From 47ab6b91a84c27d0760337b6218c9f55042f8033 Mon Sep 17 00:00:00 2001 From: pierre Date: Wed, 3 Jul 2024 13:20:13 +0100 Subject: [PATCH] update nginx.conf --- conf.d/gitlab.tryton.geeraert.eu.conf | 1 + conf.d/keycloak.tryton.geeraert.eu.conf | 52 ++++++++++++++++++++++++ conf.d/onitama.tryton.geeraert.eu.conf | 12 ++++++ conf.d/paperless.tryton.geeraert.eu.conf | 4 ++ conf.d/radarr.tryton.geeraert.eu.conf | 11 +++++ nginx.conf | 44 ++++++++++---------- 6 files changed, 101 insertions(+), 23 deletions(-) create mode 100644 conf.d/keycloak.tryton.geeraert.eu.conf diff --git a/conf.d/gitlab.tryton.geeraert.eu.conf b/conf.d/gitlab.tryton.geeraert.eu.conf index a5d150b..19f3877 100644 --- a/conf.d/gitlab.tryton.geeraert.eu.conf +++ b/conf.d/gitlab.tryton.geeraert.eu.conf @@ -23,6 +23,7 @@ server { listen 443 ssl; # managed by Certbot ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + client_max_body_size 20m; proxy_request_buffering off; #include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot #ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot diff --git a/conf.d/keycloak.tryton.geeraert.eu.conf b/conf.d/keycloak.tryton.geeraert.eu.conf new file mode 100644 index 0000000..472035c --- /dev/null +++ b/conf.d/keycloak.tryton.geeraert.eu.conf @@ -0,0 +1,52 @@ +upstream keycloak_backend { + #k8s pod + server keycloak.keycloak.svc:8080; + server 1.1.1.1 backup; + } + +server { + server_name keycloak.tryton.geeraert.eu www.keycloak.tryton.geeraert.eu; + location / { + proxy_pass http://keycloak_backend; + proxy_redirect off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port 443; + + #proxy_set_header Upgrade $http_upgrade; + #proxy_http_version 1.1; + } + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + listen 443 ssl; # managed by Certbot + ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + #add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com assets.zendesk.com connect.facebook.net; frame-src 'self' *.youtube.com assets.zendesk.com *.facebook.com s-static.ak.facebook.com tautt.zendesk.com; object-src 'self'"; + set_real_ip_from 0.0.0.0/0; + real_ip_header X-Real-IP; + real_ip_recursive on; + +} +server { + if ($host = www.keycloak.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + if ($host = keycloak.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + server_name www.keycloak.tryton.geeraert.eu keycloak.tryton.geeraert.eu; + listen 80; + + return 404; # managed by Certbot + +} + + diff --git a/conf.d/onitama.tryton.geeraert.eu.conf b/conf.d/onitama.tryton.geeraert.eu.conf index 05ef61f..e45d61f 100644 --- a/conf.d/onitama.tryton.geeraert.eu.conf +++ b/conf.d/onitama.tryton.geeraert.eu.conf @@ -10,8 +10,20 @@ upstream onitama_backend { server { server_name onitama.tryton.geeraert.eu www.onitama.tryton.geeraert.eu; location / { +# auth_request /auth; +# auth_request_set $auth_status $upstream_status; +# error_page 401 = @handle_unauthorized; proxy_pass http://onitama_backend; } +# location /auth { +# proxy_ssl_server_name on; +# proxy_pass https://keycloak.tryton.geeraert.eu/realms/tryton/protocol/openid-connect/userinfo; +# proxy_pass_request_body off; +# proxy_set_header Content-Length ""; +# proxy_set_header X-Original-URI $request_uri; + # } + + location /.well-known/acme-challenge/ { root /var/www/certbot; } diff --git a/conf.d/paperless.tryton.geeraert.eu.conf b/conf.d/paperless.tryton.geeraert.eu.conf index dad4884..d05eb19 100644 --- a/conf.d/paperless.tryton.geeraert.eu.conf +++ b/conf.d/paperless.tryton.geeraert.eu.conf @@ -10,6 +10,9 @@ server { server_name paperless.tryton.geeraert.eu www.paperless.tryton.geeraert.eu; location / { proxy_pass http://paperless_backend; +# proxy_set_header X-Forwarded-Proto $scheme; +# proxy_set_header X-Real-IP $remote_addr;# +# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location /.well-known/acme-challenge/ { root /var/www/certbot; @@ -23,6 +26,7 @@ server { } + server { if ($host = www.paperless.tryton.geeraert.eu) { return 301 https://$host$request_uri; diff --git a/conf.d/radarr.tryton.geeraert.eu.conf b/conf.d/radarr.tryton.geeraert.eu.conf index a37f2cf..8411dad 100644 --- a/conf.d/radarr.tryton.geeraert.eu.conf +++ b/conf.d/radarr.tryton.geeraert.eu.conf @@ -8,8 +8,19 @@ upstream radarr_backend { server { server_name radarr.tryton.geeraert.eu www.radarr.tryton.geeraert.eu; location / { +# auth_request /auth; +# auth_request_set $auth_status $upstream_status; + proxy_pass http://radarr_backend; } + # location /auth { +# proxy_ssl_server_name on; +# proxy_pass https://keycloak.tryton.geeraert.eu/realms/tryton/protocol/openid-connect/userinfo; +# proxy_pass_request_body off; +# proxy_set_header Content-Length ""; +# proxy_set_header X-Original-URI $request_uri; +# } + location /.well-known/acme-challenge/ { root /var/www/certbot; } diff --git a/nginx.conf b/nginx.conf index e16c44d..477847b 100755 --- a/nginx.conf +++ b/nginx.conf @@ -2,24 +2,24 @@ worker_processes 1; events { worker_connections 1024; } http { - - #include /etc/nginx/conf.d/*.conf; - #resolver 127.0.0.1 ipv6=off valid=40s; # The DNS IP server + proxy_http_version 1.1; + proxy_set_header X-Forwarded-Scheme $scheme; + proxy_set_header Accept-Encoding ""; - sendfile on; - client_max_body_size 100M; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Host $server_name; - #proxy_set_header Upgrade $http_upgrade; - #proxy_set_header Connection 'upgrade'; - #proxy_cache_bypass $http_upgrade; + sendfile on; + client_max_body_size 500M; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Host $server_name; + #proxy_set_header Upgrade $http_upgrade; + #proxy_set_header Connection 'upgrade'; + #proxy_cache_bypass $http_upgrade; - server { - listen 80; + server { + listen 80; listen 443 default ssl; ssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; # managed by$ ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed $ @@ -30,18 +30,16 @@ http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $server_name; - } -} - ## - # Connection header for WebSocket reverse proxy - ## - map $http_upgrade $connection_upgrade { - default upgrade; + } + } + # Connection header for WebSocket reverse proxy + map $http_upgrade $connection_upgrade { + default upgrade; '' close; } - include /etc/nginx/conf.d/*.conf; - resolver 127.0.0.1 ipv6=off valid=40s; # The DNS IP server + include /etc/nginx/conf.d/*.conf; + resolver 127.0.0.1 ipv6=off valid=40s; # The DNS IP server }