vault/Technical/Server/Old NGINX Code.md

note type, date, done

note type	date	done
server note	2026-06-03	true

-> % cat /etc/nginx/sites-available/zserver


server {
    server_name zainezq.com;

    access_log /var/log/nginx/zserver.access.log combined;
    error_log  /var/log/nginx/zserver.error.log warn;
    # Basic authentication for the entire server
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # Root location
    location / {
  proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;

  root /home/zaine/master-folder/org_files/org_web/output;
        index index.html index.htm;
        try_files $uri $uri/ =404;
    }

location /nginx_status {
  stub_status;
 }

location /dockge/ {
    proxy_pass http://127.0.0.1:5021/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}



location /guac/ {
    proxy_pass http://127.0.0.1:3003/guacamole/;
    proxy_http_version 1.1;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
}

    # PGAdmin4 location
    location /pgadmin4/ {
        proxy_set_header X-Script-Name /pgadmin4;
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:5050;
        proxy_redirect off;
    }

    location /pdf/ {
  proxy_pass http://127.0.0.1:8002/pdf/;
  proxy_set_header X-Script-Name /pdf;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Host $host;
  proxy_redirect off;
    }

    location /calibre {
        proxy_bind              $server_addr;
        proxy_pass              http://127.0.0.1:8083;
        proxy_set_header        Host            $http_host;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Scheme        $scheme;
        proxy_set_header        X-Script-Name   /calibre;  # IMPORTANT: path has NO trailing slash 
        # This rewrites Calibre-Web's internal paths
  proxy_redirect off;
        proxy_http_version 1.1;
  client_max_body_size 100M;
    }


    location /codeserver/ {
  proxy_pass http://localhost:8441/;
  rewrite ^/codeserver(/.*)$ $1 break;

  proxy_set_header Host $host;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
  proxy_set_header Accept-Encoding gzip;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /filebrowser {
  # prevents 502 bad gateway error
  proxy_buffers 8 32k;
  proxy_buffer_size 64k;

  client_max_body_size 75M;

  # redirect all HTTP traffic to localhost:8088;
  proxy_pass http://127.0.0.1:9991;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $http_host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  #proxy_set_header X-NginX-Proxy true;

  # enables WS support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";

  proxy_read_timeout 999999999;
    }


    # Miniflux location
    location /miniflux/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:9433/miniflux/;
        proxy_redirect off;
    }

    # Jupyter location
    location /jupyter/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:8888/jupyter/;
        proxy_redirect off;

  # WebSocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "Upgrade";
    }

    location /portainer/ {
        proxy_pass https://localhost:9443/;
        proxy_ssl_verify off;  # Because Portainer uses a self-signed cert by default
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header Authorization "";
        # Required for WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Rewrite URL base path
        rewrite ^/portainer(/.*)$ $1 break;
    }

location /wireguard/ {
    proxy_pass http://127.0.0.1:124/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Rewrite assets for subpath compatibility
    proxy_set_header Accept-Encoding "";
    sub_filter 'href="/' 'href="/wireguard/';
    sub_filter 'src="/' 'src="/wireguard/';
    sub_filter_types text/css application/javascript;
    sub_filter_once off;
}

# /password -> /password/
location = /password { return 301 /password/; }

# Main app/API (disable inherited basic auth here)
location ^~ /password/ {
    auth_basic off;

    proxy_http_version 1.1;
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # WebSockets
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # Keep the /password prefix upstream (NO trailing slash here)
    proxy_pass http://127.0.0.1:8006;
}

# (Optional but tidy) If you keep a dedicated WS block, disable auth there too
location ^~ /password/notifications/hub {
    auth_basic off;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;

    proxy_pass http://127.0.0.1:8006;
}


    # Optional: Add a custom error page
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    # Optional: Cache static assets for performance (add this new block)
#    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2|ttf|eot|svg|html|htm)$ {
#        root /home/zaine/master-folder/org_files/org_web/output;
#        expires 30d;
#        access_log off;
#    }

    # Optional: Deny access to hidden files
    location ~ /\. {
        deny all;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/zainezq.com-0001/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/zainezq.com-0001/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot





}


server {
    if ($host = zserver.zapto.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name zserver.zapto.org;
    return 404; # managed by Certbot
}