ghost.conf

limit_req_zone $binary_remote_addr zone=ips:10m rate=50r/s;

proxy_cache_path  /etc/nginx/cache/anima-engine  levels=1:2 keys_zone=STATIC:10m inactive=24h max_size=512m;

gzip_static on;
gzip_types text/html text/css application/x-javascript image/svg+xml;
gzip_min_length 256;
gzip_comp_level 3;

server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    server_name anima-engine.org www.anima-engine.org;

    limit_req zone=ips burst=5 nodelay;

    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 10M;

    client_body_timeout 5s;
    client_header_timeout 5s;
    keepalive_timeout 15s;
    send_timeout 5s;

    location / {
        root /var/www/ghost/content/themes/anima;
        index static.html;
    }

    location /blog/ {
        proxy_cache STATIC;
        proxy_cache_valid 200 10m;
        proxy_cache_valid 404 1m;
        proxy_ignore_headers X-Accel-Expires Expires Cache-Control;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://ghost;
    }

    location /blog/ghost/ {
        rewrite ^ https://$host$request_uri? permanent;
    }

    location /blog/assets/ {
        alias /var/www/ghost/content/themes/anima/assets/;
        access_log off;
        expires max;
    }

    location /blog/components/ {
        alias /var/www/ghost/content/themes/anima/components/;
        access_log off;
        expires max;
    }

    location /blog/content/images/ {
        alias /var/www/ghost/content/images/;
        access_log off;
        expires max;
    }
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server ipv6only=on;

    server_name anima-engine.org www.anima-engine.org;

    limit_req zone=ips burst=5 nodelay;

    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 10M;

    client_body_timeout 5s;
    client_header_timeout 5s;
    keepalive_timeout 15s;
    send_timeout 5s;

    ssl_certificate /etc/letsencrypt/live/anima-engine.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/anima-engine.org/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

    location ~ /.well-known {
        allow all;
    }
    
    location / {
        rewrite ^ http://$host$request_uri? permanent;
    }

    location /blog/ghost/ {
	proxy_pass http://ghost;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_buffering off;
    }
}

upstream ghost {
    server localhost:2368;
}