8.0 KiB
8.0 KiB
Old NGINX Config
-> % cat /etc/nginx/sites-available/zserver
server {
server_name zainezq.com;
access_log /var/log/nginx/zserver.access.log combined;
error_log /var/log/nginx/zserver.error.log warn;
# Basic authentication for the entire server
auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/.htpasswd;
# Root location
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_redirect off;
root /home/zaine/master-folder/org_files/org_web/output;
index index.html index.htm;
try_files $uri $uri/ =404;
}
location /nginx_status {
stub_status;
}
location /dockge/ {
proxy_pass http://127.0.0.1:5021/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /guac/ {
proxy_pass http://127.0.0.1:3003/guacamole/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
# PGAdmin4 location
location /pgadmin4/ {
proxy_set_header X-Script-Name /pgadmin4;
proxy_set_header Host $host;
proxy_pass http://127.0.0.1:5050;
proxy_redirect off;
}
location /pdf/ {
proxy_pass http://127.0.0.1:8002/pdf/;
proxy_set_header X-Script-Name /pdf;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_redirect off;
}
location /calibre {
proxy_bind $server_addr;
proxy_pass http://127.0.0.1:8083;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Script-Name /calibre; # IMPORTANT: path has NO trailing slash
# This rewrites Calibre-Web's internal paths
proxy_redirect off;
proxy_http_version 1.1;
client_max_body_size 100M;
}
location /codeserver/ {
proxy_pass http://localhost:8441/;
rewrite ^/codeserver(/.*)$ $1 break;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Accept-Encoding gzip;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /filebrowser {
# prevents 502 bad gateway error
proxy_buffers 8 32k;
proxy_buffer_size 64k;
client_max_body_size 75M;
# redirect all HTTP traffic to localhost:8088;
proxy_pass http://127.0.0.1:9991;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header X-NginX-Proxy true;
# enables WS support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_read_timeout 999999999;
}
# Miniflux location
location /miniflux/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:9433/miniflux/;
proxy_redirect off;
}
# Jupyter location
location /jupyter/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:8888/jupyter/;
proxy_redirect off;
# WebSocket support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
location /portainer/ {
proxy_pass https://localhost:9443/;
proxy_ssl_verify off; # Because Portainer uses a self-signed cert by default
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Authorization "";
# Required for WebSocket support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Rewrite URL base path
rewrite ^/portainer(/.*)$ $1 break;
}
location /wireguard/ {
proxy_pass http://127.0.0.1:124/;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# Rewrite assets for subpath compatibility
proxy_set_header Accept-Encoding "";
sub_filter 'href="/' 'href="/wireguard/';
sub_filter 'src="/' 'src="/wireguard/';
sub_filter_types text/css application/javascript;
sub_filter_once off;
}
# /password -> /password/
location = /password { return 301 /password/; }
# Main app/API (disable inherited basic auth here)
location ^~ /password/ {
auth_basic off;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# WebSockets
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Keep the /password prefix upstream (NO trailing slash here)
proxy_pass http://127.0.0.1:8006;
}
# (Optional but tidy) If you keep a dedicated WS block, disable auth there too
location ^~ /password/notifications/hub {
auth_basic off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_pass http://127.0.0.1:8006;
}
# Optional: Add a custom error page
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
# Optional: Cache static assets for performance (add this new block)
# location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot|svg|html|htm)$ {
# root /home/zaine/master-folder/org_files/org_web/output;
# expires 30d;
# access_log off;
# }
# Optional: Deny access to hidden files
location ~ /\. {
deny all;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/zainezq.com-0001/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/zainezq.com-0001/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = zserver.zapto.org) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name zserver.zapto.org;
return 404; # managed by Certbot
}