
    location "/exports/users" {
        alias /home/geonat/www/geonature/backend/static/exports/usr_generated;
    }   
 
    ssl_certificate /etc/letsencrypt/live/<alias>.<domaine-sinp>/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/<alias>.<domaine-sinp>/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
 
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name geonature.<domaine-sinp>;
 
    ssl_certificate /etc/letsencrypt/live/<alias>.<domaine-sinp>/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/<alias>.<domaine-sinp>/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
    return 302 https://<alias>.<domaine-sinp>$request_uri;
}
 
server {
    listen 80; 
    listen [::]:80;
    server_name <alias>.<domaine-sinp> geonature.<domaine-sinp>;
    return 302 https://<alias>.<domaine-sinp>$request_uri;
}

Notes : la configuration Nginx de GeoNature active la mise en cache définitive des fichiers comprenant un hash dans leur nom (JS, CSS, polices et images). Angular Cli génère des fichiers comprenant le hash de leur contenu dans leur nom. Tout nouveau build génère une nouveau hash pour les fichiers modifiés. Les fichiers peuvent donc être mis en cache définitivement à l'exception du fichier index.html.

Notes : le fichier de configuration geonature_maintenance.conf pointe vers un fichier index.html indiquant que GeoNature est en maintenance

Copier la config de GeoNature : cp /etc/nginx/sites-available/geonature.conf /etc/nginx/sites-available/geonature_maintenance.conf

Éditer le fichier : vi /etc/nginx/sites-available/geonature_maintenance.conf

Modifier le fichier de config ainsi :

server {
    listen [::]:443 ssl http2; # managed by Certbot
    listen 443 ssl http2; # managed by Certbot
 
    server_name <alias>.<domaine-sinp>;
    root /home/geonat/www/geonature/frontend/src/app/maintenance;
 
    ssl_certificate /etc/letsencrypt/live/<alias>.<domaine>/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/<alias>.<domaine>/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
 
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name geonature.<domaine-sinp>;
 
    ssl_certificate /etc/letsencrypt/live/<alias>.<domaine-sinp>/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/<alias>.<domaine-sinp>/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
    return 302 https://<alias>.<domaine-sinp>$request_uri;
}
 
server {
    listen 80; 
    listen [::]:80;
    server_name <alias>.<domaine-sinp> geonature.<domaine-sinp>;
    return 302 https://<alias>.<domaine-sinp>$request_uri;
}