From 3b67e1b3c68d58a3d92d528e8c02077fd877266e Mon Sep 17 00:00:00 2001 From: pierre Date: Thu, 25 Jul 2024 17:06:25 +0100 Subject: [PATCH] add the files --- conf.d/bitwarden.tryton.geeraert.eu.conf | 47 +++++++ ...rden_kube.tryton.geeraert.eu.kube.conf.old | 76 ++++++++++++ conf.d/django.tryton.geeraert.eu.conf | 47 +++++++ conf.d/keycloak.tryton.geeraert.eu.conf | 66 +++++----- conf.d/nextcloud.tryton.geeraert.eu.conf | 116 +++++++----------- conf.d/paperless.tryton.geeraert.eu.conf | 15 +-- conf.d/sonarr.tryton.geeraert.eu.conf | 47 +++---- 7 files changed, 276 insertions(+), 138 deletions(-) create mode 100755 conf.d/bitwarden.tryton.geeraert.eu.conf create mode 100644 conf.d/bitwarden_kube.tryton.geeraert.eu.kube.conf.old create mode 100644 conf.d/django.tryton.geeraert.eu.conf mode change 100644 => 100755 conf.d/nextcloud.tryton.geeraert.eu.conf mode change 100644 => 100755 conf.d/paperless.tryton.geeraert.eu.conf mode change 100644 => 100755 conf.d/sonarr.tryton.geeraert.eu.conf diff --git a/conf.d/bitwarden.tryton.geeraert.eu.conf b/conf.d/bitwarden.tryton.geeraert.eu.conf new file mode 100755 index 0000000..550302e --- /dev/null +++ b/conf.d/bitwarden.tryton.geeraert.eu.conf @@ -0,0 +1,47 @@ +############################################ +# config file for bitwarden +############################################ + +upstream bitwarden_backend { + server nginx.bitwarden.svc:8080; + server 1.1.1.1 backup; + } + +server { + server_name bitwarden.tryton.geeraert.eu www.bitwarden.tryton.geeraert.eu; + location / { + proxy_pass http://bitwarden_backend; + + } + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + + + + + http2 on; + ssl_protocols TLSv1.2; + + + listen 443 ssl; + ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + +} +server { + if ($host = www.bitwarden.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } + + + if ($host = bitwarden.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } + + server_name www.bitwarden.tryton.geeraert.eu bitwarden.tryton.geeraert.eu; + listen 80; + return 404; + +} diff --git a/conf.d/bitwarden_kube.tryton.geeraert.eu.kube.conf.old b/conf.d/bitwarden_kube.tryton.geeraert.eu.kube.conf.old new file mode 100644 index 0000000..0fe8c18 --- /dev/null +++ b/conf.d/bitwarden_kube.tryton.geeraert.eu.kube.conf.old @@ -0,0 +1,76 @@ +upstream bitwarden_kube_backend { +# BITWARDEN SERVER DOCKER +# server 192.168.88.50:8080; +# NEW BITWARDEN SERVER kubernetes +# server bitwarden-self-host-web.bitwarden-helm.svc:5000; + server nginx.bitwarden.svc:8080; +#bitwarden-self-host-admin.bitwarden-helm.svc +# OLD BITWARDEN SERVER +# server 192.168.6.147; + +# server 1.1.1.1 backup; + } + +server { + server_name bitwarden.tryton.geeraert.eu www.bitwarden.tryton.geeraert.eu; + location / { + proxy_pass http://bitwarden_kube_backend; + } +# location /api/ { +# proxy_pass http://bitwarden-self-host-api.bitwarden-helm.svc:5000; + #proxy_pass http://10.106.163.98:5000; +# } +# location /attachments/ { +# proxy_pass http://bitwarden-self-host-api.bitwarden-helm.svc:5000; +# } +# location /icons/ { +# proxy_pass http://bitwarden-self-host-icons.bitwarden-helm.svc:5000; +# } +# location /notifications/ { +# proxy_pass http://bitwarden-self-host-notifications.bitwarden-helm.svc:5000; +# } +# location /events/ { +# proxy_pass http://bitwarden-self-host-events.bitwarden-helm.svc:5000; +# } +# location /scim/ { +# proxy_pass http://bitwarden-self-host-scim.bitwarden-helm.svc:5000; +# } +# location /sso/ { +# proxy_pass http://bitwarden-self-host-sso.bitwarden-helm.svc:5000; +# } +# location /identity/ { +# proxy_pass http://bitwarden-self-host-identity.bitwarden-helm.svc:5000; +# } +# location /admin/ { +# proxy_pass http://bitwarden-self-host-admin.bitwarden-helm.svc:5000; +# } + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot + + +} + + +server { + if ($host = www.bitwarden.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + if ($host = bitwarden.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + server_name www.bitwarden.tryton.geeraert.eu bitwarden.tryton.geeraert.eu; + listen 80; + return 404; # managed by Certbot + +} diff --git a/conf.d/django.tryton.geeraert.eu.conf b/conf.d/django.tryton.geeraert.eu.conf new file mode 100644 index 0000000..b33c7f7 --- /dev/null +++ b/conf.d/django.tryton.geeraert.eu.conf @@ -0,0 +1,47 @@ +upstream django_backend { + server webserver.django-python.svc:8000; + server 1.1.1.1 backup; + } + +server { + server_name django.tryton.geeraert.eu www.django.tryton.geeraert.eu; + location / { + proxy_pass http://django_backend; + location ~* \.(html|css|jpg|gif|ico|js)$ { + proxy_cache cache; + proxy_cache_key $host$uri$is_args$args; + proxy_cache_valid 200 301 302 30m; + expires 30m; + proxy_pass http://django_backend; + } + + } + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + listen 443 ssl; # managed by Certbot + http2 on; + ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + + +} +server { + if ($host = www.django.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + if ($host = django.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + server_name www.django.tryton.geeraert.eu django.tryton.geeraert.eu; + listen 80; + return 404; # managed by Certbot + +} + + diff --git a/conf.d/keycloak.tryton.geeraert.eu.conf b/conf.d/keycloak.tryton.geeraert.eu.conf index 472035c..768cd9d 100644 --- a/conf.d/keycloak.tryton.geeraert.eu.conf +++ b/conf.d/keycloak.tryton.geeraert.eu.conf @@ -1,52 +1,50 @@ +############################################ +# config file for keycloak +############################################ + upstream keycloak_backend { - #k8s pod - server keycloak.keycloak.svc:8080; - server 1.1.1.1 backup; + server keycloak.keycloak.svc:8080; + server 1.1.1.1 backup; } server { - server_name keycloak.tryton.geeraert.eu www.keycloak.tryton.geeraert.eu; + server_name keycloak.tryton.geeraert.eu www.keycloak.tryton.geeraert.eu; location / { - proxy_pass http://keycloak_backend; - proxy_redirect off; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Port 443; - - #proxy_set_header Upgrade $http_upgrade; - #proxy_http_version 1.1; + proxy_pass http://keycloak_backend; + } location /.well-known/acme-challenge/ { - root /var/www/certbot; + root /var/www/certbot; } - - listen 443 ssl; # managed by Certbot - ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; - ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; - #add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com assets.zendesk.com connect.facebook.net; frame-src 'self' *.youtube.com assets.zendesk.com *.facebook.com s-static.ak.facebook.com tautt.zendesk.com; object-src 'self'"; + + + set_real_ip_from 0.0.0.0/0; real_ip_header X-Real-IP; real_ip_recursive on; - + + + + + + + listen 443 ssl; + ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + } server { - if ($host = www.keycloak.tryton.geeraert.eu) { - return 301 https://$host$request_uri; - } # managed by Certbot + if ($host = www.keycloak.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } - if ($host = keycloak.tryton.geeraert.eu) { - return 301 https://$host$request_uri; - } # managed by Certbot + if ($host = keycloak.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } - - server_name www.keycloak.tryton.geeraert.eu keycloak.tryton.geeraert.eu; - listen 80; - - return 404; # managed by Certbot + server_name www.keycloak.tryton.geeraert.eu keycloak.tryton.geeraert.eu; + listen 80; + return 404; } - - diff --git a/conf.d/nextcloud.tryton.geeraert.eu.conf b/conf.d/nextcloud.tryton.geeraert.eu.conf old mode 100644 new mode 100755 index 5af77ce..46e21ab --- a/conf.d/nextcloud.tryton.geeraert.eu.conf +++ b/conf.d/nextcloud.tryton.geeraert.eu.conf @@ -1,95 +1,71 @@ +############################################ +# config file for nextcloud +############################################ + upstream nextcloud_backend { -# server 192.168.88.43; #IP of old tryton server (physical server) -# server 192.168.88.50:6456; #IP of the docker nextcloud install - server webserver.nextcloud.svc; #using svc dns name -# server 192.168.88.52:31236; #IP of the kubernetes # -# server 1.1.1.1 backup; + server webserver.nextcloud.svc; + server 1.1.1.1 backup; } server { - server_name nextcloud.tryton.geeraert.eu www.nextcloud.tryton.geeraert.eu; + server_name nextcloud.tryton.geeraert.eu www.nextcloud.tryton.geeraert.eu; location / { - proxy_pass http://nextcloud_backend/; - location ~* \.(html|css|jpg|gif|ico|js)$ { - proxy_cache cache; - proxy_cache_key $host$uri$is_args$args; - proxy_cache_valid 200 301 302 30m; - expires 30m; - proxy_pass http://nextcloud_backend; - } - - -# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; -# proxy_set_header X-Forwarded-Port $server_port; -# proxy_set_header X-Forwarded-Scheme $scheme; -# proxy_set_header X-Forwarded-Proto $scheme; -# proxy_set_header X-Real-IP $remote_addr; -# proxy_set_header Accept-Encoding ""; -# proxy_set_header Host $host; - -# client_body_buffer_size 512k; -# proxy_read_timeout 86400s; -# client_max_body_size 0; - - # Websocket - # proxy_http_version 1.1; - # proxy_set_header Upgrade $http_upgrade; - # proxy_set_header Connection $connection_upgrade; - - - -# proxy_pass_request_headers on; -# proxy_no_cache $cookie_nocache $arg_nocache$arg_comment; -# proxy_no_cache $http_pragma $http_authorization; -# proxy_cache_bypass $cookie_nocache $arg_nocache $arg_comment; -# proxy_cache_bypass $http_pragma $http_authorization; -# proxy_set_header HTTP_AUTHORIZATION $http_authorization; - + proxy_pass http://nextcloud_backend; + + location ~* \.(html|css|jpg|gif|ico|js)$ { + proxy_cache cache; + proxy_cache_key $host$uri$is_args$args; + proxy_cache_valid 200 301 302 30m; + expires 30m; + proxy_pass http://nextcloud_backend; + } + } location /.well-known/acme-challenge/ { - root /var/www/certbot; + root /var/www/certbot; } - location /.well-known/carddav { - return 301 $scheme://$host/remote.php/dav; - } - location /.well-known/caldav { - return 301 $scheme://$host/remote.php/dav; - } + + + + location /.well-known/carddav { + return 301 $scheme://$host/remote.php/dav; + } + + location /.well-known/caldav { + return 301 $scheme://$host/remote.php/dav; + } location = /health { - default_type text/html; + default_type text/html; return 200 "

health check

\n"; - } + } -# listen 443 ssl; # managed by Certbot - listen 443 ssl; - listen [::]:443 ssl; - http2 on; - ssl_protocols TLSv1.2; + + + + http2 on; + ssl_protocols TLSv1.2; + + + listen 443 ssl; ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; - #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot - #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot - } server { - if ($host = www.nextcloud.tryton.geeraert.eu) { - return 301 https://$host$request_uri; - } # managed by Certbot + if ($host = www.nextcloud.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } - if ($host = nextcloud.tryton.geeraert.eu) { - return 301 https://$host$request_uri; - } # managed by Certbot - + if ($host = nextcloud.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } server_name www.nextcloud.tryton.geeraert.eu nextcloud.tryton.geeraert.eu; - listen 80; - return 404; # managed by Certbot + listen 80; + return 404; } - - diff --git a/conf.d/paperless.tryton.geeraert.eu.conf b/conf.d/paperless.tryton.geeraert.eu.conf old mode 100644 new mode 100755 index d05eb19..43a95b5 --- a/conf.d/paperless.tryton.geeraert.eu.conf +++ b/conf.d/paperless.tryton.geeraert.eu.conf @@ -1,18 +1,13 @@ +#config file for Paperless upstream paperless_backend { - #k8s pod - server webserver.paperless.svc:8000; - #docker pod - #server 192.168.88.50:4887; - server 1.1.1.1 backup; + server webserver.paperless.svc:8000; + server 1.1.1.1 backup; } server { server_name paperless.tryton.geeraert.eu www.paperless.tryton.geeraert.eu; location / { proxy_pass http://paperless_backend; -# proxy_set_header X-Forwarded-Proto $scheme; -# proxy_set_header X-Real-IP $remote_addr;# -# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /.well-known/acme-challenge/ { root /var/www/certbot; @@ -21,12 +16,8 @@ server { listen 443 ssl; # managed by Certbot ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; - #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot - #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot - } - server { if ($host = www.paperless.tryton.geeraert.eu) { return 301 https://$host$request_uri; diff --git a/conf.d/sonarr.tryton.geeraert.eu.conf b/conf.d/sonarr.tryton.geeraert.eu.conf old mode 100644 new mode 100755 index 95c296a..fa20b38 --- a/conf.d/sonarr.tryton.geeraert.eu.conf +++ b/conf.d/sonarr.tryton.geeraert.eu.conf @@ -1,41 +1,44 @@ +############################################ +# config file for sonarr +############################################ + upstream sonarr_backend { - server sonarr.servarr.svc; -# server 192.168.88.52:9080; - server 1.1.1.1 backup; + server sonarr.servarr.svc; + server 1.1.1.1 backup; } server { - server_name sonarr.tryton.geeraert.eu www.sonarr.tryton.geeraert.eu; + server_name sonarr.tryton.geeraert.eu www.sonarr.tryton.geeraert.eu; location / { - proxy_pass http://sonarr_backend; + proxy_pass http://sonarr_backend; + } location /.well-known/acme-challenge/ { - root /var/www/certbot; + root /var/www/certbot; } - - listen 443 ssl; # managed by Certbot + + + + + + + listen 443 ssl; ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; - #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot - #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot - } server { - if ($host = www.sonarr.tryton.geeraert.eu) { - return 301 https://$host$request_uri; - } # managed by Certbot + if ($host = www.sonarr.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } - if ($host = sonarr.tryton.geeraert.eu) { - return 301 https://$host$request_uri; - } # managed by Certbot - + if ($host = sonarr.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } server_name www.sonarr.tryton.geeraert.eu sonarr.tryton.geeraert.eu; - listen 80; - return 404; # managed by Certbot + listen 80; + return 404; } - -