:PROPERTIES:
:ID:       a9829b5d-690d-4a21-ba94-ac8beac4d439
:END:
#+title: Old NGINX Config
#+filetags: :server:


#+begin_src bash


  -> % cat /etc/nginx/sites-available/zserver


  server {
      server_name zainezq.com;

      access_log /var/log/nginx/zserver.access.log combined;
      error_log  /var/log/nginx/zserver.error.log warn;
      # Basic authentication for the entire server
      auth_basic "Restricted Access";
      auth_basic_user_file /etc/nginx/.htpasswd;

      # Root location
      location / {
  	proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_redirect off;

  	root /home/zaine/master-folder/org_files/org_web/output;
          index index.html index.htm;
          try_files $uri $uri/ =404;
      }

  location /nginx_status {
  	stub_status;
   }

  location /dockge/ {
      proxy_pass http://127.0.0.1:5021/;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
  }



  location /guac/ {
      proxy_pass http://127.0.0.1:3003/guacamole/;
      proxy_http_version 1.1;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
  }

      # PGAdmin4 location
      location /pgadmin4/ {
          proxy_set_header X-Script-Name /pgadmin4;
          proxy_set_header Host $host;
          proxy_pass http://127.0.0.1:5050;
          proxy_redirect off;
      }
      
      location /pdf/ {
  	proxy_pass http://127.0.0.1:8002/pdf/;
  	proxy_set_header X-Script-Name /pdf;
  	proxy_set_header X-Real-IP $remote_addr;
  	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  	proxy_set_header Host $host;
  	proxy_redirect off;
      }

      location /calibre {
          proxy_bind              $server_addr;
          proxy_pass              http://127.0.0.1:8083;
          proxy_set_header        Host            $http_host;
          proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header        X-Scheme        $scheme;
          proxy_set_header        X-Script-Name   /calibre;  # IMPORTANT: path has NO trailing slash 
          # This rewrites Calibre-Web's internal paths
  	proxy_redirect off;
          proxy_http_version 1.1;
  	client_max_body_size 100M;
      }


      location /codeserver/ {
  	proxy_pass http://localhost:8441/;
  	rewrite ^/codeserver(/.*)$ $1 break;

  	proxy_set_header Host $host;
  	proxy_set_header Upgrade $http_upgrade;
  	proxy_set_header Connection "upgrade";
  	proxy_set_header Accept-Encoding gzip;
  	proxy_set_header X-Real-IP $remote_addr;
  	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  	proxy_set_header X-Forwarded-Proto $scheme;
      }

      location /filebrowser {
  	# prevents 502 bad gateway error
  	proxy_buffers 8 32k;
  	proxy_buffer_size 64k;

  	client_max_body_size 75M;

  	# redirect all HTTP traffic to localhost:8088;
  	proxy_pass http://127.0.0.1:9991;
  	proxy_set_header X-Real-IP $remote_addr;
  	proxy_set_header Host $http_host;
  	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  	#proxy_set_header X-NginX-Proxy true;

  	# enables WS support
  	proxy_http_version 1.1;
  	proxy_set_header Upgrade $http_upgrade;
  	proxy_set_header Connection "upgrade";

  	proxy_read_timeout 999999999;
      }


      # Miniflux location
      location /miniflux/ {
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_pass http://127.0.0.1:9433/miniflux/;
          proxy_redirect off;
      }

      # Jupyter location
      location /jupyter/ {
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_pass http://127.0.0.1:8888/jupyter/;
          proxy_redirect off;

  	# WebSocket support
  	proxy_http_version 1.1;
  	proxy_set_header Upgrade $http_upgrade;
  	proxy_set_header Connection "Upgrade";
      }

      location /portainer/ {
          proxy_pass https://localhost:9443/;
          proxy_ssl_verify off;  # Because Portainer uses a self-signed cert by default
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
  	proxy_set_header Authorization "";
          # Required for WebSocket support
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";

          # Rewrite URL base path
          rewrite ^/portainer(/.*)$ $1 break;
      }

  location /wireguard/ {
      proxy_pass http://127.0.0.1:124/;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # Rewrite assets for subpath compatibility
      proxy_set_header Accept-Encoding "";
      sub_filter 'href="/' 'href="/wireguard/';
      sub_filter 'src="/' 'src="/wireguard/';
      sub_filter_types text/css application/javascript;
      sub_filter_once off;
  }

  # /password -> /password/
  location = /password { return 301 /password/; }

  # Main app/API (disable inherited basic auth here)
  location ^~ /password/ {
      auth_basic off;

      proxy_http_version 1.1;
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # WebSockets
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      # Keep the /password prefix upstream (NO trailing slash here)
      proxy_pass http://127.0.0.1:8006;
  }

  # (Optional but tidy) If you keep a dedicated WS block, disable auth there too
  location ^~ /password/notifications/hub {
      auth_basic off;

      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;

      proxy_pass http://127.0.0.1:8006;
  }


      # Optional: Add a custom error page
      error_page 500 502 503 504 /50x.html;
      location = /50x.html {
          root /usr/share/nginx/html;
      }

      # Optional: Cache static assets for performance (add this new block)
  #    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot|svg|html|htm)$ {
  #        root /home/zaine/master-folder/org_files/org_web/output;
  #        expires 30d;
  #        access_log off;
  #    }

      # Optional: Deny access to hidden files
      location ~ /\. {
          deny all;
      }

      listen 443 ssl; # managed by Certbot
      ssl_certificate /etc/letsencrypt/live/zainezq.com-0001/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/zainezq.com-0001/privkey.pem; # managed by Certbot
      include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot





  }


  server {
      if ($host = zserver.zapto.org) {
          return 301 https://$host$request_uri;
      } # managed by Certbot

      listen 80;
      server_name zserver.zapto.org;
      return 404; # managed by Certbot
  } 

#+end_src
