The nginx site template deploy/nginx.conf.example at mechanism level, with TLS, static web app files, the asset stamp, headers, and the signup rate limit.
A Linux node puts nginx in front of the application. nginx terminates TLS, serves the web app files from the checkout, and forwards everything else to the gunicorn master. This page describes the template deploy/nginx.conf.example and the lines of deploy/install.sh that install it. The application-side cache rules are in cache and asset stamp.
TLS 1.2 and 1.3, AEAD ciphers only, client cipher choice, session tickets off, OCSP stapling with verification.
deploy/nginx.conf.example:33-47
Version banner
server_tokens off.
deploy/nginx.conf.example:49-50
Body size
client_max_body_size 64m for uploads and document versions.
deploy/nginx.conf.example:58-59
Forwarded headers
Host, X-Real-IP, X-Forwarded-For, and X-Forwarded-Proto go to the application.
deploy/nginx.conf.example:61-67
location = /
Temporary redirect to /app/.
deploy/nginx.conf.example:72-76
Asset stamp
Includes the file that sets $cluster_asset_stamp to the release tag.
deploy/nginx.conf.example:78-84
Compression
gzip for CSS, JavaScript, JSON, SVG, and fonts above 1024 bytes.
deploy/nginx.conf.example:86-94
location /app/
Serves webapp/ from the checkout, falls back to index.html, sends Cache-Control: no-cache, and replaces __ASSET_STAMP__ in HTML with the stamp.
deploy/nginx.conf.example:96-105
Headers on /app/
HSTS, a content security policy, nosniff, and no-referrer, listed inside the location because a location-level add_header replaces the server-level ones.
The rate-limit zone signup belongs in the http block (deploy/nginx.conf.example:151-152). install.sh writes it to an nginx conf.d file when no zone of that name exists (deploy/install.sh:201-203).
A commented access-log format logs the path without the query string (deploy/nginx.conf.example:154-163).
The application rejects a body larger than max_request_body_bytes with HTTP 413 (src/cluster_erp/config/settings.py:342-347). That limit and client_max_body_size are two separate settings.
The application interprets forwarded headers only when trust_proxy_headers is on and the peer is in trusted_proxy_ips (src/cluster_erp/server/main.py:45-51, deploy/gunicorn.conf.py:47-49).
Without nginx, the application serves the same two views of webapp/ itself (src/cluster_erp/server/app.py:1574-1644).
