I have an nginx server file that serves some static content, looks something simple like:
server {
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/this_host/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/this_host/privkey.pem;
server_name static_content;
# Proper rotation of session ticket encryption keys are not implemented, so
# disable session tickets entirely
ssl_session_tickets off;
# Given that anticipated client devices are relatively modern, no need to
# support insecure protocols
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;
location /binaries/ {
auth_basic "minimal protection";
auth_basic_user_file /etc/nginx/auth/.htpasswd;
root /var/www/static/;
}
location = /apple-app-site-association {
alias /var/www/static/apple-app-site-association/apple-app-site-assocation;
types { } default_type "content-type: application/json";
}
}
I reuse this on a production server and a staging server. On the staging server, I want to front an API as well. If I just add another location in:
location ^~ /my_cool_api/v1/ {
proxy_pass http://localhost:4000/my_cool_api/v1/;
}
But then I have different server files for the different serves, and it's poorly named as "static_content" at that point as well. I would like to make it more modular, so I tried leaving the first file alone, and adding a second file to the staging server:
server {
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/this_host/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/this_host/privkey.pem;
server_name my_cool_api;
# Proper rotation of session ticket encryption keys are not implemented, so
# disable session tickets entirely
ssl_session_tickets off;
# Given that anticipated client devices are relatively modern, no need to
# support insecure protocols
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers off;
location ^~ /accumulus_twig/v1/ {
proxy_pass http://localhost:4000/accumulus_twig/v1/;
}
}
This doesn't work though. After I link the two in sites-enabled, I just get the API working in that case, error.log shows that it can't find (static) files at /usr/share/nginx/html/binaries/
. Is there not a modular way to have a single server definition at 443 with all of the proper certs etc, but define different location/matches in different files?