Compare commits

...

2 Commits
main ... main

Author SHA1 Message Date
Neovoid Pineapple 158d5f9355 Reverting to old config 2024-02-29 15:29:56 +00:00
Neovoid Pineapple 987615d414 Synced repo to upstream (#1)
Co-authored-by: Anthony Wang <a@noreply.git.exozy.me>
Co-authored-by: Anthony Wang <a@exozy.me>
Co-authored-by: x <icxven@cocaine.ninja>
Co-authored-by: iacore <noreply+gpg-stub@1a-insec.net>
Reviewed-on: nvpie/nginx#1
2024-02-29 15:20:10 +00:00
21 changed files with 117 additions and 101 deletions

14
calibre-web.conf Normal file
View File

@ -0,0 +1,14 @@
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name library.exozy.me;
location / {
proxy_pass http://unix:/srv/http/library;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 200M;
}
}

View File

@ -3,8 +3,6 @@ server {
listen [::]:443 ssl;
server_name portal.exozy.me;
include conf.d/ssl;
location / {
# Required to proxy the connection to Cockpit
proxy_pass https://localhost:9090;

View File

@ -10,12 +10,9 @@ server {
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name exozy.me;
include conf.d/ssl;
root /srv/http/exozyme;
root /srv/http/www;
index index.html;
location /.well-known/matrix/server {

View File

@ -3,7 +3,9 @@ server {
listen [::]:443 ssl;
server_name git.exozy.me;
include conf.d/ssl;
if ($http_user_agent = "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)") {
return 444;
}
location / {
proxy_pass http://unix:/run/forgejo/forgejo.sock;

View File

@ -3,8 +3,6 @@ server {
listen [::]:443 ssl;
server_name desk.exozy.me;
include conf.d/ssl;
location / {
proxy_pass http://localhost:4080/guacamole/;
proxy_buffering off;

View File

@ -1,13 +1,29 @@
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name www.1a-insec.net;
ssl_certificate /etc/letsencrypt/live/1a-insec.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/1a-insec.net/privkey.pem;
root /srv/http/iacore;
location / {
try_files $uri $uri.html $uri/ =404;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name www2.1a-insec.net;
ssl_certificate /etc/letsencrypt/live/www2.1a-insec.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www2.1a-insec.net/privkey.pem;
ssl_certificate /etc/letsencrypt/live/1a-insec.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/1a-insec.net/privkey.pem;
location / {
proxy_pass http://unix:/srv/http/pages/xrablnhmov;
proxy_pass http://unix:/srv/http/xrablnhmov;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

View File

@ -1,11 +1,8 @@
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name hub.exozy.me;
include conf.d/ssl;
location ~ ^/user/(.*)/desk/(.*)$ {
return 301 /hub/desk/$2;
}

View File

@ -4,7 +4,7 @@ map $http_upgrade $connection_upgrade {
}
upstream web {
server unix:/run/mastodon/mastodon-web.sock fail_timeout=0;
server unix:/run/mastodon-web/mastodon-web.sock fail_timeout=0;
}
upstream streaming {
@ -12,7 +12,7 @@ upstream streaming {
# to ensure load is distributed evenly.
least_conn;
server unix:/run/mastodon/mastodon-streaming.sock fail_timeout=0;
server unix:/run/mastodon-streaming/mastodon-streaming.sock fail_timeout=0;
# Uncomment these lines for load-balancing multiple instances of streaming for scaling,
# this assumes your running the streaming server on ports 4000, 4001, and 4002:
# server 127.0.0.1:4001 fail_timeout=0;
@ -26,8 +26,6 @@ server {
listen [::]:443 ssl;
server_name social.exozy.me;
include conf.d/ssl;
keepalive_timeout 70;
sendfile on;
client_max_body_size 99m;

View File

@ -68,6 +68,5 @@ server {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

View File

@ -20,9 +20,8 @@ server {
# Path to the root of your installation
root /usr/share/webapps/nextcloud;
# Use Mozilla's guidelines for SSL/TLS settings
# https://mozilla.github.io/server-side-tls/ssl-config-generator/
include conf.d/ssl;
# Prevent nginx HTTP Server Detection
server_tokens off;
# HSTS settings
# WARNING: Only add the preload option once you read about
@ -30,7 +29,7 @@ server {
# will add the domain to a hardcoded list that is shipped
# in all major browsers and getting removed from this list
# could take several months.
#add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;
# set max upload size and increase upload timeout:
client_max_body_size 16G;
@ -43,21 +42,20 @@ server {
gzip_comp_level 4;
gzip_min_length 256;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
# Pagespeed is not supported by Nextcloud, so if your server is built
# with the `ngx_pagespeed` module, uncomment this line to disable it.
#pagespeed off;
# The settings allows you to optimize the HTTP2 bandwitdth.
# The settings allows you to optimize the HTTP2 bandwidth.
# See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
# for tunning hints
# for tuning hints
client_body_buffer_size 512k;
# HTTP response headers borrowed from Nextcloud `.htaccess`
add_header Referrer-Policy "no-referrer" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Download-Options "noopen" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Permitted-Cross-Domain-Policies "none" always;
add_header X-Robots-Tag "noindex, nofollow" always;
@ -72,7 +70,7 @@ server {
# only for Nextcloud like below:
include mime.types;
types {
application/javascript js mjs;
text/javascript js mjs;
}
# Specify how to handle directories -- specifying `/index.php$request_uri`
@ -82,7 +80,7 @@ server {
# that file is correctly served; if it doesn't, then the request is passed to
# the front-end controller. This consistent behaviour means that we don't need
# to specify custom rules for certain paths (e.g. images and other assets,
# `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
# `/updater`, `/ocs-provider`), and thus
# `try_files $uri $uri/ /index.php$request_uri`
# always provides the desired behaviour.
index index.php index.html /index.php$request_uri;
@ -141,7 +139,7 @@ server {
# to the URI, resulting in a HTTP 500 error response.
location ~ \.php(?:$|/) {
# Required for legacy support
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
set $path_info $fastcgi_path_info;
@ -163,7 +161,8 @@ server {
fastcgi_max_temp_file_size 0;
}
location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
# Serve static files
location ~ \.(?:css|js|mjs|svg|gif|png|jpg|ico|wasm|tflite|map|ogg|flac)$ {
try_files $uri /index.php$request_uri;
add_header Cache-Control "public, max-age=15778463, $asset_immutable";
access_log off; # Optional: Don't log access to assets

View File

@ -6,11 +6,11 @@ server {
ssl_certificate /etc/letsencrypt/live/neovoid.is-cool.dev/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/neovoid.is-cool.dev/privkey.pem;
root /srv/http/nvpie;
index index.html;
location / {
proxy_pass http://unix:/srv/http/pages/nvpie;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
try_files $uri $uri.html $uri/ =404;
}
}

View File

@ -1,35 +1,9 @@
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name ~^(\d)\.exozy\.me;
include conf.d/ssl;
index index.html;
location / {
# https://serverfault.com/questions/638505/nginx-dynamic-proxy-pass-doesnt-resolve-properly
proxy_pass http://127.0.0.1:420$1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# Proxy WebSockets
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name ~^(?<page>.+)\.exozy\.me;
include conf.d/ssl;
root /srv/http/pages/$page;
root /srv/http/$page;
index index.html;
error_page 502 404 /404.html;
@ -42,7 +16,7 @@ server {
}
location @fallback {
proxy_pass http://unix:/srv/http/pages/$page;
proxy_pass http://unix:/srv/http/$page;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

View File

@ -11,11 +11,6 @@ server {
listen 443 ssl;
listen [::]:443 ssl;
server_name tube.exozy.me;
##
# Certificates
# you need a certificate to run in production. see https://letsencrypt.org/
##
include conf.d/ssl;
##
# Application
@ -163,7 +158,7 @@ server {
alias /usr/share/webapps/peertube/client/dist/$1;
}
location ~ ^(/static/(webseed|web-videos|streaming-playlists)/private/)|^/download {
location ~ ^(/static/(webseed|web-videos|streaming-playlists/hls)/private/)|^/download {
# We can't rate limit a try_files directive, so we need to duplicate @api
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

View File

@ -7,7 +7,7 @@ server {
ssl_certificate_key /home/pranav/.local/share/cert/karawale.in/key.pem;
location / {
proxy_pass http://unix:/srv/http/pages/pranav;
proxy_pass http://unix:/srv/http/pranav;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

View File

@ -1,11 +0,0 @@
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name ta180m.exozy.me;
include conf.d/ssl;
location / {
return 301 https://a.exozy.me$request_uri;
}
}

View File

@ -3,9 +3,7 @@ server {
listen [::]:443 ssl;
server_name safetwitch.exozy.me;
include conf.d/ssl;
root /srv/http/pages/safetwitch;
root /srv/http/safetwitch;
index index.html;
location / {

8
ssl
View File

@ -1,8 +0,0 @@
ssl_certificate /etc/letsencrypt/live/exozy.me/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/exozy.me/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
ssl_trusted_certificate /etc/letsencrypt/live/exozy.me/chain.pem;
ssl_stapling on;
ssl_stapling_verify on;

View File

@ -1,11 +1,8 @@
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name chat.exozy.me;
include conf.d/ssl;
location / {
proxy_pass http://localhost:8008;
proxy_set_header X-Forwarded-For $remote_addr;

View File

@ -3,8 +3,6 @@ server {
listen [::]:443 ssl;
server_name ci.exozy.me;
include conf.d/ssl;
location / {
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;

55
x.conf Normal file
View File

@ -0,0 +1,55 @@
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name pb.exozy.me;
location / {
proxy_pass http://localhost:7631;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name memos.exozy.me;
location / {
proxy_pass http://localhost:7632;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name reddit.exozy.me;
location / {
proxy_pass http://localhost:7633;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name rssbridge.exozy.me;
location / {
proxy_pass http://localhost:7634;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

View File

@ -9,7 +9,7 @@ server {
add_header Server exozyme;
location / {
proxy_pass http://unix:/srv/http/pages/xtexhome;
proxy_pass http://unix:/srv/http/xtexhome;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@ -33,7 +33,7 @@ server {
add_header Server exozyme;
location / {
proxy_pass http://unix:/srv/http/pages/xtexblog;
proxy_pass http://unix:/srv/http/xtexblog;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;