:PROPERTIES: :ID: a9829b5d-690d-4a21-ba94-ac8beac4d439 :END: #+title: Old NGINX Config #+filetags: :server: #+begin_src bash -> % cat /etc/nginx/sites-available/zserver server { server_name zainezq.com; access_log /var/log/nginx/zserver.access.log combined; error_log /var/log/nginx/zserver.error.log warn; # Basic authentication for the entire server auth_basic "Restricted Access"; auth_basic_user_file /etc/nginx/.htpasswd; # Root location location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_redirect off; root /home/zaine/master-folder/org_files/org_web/output; index index.html index.htm; try_files $uri $uri/ =404; } location /nginx_status { stub_status; } location /dockge/ { proxy_pass http://127.0.0.1:5021/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /guac/ { proxy_pass http://127.0.0.1:3003/guacamole/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; } # PGAdmin4 location location /pgadmin4/ { proxy_set_header X-Script-Name /pgadmin4; proxy_set_header Host $host; proxy_pass http://127.0.0.1:5050; proxy_redirect off; } location /pdf/ { proxy_pass http://127.0.0.1:8002/pdf/; proxy_set_header X-Script-Name /pdf; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_redirect off; } location /calibre { proxy_bind $server_addr; proxy_pass http://127.0.0.1:8083; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Scheme $scheme; proxy_set_header X-Script-Name /calibre; # IMPORTANT: path has NO trailing slash # This rewrites Calibre-Web's internal paths proxy_redirect off; proxy_http_version 1.1; client_max_body_size 100M; } location /codeserver/ { proxy_pass http://localhost:8441/; rewrite ^/codeserver(/.*)$ $1 break; proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Accept-Encoding gzip; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /filebrowser { # prevents 502 bad gateway error proxy_buffers 8 32k; proxy_buffer_size 64k; client_max_body_size 75M; # redirect all HTTP traffic to localhost:8088; proxy_pass http://127.0.0.1:9991; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #proxy_set_header X-NginX-Proxy true; # enables WS support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 999999999; } # Miniflux location location /miniflux/ { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://127.0.0.1:9433/miniflux/; proxy_redirect off; } # Jupyter location location /jupyter/ { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://127.0.0.1:8888/jupyter/; proxy_redirect off; # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; } location /portainer/ { proxy_pass https://localhost:9443/; proxy_ssl_verify off; # Because Portainer uses a self-signed cert by default proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Authorization ""; # Required for WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Rewrite URL base path rewrite ^/portainer(/.*)$ $1 break; } location /wireguard/ { proxy_pass http://127.0.0.1:124/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # Rewrite assets for subpath compatibility proxy_set_header Accept-Encoding ""; sub_filter 'href="/' 'href="/wireguard/'; sub_filter 'src="/' 'src="/wireguard/'; sub_filter_types text/css application/javascript; sub_filter_once off; } # /password -> /password/ location = /password { return 301 /password/; } # Main app/API (disable inherited basic auth here) location ^~ /password/ { auth_basic off; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # WebSockets proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # Keep the /password prefix upstream (NO trailing slash here) proxy_pass http://127.0.0.1:8006; } # (Optional but tidy) If you keep a dedicated WS block, disable auth there too location ^~ /password/notifications/hub { auth_basic off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_pass http://127.0.0.1:8006; } # Optional: Add a custom error page error_page 500 502 503 504 /50x.html; location = /50x.html { root /usr/share/nginx/html; } # Optional: Cache static assets for performance (add this new block) # location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot|svg|html|htm)$ { # root /home/zaine/master-folder/org_files/org_web/output; # expires 30d; # access_log off; # } # Optional: Deny access to hidden files location ~ /\. { deny all; } listen 443 ssl; # managed by Certbot ssl_certificate /etc/letsencrypt/live/zainezq.com-0001/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/zainezq.com-0001/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot } server { if ($host = zserver.zapto.org) { return 301 https://$host$request_uri; } # managed by Certbot listen 80; server_name zserver.zapto.org; return 404; # managed by Certbot } #+end_src