Production nginx, caching and user data

Lesson 19 / 22 · Commentail 1.3.2

Before public use, test the real domain, HTTPS and proxy path rather than localhost alone. The following example applies only to “public nginx → Django on loopback.” A CDN or multiple proxy hops requires reviewing the entire chain.

Client IP behind one nginx

Example fragment of the existing nginx configuration:

# Example: nginx is the only public edge; Django listens on loopback.
location / {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_pass http://127.0.0.1:8000;
}

Here nginx overwrites the forwarded IP with its client's address rather than trusting a visitor-supplied header. Block external access to the Django port. In settings:

COMMENTAIL = {"default": {"TRUSTED_PROXIES": ["127.0.0.1/32"]}}
# Set only when your controlled proxy overwrites this header and direct access is blocked.
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

127.0.0.1/32 is correct only when that is the application's actual peer. Containers, Unix sockets and remote load balancers differ. Never trust 0.0.0.0/0 or ::/0. Enable SECURE_PROXY_SSL_HEADER only when you control header rewriting and block direct backend access.

Validate and reload nginx using the server's established procedure. Through the real domain, verify that different clients have distinct IP quotas and that a forged X-Forwarded-For cannot replace the real address. Django system checks cannot establish the live network path.

Caching

Forms, private pending cards and recent lists depend on the visitor. Keep CapabilityHeadersMiddleware and Cache-Control: private, no-store. Exclude these responses from shared page/CDN caches; Vary alone is not a safe caching policy. Do not treat protected action URLs as ordinary analytics links.

Data and access

Guest email is not public, but the site and selected delivery provider process it. External CAPTCHA also involves its provider. Describe actual processing and retention for your site; installing a package does not define your legal policy.

Deleting an account cancels related mail/subscriptions and removes stored comment email. Text may remain under a deleted-author label. Published comments do not expire with temporary tokens. Backups and exports require their own retention policy.

Acceptance

Test two browsers, guest and account, restricted Page, another Site, moderation and editing. Inspect actual themes, narrow screens, keyboard and supported no-JS paths. Separately complete mail through unsubscribe. Monitor queue age and worker failures and redact protected URLs from logs. Do not deploy the example's runserver or DEBUG settings.

Related lessons

• 8. Schedule email processing and cleanup
• 20. Upgrade and restore Commentail
• 21. Troubleshoot a Commentail installation

Related documentation

• Deployment
• Security-and-privacy
• Performance