update nginx.conf

conf.d/gitlab.tryton.geeraert.eu.conf

@@ -23,6 +23,7 @@ server {
 	listen 443 ssl; # managed by Certbot
         ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
         ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
+        client_max_body_size 20m;
         proxy_request_buffering off;
 	#include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
 	#ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

conf.d/keycloak.tryton.geeraert.eu.conf

@@ -0,0 +1,52 @@
+upstream keycloak_backend {
+	#k8s pod
+	server keycloak.keycloak.svc:8080;
+	server 1.1.1.1 backup;
+    }
+
+server {
+	server_name keycloak.tryton.geeraert.eu www.keycloak.tryton.geeraert.eu;
+        location / {
+		proxy_pass http://keycloak_backend;
+                proxy_redirect off;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $remote_addr;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_set_header X-Forwarded-Port 443;
+         
+                #proxy_set_header    Upgrade     $http_upgrade;
+                #proxy_http_version 1.1;
+        }
+        location /.well-known/acme-challenge/ {
+		root /var/www/certbot;
+        }
+	
+	listen 443 ssl; # managed by Certbot
+        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
+        #add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com assets.zendesk.com connect.facebook.net; frame-src 'self' *.youtube.com assets.zendesk.com *.facebook.com s-static.ak.facebook.com tautt.zendesk.com; object-src 'self'";
+        set_real_ip_from 0.0.0.0/0;
+        real_ip_header X-Real-IP;
+        real_ip_recursive on;
+      
+}
+server {
+    if ($host = www.keycloak.tryton.geeraert.eu) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = keycloak.tryton.geeraert.eu) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    server_name www.keycloak.tryton.geeraert.eu keycloak.tryton.geeraert.eu;
+    listen 80;
+
+    return 404; # managed by Certbot
+
+}
+
+

conf.d/onitama.tryton.geeraert.eu.conf

@@ -10,8 +10,20 @@ upstream onitama_backend {
 server {
 	server_name onitama.tryton.geeraert.eu www.onitama.tryton.geeraert.eu;
         location / {
+#		auth_request /auth;
+#		auth_request_set $auth_status $upstream_status;
+#		error_page 401 = @handle_unauthorized;
 		proxy_pass http://onitama_backend;
         }
+#        location /auth {
+#                proxy_ssl_server_name on;
+#                proxy_pass  https://keycloak.tryton.geeraert.eu/realms/tryton/protocol/openid-connect/userinfo;
+#                proxy_pass_request_body off;
+#                proxy_set_header Content-Length "";
+#                proxy_set_header X-Original-URI $request_uri;
+ #       }
+
+
         location /.well-known/acme-challenge/ {
 		root /var/www/certbot;
         }

conf.d/paperless.tryton.geeraert.eu.conf

@@ -10,6 +10,9 @@ server {
 	server_name paperless.tryton.geeraert.eu www.paperless.tryton.geeraert.eu;
         location / {
 		proxy_pass http://paperless_backend;
+#		proxy_set_header X-Forwarded-Proto $scheme;
+#	        proxy_set_header X-Real-IP $remote_addr;#
+#		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
         location /.well-known/acme-challenge/ {
 		root /var/www/certbot;
@@ -23,6 +26,7 @@ server {
 
 
 }
+
 server {
     if ($host = www.paperless.tryton.geeraert.eu) {
         return 301 https://$host$request_uri;

conf.d/radarr.tryton.geeraert.eu.conf

@@ -8,8 +8,19 @@ upstream radarr_backend {
 server {
 	server_name radarr.tryton.geeraert.eu www.radarr.tryton.geeraert.eu;
         location / {
+#                auth_request /auth;
+#                auth_request_set $auth_status $upstream_status;
+
 		proxy_pass http://radarr_backend;
         }
+ #       location /auth {
+#		proxy_ssl_server_name on;
+#		proxy_pass  https://keycloak.tryton.geeraert.eu/realms/tryton/protocol/openid-connect/userinfo;
+#		proxy_pass_request_body off;
+#		proxy_set_header Content-Length "";
+#		proxy_set_header X-Original-URI $request_uri;
+#	}
+
         location /.well-known/acme-challenge/ {
 		root /var/www/certbot;
         }

nginx.conf

@@ -2,24 +2,24 @@ worker_processes 1;
 events { worker_connections 1024; }
 
 http {
- 
+	proxy_http_version            1.1;
-    #include /etc/nginx/conf.d/*.conf;
+	proxy_set_header              X-Forwarded-Scheme $scheme;
-    #resolver 127.0.0.1 ipv6=off valid=40s;  # The DNS IP server
+	proxy_set_header              Accept-Encoding "";
 
 
-    sendfile on;
+	sendfile on;
-    client_max_body_size 100M; 
+	client_max_body_size 500M; 
-    proxy_set_header   Host $host;
+	proxy_set_header   Host $host;
-    proxy_set_header   X-Real-IP $remote_addr;
+	proxy_set_header   X-Real-IP $remote_addr;
-    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header   X-Forwarded-Host $server_name;
+	proxy_set_header   X-Forwarded-Host $server_name;
-    #proxy_set_header Upgrade $http_upgrade;
+	#proxy_set_header Upgrade $http_upgrade;
-    #proxy_set_header Connection 'upgrade';
+	#proxy_set_header Connection 'upgrade';
-    #proxy_cache_bypass $http_upgrade; 
+	#proxy_cache_bypass $http_upgrade; 
 
 
-     server {
+	server {
-        listen 80;
+	listen 80;
         listen 443 default ssl;
 	ssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; # managed by$
         ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed $
@@ -30,18 +30,16 @@ http {
             proxy_set_header   X-Real-IP $remote_addr;
             proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header   X-Forwarded-Host $server_name;
-        }
+		}
-}
+	}
-	##
+	# Connection header for WebSocket reverse proxy
-    # Connection header for WebSocket reverse proxy
+	map $http_upgrade $connection_upgrade {
-    ##
+		default upgrade;
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
         ''      close;
     }
 
-    include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/conf.d/*.conf;
-    resolver 127.0.0.1 ipv6=off valid=40s;  # The DNS IP server
+	resolver 127.0.0.1 ipv6=off valid=40s;  # The DNS IP server
 
 }