org_roam/20251109205925-old_nginx_code.org

:PROPERTIES:
:ID:       a9829b5d-690d-4a21-ba94-ac8beac4d439
:END:
#+title: old_nginx_code
#+filetags: :server:



-> % cat /etc/nginx/sites-available/zserver


server {
    server_name zainezq.com;

    access_log /var/log/nginx/zserver.access.log combined;
    error_log  /var/log/nginx/zserver.error.log warn;
    # Basic authentication for the entire server
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # Root location
    location / {
	proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;

	root /home/zaine/master-folder/org_files/org_web/output;
        index index.html index.htm;
        try_files $uri $uri/ =404;
    }

location /nginx_status {
	stub_status;
 }

location /dockge/ {
    proxy_pass http://127.0.0.1:5021/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}



location /guac/ {
    proxy_pass http://127.0.0.1:3003/guacamole/;
    proxy_http_version 1.1;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
}

    # PGAdmin4 location
    location /pgadmin4/ {
        proxy_set_header X-Script-Name /pgadmin4;
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:5050;
        proxy_redirect off;
    }
    
    location /pdf/ {
	proxy_pass http://127.0.0.1:8002/pdf/;
	proxy_set_header X-Script-Name /pdf;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header Host $host;
	proxy_redirect off;
    }

    location /calibre {
        proxy_bind              $server_addr;
        proxy_pass              http://127.0.0.1:8083;
        proxy_set_header        Host            $http_host;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Scheme        $scheme;
        proxy_set_header        X-Script-Name   /calibre;  # IMPORTANT: path has NO trailing slash 
        # This rewrites Calibre-Web's internal paths
	proxy_redirect off;
        proxy_http_version 1.1;
	client_max_body_size 100M;
    }


    location /codeserver/ {
	proxy_pass http://localhost:8441/;
	rewrite ^/codeserver(/.*)$ $1 break;

	proxy_set_header Host $host;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "upgrade";
	proxy_set_header Accept-Encoding gzip;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /filebrowser {
	# prevents 502 bad gateway error
	proxy_buffers 8 32k;
	proxy_buffer_size 64k;

	client_max_body_size 75M;

	# redirect all HTTP traffic to localhost:8088;
	proxy_pass http://127.0.0.1:9991;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header Host $http_host;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	#proxy_set_header X-NginX-Proxy true;

	# enables WS support
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "upgrade";

	proxy_read_timeout 999999999;
    }


    # Miniflux location
    location /miniflux/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:9433/miniflux/;
        proxy_redirect off;
    }

    # Jupyter location
    location /jupyter/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:8888/jupyter/;
        proxy_redirect off;

	# WebSocket support
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "Upgrade";
    }

    location /portainer/ {
        proxy_pass https://localhost:9443/;
        proxy_ssl_verify off;  # Because Portainer uses a self-signed cert by default
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header Authorization "";
        # Required for WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Rewrite URL base path
        rewrite ^/portainer(/.*)$ $1 break;
    }

location /wireguard/ {
    proxy_pass http://127.0.0.1:124/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Rewrite assets for subpath compatibility
    proxy_set_header Accept-Encoding "";
    sub_filter 'href="/' 'href="/wireguard/';
    sub_filter 'src="/' 'src="/wireguard/';
    sub_filter_types text/css application/javascript;
    sub_filter_once off;
}

# /password -> /password/
location = /password { return 301 /password/; }

# Main app/API (disable inherited basic auth here)
location ^~ /password/ {
    auth_basic off;

    proxy_http_version 1.1;
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # WebSockets
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # Keep the /password prefix upstream (NO trailing slash here)
    proxy_pass http://127.0.0.1:8006;
}

# (Optional but tidy) If you keep a dedicated WS block, disable auth there too
location ^~ /password/notifications/hub {
    auth_basic off;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;

    proxy_pass http://127.0.0.1:8006;
}


    # Optional: Add a custom error page
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    # Optional: Cache static assets for performance (add this new block)
#    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot|svg|html|htm)$ {
#        root /home/zaine/master-folder/org_files/org_web/output;
#        expires 30d;
#        access_log off;
#    }

    # Optional: Deny access to hidden files
    location ~ /\. {
        deny all;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/zainezq.com-0001/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/zainezq.com-0001/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot





}


server {
    if ($host = zserver.zapto.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name zserver.zapto.org;
    return 404; # managed by Certbot
}