Odoo 9 sample nginx config to hide backend from customers

# Requires a local Odoo 9 server that is only listening to 127.0.0.1
# interface on port 8069, with website/ecommerce installed, and
# a proper --db-filter setting. --proxy-mode recommended too.

# This is an *untested* sample nginx configuration for demo purpose,
# please double-check all the settings and test the actual security
# of your setup - don't take it for granted.
# It is likely to break some built-in features of Odoo as well,
# might require whitelisting some extra routes.

# Your public server configuration, visible to the world
server {
    listen 80 default_server;
    server_name www.acme.com;

    error_page 404 /page/404;

    # some resources allowed within /web
    location ~ ^/web/(content/|static/|image/|login|session/) {
        proxy_pass http://127.0.0.1:8069;
    }

    # rest of /web/ backend blocked: 404 or rewrite rule
    location ~ ^/web\b {
        return 404;
    }

    # everything else allowed
    location / {
        proxy_pass http://127.0.0.1:8069;
    }
}

# Your private server configuration, could be restricted via
# password protection (htaccess-like) or based on source IP address, etc.
server {
    listen 80;
    server_name backend.acme.com;

    location / {
        # Proxy everything
        proxy_pass http://127.0.0.1:8069;
    }
}