pi-ux-ce/Reverse_proxy_Nginx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adding before some work
Gitea Actions Demo / Explore-Gitea-Actions (push) Failing after 47s
Details

Browse Source
This commit is contained in:
pi-ux-ce
2026-01-26 22:17:14 +00:00
parent f3aa767cd5
commit 800d23ac8e
14 changed files with 349 additions and 159 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/variables.auto.tfvars
+109 -29
View File
@@ -1,6 +1,13 @@
nginx_sites = {
bitwarden = {
service = "nginx.bitwarden.svc:8080"
service = "nginx.bitwarden.svc:8080"
#extra-value-location = <<EOT
#proxy_set_header Host $host;
#proxy_set_header X-Real-IP $remote_addr;
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header Proxy "";
# EOT
#service = "bitwarden-nginx-svc.bitwardent.svc:8080"
http2_bool = true
}
@@ -16,7 +23,14 @@ nginx_sites = {
proxy_cache = true
http2_bool = true
}
django-dev = {
service = "webserver.django-dev.svc:8000"
proxy_cache = true
http2_bool = true
}
echo = {
enabled = false
# service = "echo-server.echo-server.svc:80"
service = "echo-svc.echo.svc"
proxy_cache = true
@@ -25,7 +39,7 @@ nginx_sites = {
extra-value-location = <<EOT
auth_request /oauth2/auth;
error_page 401 = @oauth2_signin;
proxy_set_header X-Auth-Request-Redirect $request_uri;
proxy_set_header X-Auth-Request-Redirect $request_uri;
EOT
extra-value = <<EOT
@@ -39,12 +53,14 @@ proxy_pass http://oauthn_backend;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
}
location @oauth2_signin {
return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
#return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
}
location /oauth2/ {
proxy_pass http://oauthn_backend;
proxy_pass http://oauthn_backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
@@ -127,7 +143,8 @@ client_max_body_size 20m;
enabled = false
}
paperless = {
service = "webserver.paperless.svc:8000"
#service = "webserver.paperless.svc:8000"
service = "paperless-svc.paperless.svc:8000"
}
pihole = {
service = "172.16.0.60:8081"
@@ -179,8 +196,22 @@ client_max_body_size 20m;
}
immich = {
#service = "immich-server.immich.svc:3001"
service = "immich-server.immich.svc:2283"
#service = "immich-server.immich.svc:2283"
service = "immich-svc.immich.svc:2283"
extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#adding websocket , usefull for reverse proxy
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
}
immicht = {
service = "immicht-svc.immicht.svc:2283"
@@ -199,8 +230,23 @@ client_max_body_size 20m;
}
stirling = {
enabled = false
service = "stirling-svc.stirling.svc:8080"
enabled = false
service = "stirling-svc.stirling.svc:8080"
extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
}
vulcan = {
service = "vulcan.vulcan.svc:80"
@@ -283,22 +329,27 @@ client_max_body_size 20m;
}
stash = {
# enabled = false
service = "stash-svc.stash.svc:9999"
service = "stash-svc.stash.svc:9999"
#extra-value= <<EOT
# proxy_protocol on;
#EOT
extra-value-location = <<EOT
#don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
#Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
#proxy_bind $remote_addr transparent;
##used to be working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
#working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
#end of working
EOT
}
neko = {
@@ -339,7 +390,6 @@ proxy_set_header Connection "upgrade";
service = "qbitorrent-svc.tservarr.svc:8080"
}
poste = {
enabled = false
service = "poste-svc.poste.svc:443"
@@ -361,12 +411,16 @@ proxy_set_header Connection "upgrade";
EOT
}
wikijs = {
#enabled = false
service = "wikijs-svc.wikijs.svc:3000"
#enabled = false
service = "wikijs-svc.wikijs.svc:3000"
extra-value = <<EOT
client_max_body_size 20m;
proxy_request_buffering off;
EOT
}
keycloak = {
#enabled = false
enabled = false
service = "keycloak-svc.keycloak.svc:8080"
extra-value = <<EOT
@@ -376,18 +430,44 @@ proxy_set_header Connection "upgrade";
EOT
}
oauthn = {
#enabled = false
enabled = false
service = "oauth2-proxy-svc.oauth2-proxy.svc:4180"
# extra-value = <<EOT
# location /oauth2/ {
# proxy_pass http://oauthn_backend;
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Scheme $scheme;
# }
# EOT
# extra-value = <<EOT
# location /oauth2/ {
# proxy_pass http://oauthn_backend;
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Scheme $scheme;
# }
# EOT
}
emailproxy = {
enabled = false
service = "emailproxy-svc.paper.svc:80"
}
tdarr = {
#enabled = false
service = "tdarr-svc.servarr.svc:8265"
extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
proxy_set_header X-Real-IP $remote_addr;
proxy_cache_bypass $http_upgrade;
#end of working
EOT
}
}
deny_ip = ["1.2.3.4"]