266 lines
8.0 KiB
Org Mode
266 lines
8.0 KiB
Org Mode
:PROPERTIES:
|
|
:ID: a9829b5d-690d-4a21-ba94-ac8beac4d439
|
|
:END:
|
|
#+title: Old NGINX Config
|
|
#+filetags: :server:
|
|
|
|
|
|
#+begin_src bash
|
|
|
|
|
|
-> % cat /etc/nginx/sites-available/zserver
|
|
|
|
|
|
server {
|
|
server_name zainezq.com;
|
|
|
|
access_log /var/log/nginx/zserver.access.log combined;
|
|
error_log /var/log/nginx/zserver.error.log warn;
|
|
# Basic authentication for the entire server
|
|
auth_basic "Restricted Access";
|
|
auth_basic_user_file /etc/nginx/.htpasswd;
|
|
|
|
# Root location
|
|
location / {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_redirect off;
|
|
|
|
root /home/zaine/master-folder/org_files/org_web/output;
|
|
index index.html index.htm;
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
|
|
location /nginx_status {
|
|
stub_status;
|
|
}
|
|
|
|
location /dockge/ {
|
|
proxy_pass http://127.0.0.1:5021/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
|
|
|
|
location /guac/ {
|
|
proxy_pass http://127.0.0.1:3003/guacamole/;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
|
|
# PGAdmin4 location
|
|
location /pgadmin4/ {
|
|
proxy_set_header X-Script-Name /pgadmin4;
|
|
proxy_set_header Host $host;
|
|
proxy_pass http://127.0.0.1:5050;
|
|
proxy_redirect off;
|
|
}
|
|
|
|
location /pdf/ {
|
|
proxy_pass http://127.0.0.1:8002/pdf/;
|
|
proxy_set_header X-Script-Name /pdf;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header Host $host;
|
|
proxy_redirect off;
|
|
}
|
|
|
|
location /calibre {
|
|
proxy_bind $server_addr;
|
|
proxy_pass http://127.0.0.1:8083;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Scheme $scheme;
|
|
proxy_set_header X-Script-Name /calibre; # IMPORTANT: path has NO trailing slash
|
|
# This rewrites Calibre-Web's internal paths
|
|
proxy_redirect off;
|
|
proxy_http_version 1.1;
|
|
client_max_body_size 100M;
|
|
}
|
|
|
|
|
|
location /codeserver/ {
|
|
proxy_pass http://localhost:8441/;
|
|
rewrite ^/codeserver(/.*)$ $1 break;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Accept-Encoding gzip;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /filebrowser {
|
|
# prevents 502 bad gateway error
|
|
proxy_buffers 8 32k;
|
|
proxy_buffer_size 64k;
|
|
|
|
client_max_body_size 75M;
|
|
|
|
# redirect all HTTP traffic to localhost:8088;
|
|
proxy_pass http://127.0.0.1:9991;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
#proxy_set_header X-NginX-Proxy true;
|
|
|
|
# enables WS support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
proxy_read_timeout 999999999;
|
|
}
|
|
|
|
|
|
# Miniflux location
|
|
location /miniflux/ {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_pass http://127.0.0.1:9433/miniflux/;
|
|
proxy_redirect off;
|
|
}
|
|
|
|
# Jupyter location
|
|
location /jupyter/ {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_pass http://127.0.0.1:8888/jupyter/;
|
|
proxy_redirect off;
|
|
|
|
# WebSocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "Upgrade";
|
|
}
|
|
|
|
location /portainer/ {
|
|
proxy_pass https://localhost:9443/;
|
|
proxy_ssl_verify off; # Because Portainer uses a self-signed cert by default
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header Authorization "";
|
|
# Required for WebSocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
# Rewrite URL base path
|
|
rewrite ^/portainer(/.*)$ $1 break;
|
|
}
|
|
|
|
location /wireguard/ {
|
|
proxy_pass http://127.0.0.1:124/;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "Upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Rewrite assets for subpath compatibility
|
|
proxy_set_header Accept-Encoding "";
|
|
sub_filter 'href="/' 'href="/wireguard/';
|
|
sub_filter 'src="/' 'src="/wireguard/';
|
|
sub_filter_types text/css application/javascript;
|
|
sub_filter_once off;
|
|
}
|
|
|
|
# /password -> /password/
|
|
location = /password { return 301 /password/; }
|
|
|
|
# Main app/API (disable inherited basic auth here)
|
|
location ^~ /password/ {
|
|
auth_basic off;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# WebSockets
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
# Keep the /password prefix upstream (NO trailing slash here)
|
|
proxy_pass http://127.0.0.1:8006;
|
|
}
|
|
|
|
# (Optional but tidy) If you keep a dedicated WS block, disable auth there too
|
|
location ^~ /password/notifications/hub {
|
|
auth_basic off;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
|
|
proxy_pass http://127.0.0.1:8006;
|
|
}
|
|
|
|
|
|
# Optional: Add a custom error page
|
|
error_page 500 502 503 504 /50x.html;
|
|
location = /50x.html {
|
|
root /usr/share/nginx/html;
|
|
}
|
|
|
|
# Optional: Cache static assets for performance (add this new block)
|
|
# location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot|svg|html|htm)$ {
|
|
# root /home/zaine/master-folder/org_files/org_web/output;
|
|
# expires 30d;
|
|
# access_log off;
|
|
# }
|
|
|
|
# Optional: Deny access to hidden files
|
|
location ~ /\. {
|
|
deny all;
|
|
}
|
|
|
|
listen 443 ssl; # managed by Certbot
|
|
ssl_certificate /etc/letsencrypt/live/zainezq.com-0001/fullchain.pem; # managed by Certbot
|
|
ssl_certificate_key /etc/letsencrypt/live/zainezq.com-0001/privkey.pem; # managed by Certbot
|
|
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
server {
|
|
if ($host = zserver.zapto.org) {
|
|
return 301 https://$host$request_uri;
|
|
} # managed by Certbot
|
|
|
|
listen 80;
|
|
server_name zserver.zapto.org;
|
|
return 404; # managed by Certbot
|
|
}
|
|
|
|
#+end_src
|