# Nginx Configuration

<!-- BOOKSTACK-DOCUMENT-RELEASE:BEGIN -->
# Nginx Configuration

| Field | Value |
| --- | --- |
| Distribution | BSS — OpenSOF |
| Product | OpenSOF |
| Release | 0.15.1 |
| Deployment | `opensof.bss.dev` |
| Source | `/srv/bss/releases/OpenSOF-v0.15.0-20app` |
| Evidence | Release and readable host Nginx configuration |
| Source fingerprint | `cda583b42f2a0d296b268ab5b174932a378c8be6fb52ffa1af14af896e990f6e` |
| Status | Generated baseline — human review required |

> **Verification boundary:** This page combines platform design guidance with static evidence from the release. It does not prove that every detected interface is enabled, reachable, secure, or operational in the deployed environment.

## Observed proxy configuration

| Evidence | server_name | listen | location | proxy_pass |
| --- | --- | --- | --- | --- |
| `/etc/nginx/sites-available/opensof.bss.dev` | opensof.bss.dev<br>opensof.bss.dev | 443 ssl<br>[::]:443 ssl<br>80<br>[::]:80 | / | `http://127.0.0.1:3201/` |

## Proxy requirements

- Terminate TLS with a valid certificate and redirect clear-text HTTP to HTTPS.
- Preserve Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto headers.
- Configure WebSocket upgrade headers on real-time routes.
- Set upload/body/time limits deliberately for imagery, video, files and long-running analytics.
- Keep each distribution hostname mapped to its intended service/port; test routing after every release.
- Run nginx -t before reload and retain the last-known-good configuration.

## Verification commands

```bash
sudo nginx -t
sudo systemctl reload nginx
curl -I https://opensof.bss.dev/
```
<!-- BOOKSTACK-DOCUMENT-RELEASE:END -->

---

## Maintainer Notes

<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-BEGIN -->
Add human-reviewed deployment notes, corrections, decisions, screenshots, and links here. Content outside the generated block is preserved on future runs.
<!-- BOOKSTACK-DOCUMENT-RELEASE:NOTES-END -->