pi-ux-ce/Reverse_proxy_Nginx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update nginx.conf

Browse Source
This commit is contained in:
pi-ux-ce
2024-07-03 13:20:13 +01:00
parent 0ce409bcce
commit 47ab6b91a8
6 changed files with 101 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf.d/gitlab.tryton.geeraert.eu.conf
+1
View File
@@ -23,6 +23,7 @@ server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
client_max_body_size 20m;
proxy_request_buffering off;
#include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
#ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
conf.d/keycloak.tryton.geeraert.eu.conf
+52
View File
@@ -0,0 +1,52 @@
upstream keycloak_backend {
#k8s pod
server keycloak.keycloak.svc:8080;
server 1.1.1.1 backup;
}
server {
server_name keycloak.tryton.geeraert.eu www.keycloak.tryton.geeraert.eu;
location / {
proxy_pass http://keycloak_backend;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port 443;
#proxy_set_header Upgrade $http_upgrade;
#proxy_http_version 1.1;
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
#add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com assets.zendesk.com connect.facebook.net; frame-src 'self' *.youtube.com assets.zendesk.com *.facebook.com s-static.ak.facebook.com tautt.zendesk.com; object-src 'self'";
set_real_ip_from 0.0.0.0/0;
real_ip_header X-Real-IP;
real_ip_recursive on;
}
server {
if ($host = www.keycloak.tryton.geeraert.eu) {
return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = keycloak.tryton.geeraert.eu) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name www.keycloak.tryton.geeraert.eu keycloak.tryton.geeraert.eu;
listen 80;
return 404; # managed by Certbot
}
conf.d/onitama.tryton.geeraert.eu.conf
+12
View File
@@ -10,8 +10,20 @@ upstream onitama_backend {
server {
server_name onitama.tryton.geeraert.eu www.onitama.tryton.geeraert.eu;
location / {
# auth_request /auth;
# auth_request_set $auth_status $upstream_status;
# error_page 401 = @handle_unauthorized;
proxy_pass http://onitama_backend;
}
# location /auth {
# proxy_ssl_server_name on;
# proxy_pass https://keycloak.tryton.geeraert.eu/realms/tryton/protocol/openid-connect/userinfo;
# proxy_pass_request_body off;
# proxy_set_header Content-Length "";
# proxy_set_header X-Original-URI $request_uri;
# }
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
conf.d/paperless.tryton.geeraert.eu.conf
+4
View File
@@ -10,6 +10,9 @@ server {
server_name paperless.tryton.geeraert.eu www.paperless.tryton.geeraert.eu;
location / {
proxy_pass http://paperless_backend;
# proxy_set_header X-Forwarded-Proto $scheme;
# proxy_set_header X-Real-IP $remote_addr;#
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
location /.well-known/acme-challenge/ {
root /var/www/certbot;
@@ -23,6 +26,7 @@ server {
}
server {
if ($host = www.paperless.tryton.geeraert.eu) {
return 301 https://$host$request_uri;
conf.d/radarr.tryton.geeraert.eu.conf
+11
View File
@@ -8,8 +8,19 @@ upstream radarr_backend {
server {
server_name radarr.tryton.geeraert.eu www.radarr.tryton.geeraert.eu;
location / {
# auth_request /auth;
# auth_request_set $auth_status $upstream_status;
proxy_pass http://radarr_backend;
}
# location /auth {
# proxy_ssl_server_name on;
# proxy_pass https://keycloak.tryton.geeraert.eu/realms/tryton/protocol/openid-connect/userinfo;
# proxy_pass_request_body off;
# proxy_set_header Content-Length "";
# proxy_set_header X-Original-URI $request_uri;
# }
location /.well-known/acme-challenge/ {
root /var/www/certbot;
}
nginx.conf
+21 -23
View File
@@ -2,24 +2,24 @@ worker_processes 1;
events { worker_connections 1024; }
http {
#include /etc/nginx/conf.d/*.conf;
#resolver 127.0.0.1 ipv6=off valid=40s; # The DNS IP server
proxy_http_version 1.1;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header Accept-Encoding "";
sendfile on;
client_max_body_size 100M;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
#proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection 'upgrade';
#proxy_cache_bypass $http_upgrade;
sendfile on;
client_max_body_size 500M;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
#proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection 'upgrade';
#proxy_cache_bypass $http_upgrade;
server {
listen 80;
server {
listen 80;
listen 443 default ssl;
ssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; # managed by$
ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed $
@@ -30,18 +30,16 @@ http {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
}
##
# Connection header for WebSocket reverse proxy
##
map $http_upgrade $connection_upgrade {
default upgrade;
}
}
# Connection header for WebSocket reverse proxy
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
include /etc/nginx/conf.d/*.conf;
resolver 127.0.0.1 ipv6=off valid=40s; # The DNS IP server
include /etc/nginx/conf.d/*.conf;
resolver 127.0.0.1 ipv6=off valid=40s; # The DNS IP server
}