Add a personal ArchiveBox instance (#32)

Reviewed-on: #32
Co-authored-by: mdwalters <mdwalters@noreply.git.exozy.me>
Co-committed-by: mdwalters <mdwalters@noreply.git.exozy.me>

calibre-web.conf

@@ -1,16 +1,17 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name git.exozy.me;
-
-    include conf.d/ssl;
+    server_name library.exozy.me;
 
     location / {
-        proxy_pass http://unix:/run/forgejo/forgejo.sock;
+        proxy_pass http://unix:/srv/http/library;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
-        client_max_body_size 1G;
+        proxy_set_header Remote-User $remote_user;
+        auth_pam "calibre-web";
+        auth_pam_service_name "sssd";
+        client_max_body_size 200M;
     }
 }

cockpit.conf

@@ -1,24 +0,0 @@
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name portal.exozy.me;
-
-    include conf.d/ssl;
-
-    location / {
-        # Required to proxy the connection to Cockpit
-        proxy_pass https://localhost:9090;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        # Required for web sockets to function
-        proxy_http_version 1.1;
-        proxy_buffering off;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-
-        # Pass ETag header from Cockpit to clients.
-        # See: https://github.com/cockpit-project/cockpit/issues/5239
-        gzip off;
-    }
-}

exozyme.conf

@@ -10,12 +10,9 @@ server {
 server {
     listen 443 ssl default_server;
     listen [::]:443 ssl default_server;
-
     server_name exozy.me;
 
-    include conf.d/ssl;
-
-    root /srv/http/exozyme;
+    root /srv/http/www;
     index index.html;
 
     location /.well-known/matrix/server {

guacamole.conf

@@ -3,8 +3,6 @@ server {
     listen [::]:443 ssl;
     server_name desk.exozy.me;
 
-    include conf.d/ssl;
-
     location / {
         proxy_pass http://localhost:4080/guacamole/;
         proxy_buffering off;
@@ -12,6 +10,5 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection $http_connection;
-        access_log off;
     }
 }

iacore.conf

@@ -1,21 +1,40 @@
+log_format 1a-simple '[$time_local] "$request" $status $bytes_sent "$http_referer"';
+
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name www2.1a-insec.net;
+    server_name www.1a-insec.net;
 
-    #ssl_certificate /etc/letsencrypt/live/www2.1a-insec.net/fullchain.pem;
-    #ssl_certificate_key /etc/letsencrypt/live/www2.1a-insec.net/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/1a-insec.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/1a-insec.net/privkey.pem;
+
+    root /srv/http/iacore;
+
+    access_log /var/log/nginx/www.1a-insec.net.access.log 1a-simple;
 
     location / {
-        proxy_pass http://unix:/srv/http/pages/xrablnhmov;
-        proxy_set_header Host $host;
-        # proxy_set_header X-Real-IP $remote_addr;
-        # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        # proxy_set_header X-Forwarded-Proto $scheme;
-
-        # # Proxy WebSockets
-        # proxy_http_version 1.1;
-        # proxy_set_header Upgrade $http_upgrade;
-        # proxy_set_header Connection "Upgrade";
+        try_files $uri $uri.html $uri/ =404;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name bean.1a-insec.net;
+
+    ssl_certificate /etc/letsencrypt/live/1a-insec.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/1a-insec.net/privkey.pem;
+
+    location / {
+        proxy_pass http://unix:/srv/http/bean-doze;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Proxy WebSockets
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "Upgrade";
     }
 }

jupyterhub.conf

@@ -1,11 +1,8 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-
     server_name hub.exozy.me;
 
-    include conf.d/ssl;
-
     location ~ ^/user/(.*)/desk/(.*)$ {
         return 301 /hub/desk/$2;
     }
@@ -18,7 +15,6 @@ server {
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection $http_connection;
         proxy_cookie_path /guacamole/ /hub/desk/;
-        access_log off;
     }
 
     # Managing literal requests to the JupyterHub front end
@@ -35,8 +31,5 @@ server {
         proxy_set_header X-Scheme $scheme;
 
         proxy_buffering off;
-
-        # Allow big uploads
-        client_max_body_size 1G;
     }
 }

mastodon.conf

@@ -3,8 +3,8 @@ map $http_upgrade $connection_upgrade {
     '' close;
 }
 
-upstream web {
-    server unix:/run/mastodon/mastodon-web.sock fail_timeout=0;
+upstream backend {
+    server unix:/run/mastodon-web/mastodon-web.sock fail_timeout=0;
 }
 
 upstream streaming {
@@ -12,7 +12,7 @@ upstream streaming {
     # to ensure load is distributed evenly.
     least_conn;
 
-    server unix:/run/mastodon/mastodon-streaming.sock fail_timeout=0;
+    server unix:/run/mastodon-streaming/mastodon-streaming.sock fail_timeout=0;
     # Uncomment these lines for load-balancing multiple instances of streaming for scaling,
     # this assumes your running the streaming server on ports 4000, 4001, and 4002:
     # server 127.0.0.1:4001 fail_timeout=0;
@@ -26,8 +26,6 @@ server {
     listen [::]:443 ssl;
     server_name social.exozy.me;
 
-    include conf.d/ssl;
-
     keepalive_timeout 70;
     sendfile on;
     client_max_body_size 99m;
@@ -132,7 +130,7 @@ server {
         proxy_set_header Proxy "";
         proxy_pass_header Server;
 
-        proxy_pass http://web;
+        proxy_pass http://backend;
         proxy_buffering on;
         proxy_redirect off;
         proxy_http_version 1.1;

mdwalters.conf

@@ -1,66 +1,10 @@
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name meower.mdwalters.exozy.me;
+    server_name git.max.is-probably.gay;
 
-    ssl_certificate /etc/letsencrypt/live/mdwalters.exozy.me/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/mdwalters.exozy.me/privkey.pem;
-
-    location / {
-        proxy_pass http://localhost:5173;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name api.meower.mdwalters.exozy.me;
-
-    ssl_certificate /etc/letsencrypt/live/mdwalters.exozy.me/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/mdwalters.exozy.me/privkey.pem;
-
-    location / {
-        proxy_pass http://localhost:1342;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name wss.meower.mdwalters.exozy.me;
-
-    ssl_certificate /etc/letsencrypt/live/mdwalters.exozy.me/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/mdwalters.exozy.me/privkey.pem;
-
-    location / {
-        proxy_pass http://localhost:1341;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        # Proxy WebSockets
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name git.mdwalters.exozy.me;
-
-    ssl_certificate /etc/letsencrypt/live/mdwalters.exozy.me/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/mdwalters.exozy.me/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/max.is-probably.gay/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/max.is-probably.gay/privkey.pem;
 
     location / {
         proxy_pass http://localhost:1351;
@@ -68,6 +12,22 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
-
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name archive.max.is-probably.gay;
+
+    ssl_certificate /etc/letsencrypt/live/max.is-probably.gay/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/max.is-probably.gay/privkey.pem;
+
+    location / {
+        proxy_pass http://localhost:1291;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
     }
 }

nextcloud.conf

@@ -1,190 +0,0 @@
-upstream php-handler {
-    server unix:/run/nextcloud/nextcloud.sock;
-}
-
-# Set the `immutable` cache control options only for assets with a cache busting `v` argument
-map $arg_v $asset_immutable {
-    "" "";
-    default "immutable";
-}
-
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name cloud.exozy.me;
-
-    # Enable symlinks
-    disable_symlinks off;
-
-    # Path to the root of your installation
-    root /usr/share/webapps/nextcloud;
-
-    # Use Mozilla's guidelines for SSL/TLS settings
-    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
-    include conf.d/ssl;
-
-    # HSTS settings
-    # WARNING: Only add the preload option once you read about
-    # the consequences in https://hstspreload.org/. This option
-    # will add the domain to a hardcoded list that is shipped
-    # in all major browsers and getting removed from this list
-    # could take several months.
-    #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
-
-    # set max upload size and increase upload timeout:
-    client_max_body_size 16G;
-    client_body_timeout 300s;
-    fastcgi_buffers 64 4K;
-
-    # Enable gzip but do not remove ETag headers
-    gzip on;
-    gzip_vary on;
-    gzip_comp_level 4;
-    gzip_min_length 256;
-    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-    gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-    # Pagespeed is not supported by Nextcloud, so if your server is built
-    # with the `ngx_pagespeed` module, uncomment this line to disable it.
-    #pagespeed off;
-
-    # The settings allows you to optimize the HTTP2 bandwitdth.
-    # See https://blog.cloudflare.com/delivering-http-2-upload-speed-improvements/
-    # for tunning hints
-    client_body_buffer_size 512k;
-
-    # HTTP response headers borrowed from Nextcloud `.htaccess`
-    add_header Referrer-Policy "no-referrer" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Download-Options "noopen" always;
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Permitted-Cross-Domain-Policies "none" always;
-    add_header X-Robots-Tag "noindex, nofollow" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-
-    # Remove X-Powered-By, which is an information leak
-    fastcgi_hide_header X-Powered-By;
-
-    # Add .mjs as a file extension for javascript
-    # Either include it in the default mime.types list
-    # or include you can include that list explicitly and add the file extension
-    # only for Nextcloud like below:
-    include mime.types;
-    types {
-        application/javascript js mjs;
-    }
-
-    # Specify how to handle directories -- specifying `/index.php$request_uri`
-    # here as the fallback means that Nginx always exhibits the desired behaviour
-    # when a client requests a path that corresponds to a directory that exists
-    # on the server. In particular, if that directory contains an index.php file,
-    # that file is correctly served; if it doesn't, then the request is passed to
-    # the front-end controller. This consistent behaviour means that we don't need
-    # to specify custom rules for certain paths (e.g. images and other assets,
-    # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus
-    # `try_files $uri $uri/ /index.php$request_uri`
-    # always provides the desired behaviour.
-    index index.php index.html /index.php$request_uri;
-
-    # Rule borrowed from `.htaccess` to handle Microsoft DAV clients
-    location = / {
-        if ( $http_user_agent ~ ^DavClnt ) {
-            return 302 /remote.php/webdav/$is_args$args;
-        }
-    }
-
-    location = /robots.txt {
-        allow all;
-        log_not_found off;
-        access_log off;
-    }
-
-    # Make a regex exception for `/.well-known` so that clients can still
-    # access it despite the existence of the regex rule
-    # `location ~ /(\.|autotest|...)` which would otherwise handle requests
-    # for `/.well-known`.
-    location ^~ /.well-known {
-        # The rules in this block are an adaptation of the rules
-        # in `.htaccess` that concern `/.well-known`.
-
-        location = /.well-known/carddav {
-            return 301 /remote.php/dav/;
-        }
-        location = /.well-known/caldav {
-            return 301 /remote.php/dav/;
-        }
-
-        location /.well-known/acme-challenge {
-            try_files $uri $uri/ =404;
-        }
-        location /.well-known/pki-validation {
-            try_files $uri $uri/ =404;
-        }
-
-        # Let Nextcloud's API for `/.well-known` URIs handle all other
-        # requests by passing them to the front-end controller.
-        return 301 /index.php$request_uri;
-    }
-
-    # Rules borrowed from `.htaccess` to hide certain paths from clients
-    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) {
-        return 404;
-    }
-    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
-        return 404;
-    }
-
-    # Ensure this block, which passes PHP files to the PHP process, is above the blocks
-    # which handle static assets (as seen below). If this block is not declared first,
-    # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php`
-    # to the URI, resulting in a HTTP 500 error response.
-    location ~ \.php(?:$|/) {
-        # Required for legacy support
-        rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy) /index.php$request_uri;
-
-        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-        set $path_info $fastcgi_path_info;
-
-        try_files $fastcgi_script_name =404;
-
-        include fastcgi_params;
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_param PATH_INFO $path_info;
-        fastcgi_param HTTPS on;
-
-        fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice
-        fastcgi_param front_controller_active true; # Enable pretty urls
-        fastcgi_pass php-handler;
-
-        fastcgi_intercept_errors on;
-        fastcgi_request_buffering off;
-
-        fastcgi_max_temp_file_size 0;
-    }
-
-    location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
-        try_files $uri /index.php$request_uri;
-        add_header Cache-Control "public, max-age=15778463, $asset_immutable";
-        access_log off; # Optional: Don't log access to assets
-
-        location ~ \.wasm$ {
-            default_type application/wasm;
-        }
-    }
-
-    location ~ \.woff2?$ {
-        try_files $uri /index.php$request_uri;
-        expires 7d; # Cache-Control policy borrowed from `.htaccess`
-        access_log off; # Optional: Don't log access to assets
-    }
-
-    # Rule borrowed from `.htaccess`
-    location /remote {
-        return 301 /remote.php$request_uri;
-    }
-
-    location / {
-        try_files $uri $uri/ /index.php$request_uri;
-    }
-}

nginx.conf

@@ -0,0 +1,22 @@
+# SSL
+ssl_certificate /etc/letsencrypt/live/exozy.me/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/exozy.me/privkey.pem;
+include /etc/letsencrypt/options-ssl-nginx.conf;
+ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+add_header Strict-Transport-Security "max-age=63072000" always;
+ssl_stapling on;
+ssl_stapling_verify on;
+ssl_trusted_certificate /etc/letsencrypt/live/exozy.me/chain.pem;
+
+# Log to system journal
+access_log syslog:server=unix:/dev/log;
+error_log syslog:server=unix:/dev/log;
+
+# Disable symlinks so users can't make nginx follow symlinks to sensitive files
+disable_symlinks if_not_owner;
+
+# Force UTF-8 because why not
+charset utf-8;
+
+# Yay HTTP/2!
+http2 on;

nvpie.conf

@@ -6,7 +6,7 @@ server {
     ssl_certificate /etc/letsencrypt/live/neovoid.is-cool.dev/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/neovoid.is-cool.dev/privkey.pem;
 
-    root /srv/http/pages/nvpie;
+    root /srv/http/nvpie;
     index index.html;
 
     location / {

pages.conf

@@ -1,36 +1,10 @@
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name ~^(\d)\.exozy\.me;
-
-    include conf.d/ssl;
-
-    index index.html;
-
-    location / {
-        # https://serverfault.com/questions/638505/nginx-dynamic-proxy-pass-doesnt-resolve-properly
-        proxy_pass http://127.0.0.1:420$1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        # Proxy WebSockets
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "Upgrade";
-    }
-}
-
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
     server_name ~^(?<page>.+)\.exozy\.me;
 
-    include conf.d/ssl;
-
-    root /srv/http/pages/$page;
-    index index.html;
+    root /srv/http/$page;
+    index index.html index.txt;
 
     error_page 502 404 /404.html;
     location = /404.html {
@@ -42,7 +16,7 @@ server {
     }
 
     location @fallback {
-        proxy_pass http://unix:/srv/http/pages/$page;
+        proxy_pass http://unix:/srv/http/$page;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -52,5 +26,7 @@ server {
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "Upgrade";
+
+        client_max_body_size 20M;
     }
 }

peertube.conf

@@ -1,247 +0,0 @@
-# Minimum Nginx version required:  1.13.0 (released Apr 25, 2017)
-# Please check your Nginx installation features the following modules via 'nginx -V':
-# STANDARD HTTP MODULES: Core, Proxy, Rewrite, Access, Gzip, Headers, HTTP/2, Log, Real IP, SSL, Thread Pool, Upstream, AIO Multithreading.
-# THIRD PARTY MODULES:   None.
-
-upstream backend {
-    server [::1]:9000; # https://framacolibri.org/t/listen-to-unix-socket-instead-of-localhost-9000/5348
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name tube.exozy.me;
-    ##
-    # Certificates
-    # you need a certificate to run in production. see https://letsencrypt.org/
-    ##
-    include conf.d/ssl;
-
-    ##
-    # Application
-    ##
-
-    location @api {
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-
-        client_max_body_size 100k; # default is 1M
-
-        proxy_connect_timeout 10m;
-        proxy_send_timeout 10m;
-        proxy_read_timeout 10m;
-        send_timeout 10m;
-
-        proxy_pass http://backend;
-    }
-
-    location / {
-        try_files /dev/null @api;
-    }
-
-    location = /api/v1/videos/upload-resumable {
-        client_max_body_size 0;
-        proxy_request_buffering off;
-
-        try_files /dev/null @api;
-    }
-
-    location ~ ^/api/v1/videos/(upload|([^/]+/studio/edit))$ {
-        limit_except POST HEAD {
-            deny all;
-        }
-
-        # This is the maximum upload size, which roughly matches the maximum size of a video file.
-        # Note that temporary space is needed equal to the total size of all concurrent uploads.
-        # This data gets stored in /var/lib/nginx by default, so you may want to put this directory
-        # on a dedicated filesystem.
-        client_max_body_size 12G; # default is 1M
-        add_header X-File-Maximum-Size 8G always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
-
-        try_files /dev/null @api;
-    }
-
-    location ~ ^/api/v1/runners/jobs/[^/]+/(update|success)$ {
-        client_max_body_size 12G; # default is 1M
-        add_header X-File-Maximum-Size 8G always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
-
-        try_files /dev/null @api;
-    }
-
-    location ~ ^/api/v1/(videos|video-playlists|video-channels|users/me) {
-        client_max_body_size 6M; # default is 1M
-        add_header X-File-Maximum-Size 4M always; # inform backend of the set value in bytes before mime-encoding (x * 1.4 >= client_max_body_size)
-
-        try_files /dev/null @api;
-    }
-
-    ##
-    # Websocket
-    ##
-
-    location @api_websocket {
-        proxy_http_version 1.1;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-
-        proxy_pass http://backend;
-    }
-
-    location /socket.io {
-        try_files /dev/null @api_websocket;
-    }
-
-    location /tracker/socket {
-        # Peers send a message to the tracker every 15 minutes
-        # Don't close the websocket before then
-        proxy_read_timeout 15m; # default is 60s
-
-        try_files /dev/null @api_websocket;
-    }
-
-    # Plugin websocket routes
-    location ~ ^/plugins/[^/]+(/[^/]+)?/ws/ {
-        try_files /dev/null @api_websocket;
-    }
-
-    ##
-    # Performance optimizations
-    # For extra performance please refer to https://github.com/denji/nginx-tuning
-    ##
-
-    root /var/lib/peertube/storage;
-
-    # Enable compression for JS/CSS/HTML, for improved client load times.
-    # It might be nice to compress JSON/XML as returned by the API, but
-    # leaving that out to protect against potential BREACH attack.
-    gzip on;
-    gzip_vary on;
-    gzip_types # text/html is always compressed by HttpGzipModule
-    text/css
-    application/javascript
-    font/truetype
-    font/opentype
-    application/vnd.ms-fontobject
-    image/svg+xml;
-    gzip_min_length 1000; # default is 20 bytes
-    gzip_buffers 16 8k;
-    gzip_comp_level 2; # default is 1
-
-    client_body_timeout 30s; # default is 60
-    client_header_timeout 10s; # default is 60
-    send_timeout 10s; # default is 60
-    keepalive_timeout 10s; # default is 75
-    resolver_timeout 10s; # default is 30
-    reset_timedout_connection on;
-    proxy_ignore_client_abort on;
-
-    tcp_nopush on; # send headers in one piece
-    tcp_nodelay on; # don't buffer data sent, good for small data bursts in real time
-
-    # If you have a small /var/lib partition, it could be interesting to store temp nginx uploads in a different place
-    # See https://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_temp_path
-    #client_body_temp_path /var/lib/peertube/storage/nginx/;
-
-    # Bypass PeerTube for performance reasons. Optional.
-    # Should be consistent with client-overrides assets list in /server/controllers/client.ts
-    location ~ ^/client/(assets/images/(icons/icon-36x36\.png|icons/icon-48x48\.png|icons/icon-72x72\.png|icons/icon-96x96\.png|icons/icon-144x144\.png|icons/icon-192x192\.png|icons/icon-512x512\.png|logo\.svg|favicon\.png|default-playlist\.jpg|default-avatar-account\.png|default-avatar-account-48x48\.png|default-avatar-video-channel\.png|default-avatar-video-channel-48x48\.png))$ {
-        add_header Cache-Control "public, max-age=31536000, immutable"; # Cache 1 year
-
-        root /var/lib/peertube;
-
-        try_files /storage/client-overrides/$1 /peertube-latest/client/dist/$1 @api;
-    }
-
-    # Bypass PeerTube for performance reasons. Optional.
-    location ~ ^/client/(.*\.(js|css|png|svg|woff2|otf|ttf|woff|eot))$ {
-        add_header Cache-Control "public, max-age=31536000, immutable"; # Cache 1 year
-
-        alias /usr/share/webapps/peertube/client/dist/$1;
-    }
-
-    # Bypass PeerTube for performance reasons. Optional.
-    location ~ ^/static/(thumbnails|avatars)/ {
-        if ($request_method = 'OPTIONS') {
-            add_header Access-Control-Allow-Origin '*';
-            add_header Access-Control-Allow-Methods 'GET, OPTIONS';
-            add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
-            add_header Access-Control-Max-Age 1728000; # Preflight request can be cached 20 days
-            add_header Content-Type 'text/plain charset=UTF-8';
-            add_header Content-Length 0;
-            return 204;
-        }
-
-        add_header Access-Control-Allow-Origin '*';
-        add_header Access-Control-Allow-Methods 'GET, OPTIONS';
-        add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
-        add_header Cache-Control "public, max-age=7200"; # Cache response 2 hours
-
-        rewrite ^/static/(.*)$ /$1 break;
-
-        try_files $uri @api;
-    }
-
-    location ~ ^(/static/(webseed|streaming-playlists)/private/)|^/download {
-        # We can't rate limit a try_files directive, so we need to duplicate @api
-
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-
-        proxy_limit_rate 5M;
-
-        proxy_pass http://backend;
-    }
-
-    # Bypass PeerTube for performance reasons. Optional.
-    location ~ ^/static/(webseed|redundancy|streaming-playlists)/ {
-        limit_rate_after 5M;
-
-        # Clients usually have 4 simultaneous webseed connections, so the real limit is 3MB/s per client
-        set $peertube_limit_rate 800k;
-
-        # Increase rate limit in HLS mode, because we don't have multiple simultaneous connections
-        if ($request_uri ~ -fragmented.mp4$) {
-            set $peertube_limit_rate 5M;
-        }
-
-        # Use this line with nginx >= 1.17.0
-        limit_rate $peertube_limit_rate;
-        # Or this line with nginx < 1.17.0
-        # set $limit_rate $peertube_limit_rate;
-
-        if ($request_method = 'OPTIONS') {
-            add_header Access-Control-Allow-Origin '*';
-            add_header Access-Control-Allow-Methods 'GET, OPTIONS';
-            add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
-            add_header Access-Control-Max-Age 1728000; # Preflight request can be cached 20 days
-            add_header Content-Type 'text/plain charset=UTF-8';
-            add_header Content-Length 0;
-            return 204;
-        }
-
-        if ($request_method = 'GET') {
-            add_header Access-Control-Allow-Origin '*';
-            add_header Access-Control-Allow-Methods 'GET, OPTIONS';
-            add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
-
-            # Don't spam access log file with byte range requests
-            access_log off;
-        }
-
-        # Enabling the sendfile directive eliminates the step of copying the data into the buffer
-        # and enables direct copying data from one file descriptor to another.
-        sendfile on;
-        sendfile_max_chunk 1M; # prevent one fast connection from entirely occupying the worker process. should be > 800k.
-        aio threads;
-
-        rewrite ^/static/webseed/(.*)$ /videos/$1 break;
-        rewrite ^/static/(.*)$ /$1 break;
-
-        try_files $uri @api;
-    }
-}

pranav.conf

@@ -7,7 +7,7 @@ server {
     ssl_certificate_key /home/pranav/.local/share/cert/karawale.in/key.pem;
 
     location / {
-        proxy_pass http://unix:/srv/http/pages/pranav;
+        proxy_pass http://unix:/srv/http/pranav;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

redirect.conf

@@ -1,11 +0,0 @@
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name ta180m.exozy.me;
-
-    include conf.d/ssl;
-
-    location / {
-        return 301 https://a.exozy.me$request_uri;
-    }
-}

safetwitch.conf

@@ -1,14 +0,0 @@
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    server_name safetwitch.exozy.me;
-
-    include conf.d/ssl;
-
-    root /srv/http/pages/safetwitch;
-    index index.html;
-
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
-}

ssl

@@ -1,8 +0,0 @@
-ssl_certificate /etc/letsencrypt/live/exozy.me/fullchain.pem;
-ssl_certificate_key /etc/letsencrypt/live/exozy.me/privkey.pem;
-include /etc/letsencrypt/options-ssl-nginx.conf;
-ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-add_header Strict-Transport-Security "max-age=31536000" always;
-ssl_trusted_certificate /etc/letsencrypt/live/exozy.me/chain.pem;
-ssl_stapling on;
-ssl_stapling_verify on;

synapse.conf

@@ -1,22 +0,0 @@
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-
-    server_name chat.exozy.me;
-
-    include conf.d/ssl;
-
-    location / {
-        proxy_pass http://localhost:8008;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Host $host;
-
-        # Nginx by default only allows file uploads up to 1M in size
-        # Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
-        client_max_body_size 1G;
-
-        # Stop access_log spam
-        access_log off;
-    }
-}

woodpecker.conf

@@ -3,8 +3,6 @@ server {
     listen [::]:443 ssl;
     server_name ci.exozy.me;
 
-    include conf.d/ssl;
-
     location / {
         proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;

x.conf

@@ -0,0 +1,76 @@
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name pb.exozy.me;
+
+    location / {
+        proxy_pass http://localhost:7631;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name memos.exozy.me;
+
+    location / {
+        proxy_pass http://localhost:7632;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name reddit.exozy.me;
+
+    if ($http_user_agent = "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)") {
+        return 444;
+    }
+
+    location / {
+        proxy_pass http://localhost:7633;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name rssbridge.exozy.me;
+
+    location / {
+        proxy_pass http://localhost:7634;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name exonus.eu.org;
+
+    ssl_certificate /etc/letsencrypt/live/exonus.eu.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/exonus.eu.org/privkey.pem;
+
+    location / {
+        proxy_pass http://localhost:5231;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}

xtex.conf

@@ -9,7 +9,7 @@ server {
     add_header Server exozyme;
 
     location / {
-        proxy_pass http://unix:/srv/http/pages/xtexhome;
+        proxy_pass http://unix:/srv/http/xtexhome;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -33,7 +33,7 @@ server {
     add_header Server exozyme;
 
     location / {
-        proxy_pass http://unix:/srv/http/pages/xtexblog;
+        proxy_pass http://unix:/srv/http/xtexblog;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;