vps/roles/reverse-proxy/templates/reverse-proxy.conf

192 lines
4.2 KiB
Text
Raw Normal View History

2023-12-01 11:27:02 +01:00
# Redirect HTTP to HTTPS
server {
listen 80 default_server;
listen [::]:80 default_server;
2023-12-01 11:27:02 +01:00
server_name _;
return 308 https://$host$request_uri;
}
# Default HTTPS server
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name _;
server_name_in_redirect off;
return 404;
}
2024-02-17 19:01:04 +01:00
# Homepage
2023-12-01 11:27:02 +01:00
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name {{ domain }};
2023-12-01 11:27:02 +01:00
location = /.well-known/matrix/server {
default_type application/json;
2024-02-17 19:01:04 +01:00
return 200 '{ "m.server": "matrix.{{ domain }}:443" }';
}
2023-12-01 11:27:02 +01:00
location = /.well-known/matrix/client {
default_type application/json;
add_header Access-Control-Allow-Origin '*';
2024-02-17 19:01:04 +01:00
return 200 '{ "m.homeserver": { "base_url": "https://matrix.{{ domain }}" } }';
}
2023-12-01 11:27:02 +01:00
location / {
2024-02-17 19:01:04 +01:00
proxy_pass http://localhost:{{ ports['homepage'] }};
2023-12-01 11:27:02 +01:00
}
}
# Downloads
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name dl.{{ domain }};
root /var/www/html;
autoindex on;
}
# Element
2023-12-01 11:27:02 +01:00
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name element.{{ domain }};
2023-12-01 11:27:02 +01:00
location / {
2024-02-17 19:01:04 +01:00
proxy_pass http://localhost:{{ ports['element'] }};
2023-12-01 11:27:02 +01:00
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "frame-ancestors 'none'";
2023-12-01 11:27:02 +01:00
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Set-Cookie "Path=/; HttpOnly; Secure";
}
}
# Etebase
2023-12-01 11:27:02 +01:00
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name etebase.{{ domain }};
location ~ ^/(?!admin) {
2024-02-17 19:01:04 +01:00
proxy_pass http://localhost:{{ ports['etebase'] }};
2023-12-01 11:27:02 +01:00
}
}
2024-02-17 19:01:04 +01:00
# Hedgedoc
2023-12-11 14:40:29 +01:00
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name hedgedoc.{{ domain }};
location / {
proxy_pass http://localhost:{{ ports['hedgedoc'] }};
}
}
# SearXNG
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name searx.{{ domain }};
2023-12-11 14:40:29 +01:00
location / {
2024-02-17 19:01:04 +01:00
proxy_pass http://localhost:{{ ports['searxng'] }};
2023-12-11 14:40:29 +01:00
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Set-Cookie "Path=/; HttpOnly; Secure";
add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https://github.com/searxng/searxng/issues/new; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com";
2023-12-11 14:40:29 +01:00
}
}
# Synapse
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name matrix.{{ domain }};
location ~ ^(/_matrix|/_synapse/client) {
2024-02-17 19:01:04 +01:00
proxy_pass http://localhost:{{ ports['synapse'] }};
# Nginx by default only allows file uploads up to 1M in size
# Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
2024-02-17 19:01:04 +01:00
client_max_body_size {{ synapse['max_upload_size'] }};
}
location / {
2024-02-17 19:01:04 +01:00
return 308 https://element.{{ domain }}/;
}
}
# Syncthing Discovery
2024-02-17 19:01:04 +01:00
upstream stdisco.{{ domain }} {
# Local IP address:port for discovery server
2024-02-17 19:08:53 +01:00
server localhost:{{ ports['syncthing_discosrv'] }};
}
2023-12-01 11:27:02 +01:00
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name stdisco.{{ domain }};
ssl_verify_client optional_no_ca;
2023-12-01 11:27:02 +01:00
location / {
2024-02-17 19:01:04 +01:00
proxy_pass http://stdisco.{{ domain }};
proxy_set_header X-Client-Port $remote_port;
proxy_set_header X-SSL-Cert $ssl_client_cert;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
2023-12-01 11:27:02 +01:00
}
}
# Vaultwarden
upstream vaultwarden-default {
zone vaultwarden-default 64k;
2024-02-17 19:01:04 +01:00
server localhost:{{ ports['vaultwarden'] }};
keepalive 2;
}
2023-12-01 11:27:02 +01:00
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
2024-02-17 19:01:04 +01:00
server_name vw.{{ domain }};
2023-12-01 11:27:02 +01:00
2023-12-06 13:59:07 +01:00
location / {
proxy_pass http://vaultwarden-default;
# Websocket
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
client_max_body_size 525M;
2023-12-01 11:27:02 +01:00
}
}