476 lines
12 KiB
HCL
476 lines
12 KiB
HCL
nginx_sites = {
|
|
bitwarden = {
|
|
#service = "nginx.bitwarden.svc:8080"
|
|
#extra-value-location = <<EOT
|
|
#proxy_set_header Host $host;
|
|
#proxy_set_header X-Real-IP $remote_addr;
|
|
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
#proxy_set_header Proxy "";
|
|
# EOT
|
|
service = "bitwarden-nginx-svc.bitwarden.svc:8080"
|
|
http2_bool = true
|
|
}
|
|
|
|
bookstack = {
|
|
# service = "webserver.bookstack.svc"
|
|
service = "bookstack-svc.bookstack.svc"
|
|
proxy_cache = false
|
|
}
|
|
|
|
django = {
|
|
#service = "webserver.django-python.svc:8000"
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
django-dev = {
|
|
service = "webserver.django-dev.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
echo = {
|
|
enabled = false
|
|
# service = "echo-server.echo-server.svc:80"
|
|
service = "echo-svc.echo.svc"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
#extra-value-location = <<EOT
|
|
# auth_request /oauth2/auth;
|
|
# error_page 401 = @oauth2_signin;
|
|
# proxy_set_header X-Auth-Request-Redirect $request_uri;
|
|
# EOT
|
|
|
|
#extra-value = <<EOT
|
|
# location = /oauth2/auth {
|
|
# internal;
|
|
#proxy_pass http://oauthn_backend;
|
|
## proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
|
|
# proxy_pass_request_body off;
|
|
# proxy_set_header Content-Length "";
|
|
# proxy_set_header X-Original-URI $request_uri;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Scheme $scheme;
|
|
#}
|
|
|
|
#location @oauth2_signin {
|
|
# return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
|
|
# #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
|
|
#}
|
|
|
|
#location /oauth2/ {
|
|
#proxy_pass http://oauthn_backend;
|
|
#proxy_set_header Host $host;
|
|
#proxy_set_header X-Real-IP $remote_addr;
|
|
#proxy_set_header X-Scheme $scheme;
|
|
#proxy_set_header X-Auth-Request-Redirect $request_uri;
|
|
#}
|
|
|
|
# EOT
|
|
|
|
|
|
}
|
|
gitlab = {
|
|
service = "webserver.gitlab.svc:443"
|
|
proxy_cache = true
|
|
extra_value_bool = true
|
|
enabled = false
|
|
extra-value = <<EOT
|
|
client_max_body_size 20m;
|
|
proxy_request_buffering off;
|
|
EOT
|
|
http2_bool = true
|
|
proxy_pass_https = true
|
|
}
|
|
sonarr = {
|
|
service = "sonarr-svc.servarr.svc:8989"
|
|
}
|
|
|
|
keycloak = {
|
|
service = "keycloak.keycloak.svc:8080"
|
|
enabled = false
|
|
extra-value = <<EOT
|
|
|
|
set_real_ip_from 0.0.0.0/0;
|
|
real_ip_header X-Real-IP;
|
|
real_ip_recursive on;
|
|
EOT
|
|
}
|
|
nextcloud = {
|
|
service = "webserver.nextcloud.svc"
|
|
# service = "next-svc.next.svc"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
extra-value = <<EOT
|
|
|
|
|
|
location /.well-known/carddav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location /.well-known/caldav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location = /health {
|
|
default_type text/html;
|
|
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
|
|
}
|
|
EOT
|
|
}
|
|
|
|
|
|
|
|
router = {
|
|
service = "192.168.88.1"
|
|
authentication_required = true
|
|
}
|
|
homeassistant = {
|
|
enabled = false
|
|
service = "homeassistant-svc.homeassistant.svc:8123"
|
|
}
|
|
octoprint = {
|
|
service = "192.168.1.28:5000"
|
|
}
|
|
onitama = {
|
|
service = "onitama-svc.onitama.svc:8080"
|
|
enabled = false
|
|
}
|
|
|
|
opentrashmail = {
|
|
# service = "opentrashmail.opentrashmail.svc"
|
|
service = "1.1.1.1"
|
|
enabled = false
|
|
}
|
|
paperless = {
|
|
#service = "webserver.paperless.svc:8000"
|
|
service = "paperless-svc.paperless.svc:8000"
|
|
}
|
|
pihole = {
|
|
service = "172.16.0.60:8081"
|
|
enabled = false
|
|
}
|
|
portainer = {
|
|
service = "portainer.portainer.svc"
|
|
}
|
|
prowlarr = {
|
|
service = "prowlarr-svc.servarr.svc:9696"
|
|
}
|
|
proxmox = {
|
|
service = "192.168.6.2:8006"
|
|
enabled = false
|
|
}
|
|
qbittorrent = {
|
|
service = "qbittorrent-svc.servarr.svc:8080"
|
|
}
|
|
radarr = {
|
|
service = "radarr-svc.servarr.svc:7878"
|
|
}
|
|
recommendarr = {
|
|
service = "recommendarr-svc.servarr.svc:3000"
|
|
enabled = false
|
|
}
|
|
reverse = {
|
|
service = "192.168.88.50:8888"
|
|
enabled = false
|
|
}
|
|
sickchill = {
|
|
service = "sickchill.servarr.svc"
|
|
enabled = false
|
|
}
|
|
transmission = {
|
|
service = "192.168.88.52:31091"
|
|
enabled = false
|
|
}
|
|
unifi = {
|
|
# service = "unifi.unifi.svc:8443"
|
|
service = "192.168.88.244:8443"
|
|
proxy_pass_https = true
|
|
}
|
|
unifi-inform = {
|
|
service = "192.168.88.50:8082"
|
|
}
|
|
dupeguru = {
|
|
service = "dupeguru.dupeguru.svc:5800"
|
|
enabled = false
|
|
authentication_required = true
|
|
}
|
|
|
|
immich = {
|
|
#service = "immich-server.immich.svc:2283"
|
|
service = "immich-svc.immich.svc:2283"
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
|
|
|
|
#adding websocket , usefull for reverse proxy
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
EOT
|
|
}
|
|
immicht = {
|
|
service = "immicht-svc.immicht.svc:2283"
|
|
enabled = false
|
|
}
|
|
|
|
netdata = {
|
|
enabled = false
|
|
service = "netdata-agent.netdata.svc:19999"
|
|
}
|
|
screeps = {
|
|
enabled = false
|
|
redirect_to_https_bool = false
|
|
listen_port_80_bool = true
|
|
service = "screeps-svc.screeps.svc:21025"
|
|
}
|
|
|
|
stirling = {
|
|
enabled = false
|
|
service = "stirling-svc.stirling.svc:8080"
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
#working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
|
|
|
|
|
|
EOT
|
|
}
|
|
vulcan = {
|
|
service = "vulcan.vulcan.svc:80"
|
|
enabled = false
|
|
}
|
|
djangoterra = {
|
|
enabled = false
|
|
service = "djangoterra-svc.djangoterra.svc:8000"
|
|
}
|
|
|
|
nginx = {
|
|
enabled = false
|
|
service = "nginx-svc.nginx.svc"
|
|
}
|
|
openmediavault = {
|
|
service = "192.168.88.29"
|
|
# service = "192.168.88.42"
|
|
}
|
|
pihole = {
|
|
service = "web.piholenew.svc"
|
|
}
|
|
jellyfin = {
|
|
# enabled = false
|
|
service = "jellyfin-svc.jellyfin.svc:8096"
|
|
}
|
|
gogs = {
|
|
enabled = false
|
|
service = "gogs-svc.gogs.svc:3000"
|
|
}
|
|
synology = {
|
|
enabled = true
|
|
service = "192.168.88.39:5000"
|
|
}
|
|
|
|
gitea = {
|
|
enabled = true
|
|
service = "webserver.gitea.svc:3000"
|
|
}
|
|
|
|
spider = {
|
|
enabled = false
|
|
service = "spider-svc.spider.svc:8080"
|
|
}
|
|
nextcloud-terraform = {
|
|
enabled = false
|
|
service = "nextcloud-web-svc.nextcloud-terraform.svc:80"
|
|
|
|
}
|
|
paper = {
|
|
enabled = false
|
|
service = "paper-svc.paper.svc:8000"
|
|
|
|
}
|
|
next = {
|
|
enabled = false
|
|
service = "next-svc.next.svc"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
extra-value = <<EOT
|
|
|
|
|
|
location /.well-known/carddav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location /.well-known/caldav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location = /health {
|
|
default_type text/html;
|
|
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
|
|
}
|
|
EOT
|
|
}
|
|
|
|
bookstack-terraform = {
|
|
enabled = false
|
|
service = "bookstack-svc.bookstack-terraform.svc"
|
|
}
|
|
stash = {
|
|
# enabled = false
|
|
service = "stash-svc.stash.svc:9999"
|
|
#extra-value= <<EOT
|
|
# proxy_protocol on;
|
|
#EOT
|
|
extra-value-location = <<EOT
|
|
#don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
|
|
#Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
|
|
#proxy_bind $remote_addr transparent;
|
|
|
|
##used to be working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
#working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
EOT
|
|
|
|
}
|
|
neko = {
|
|
enabled = false
|
|
service = "neko-svc.neko.svc:8080"
|
|
http2_bool = true
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
|
|
EOT
|
|
|
|
}
|
|
pinchflat = {
|
|
enabled = false
|
|
service = "pinchflat-svc.pinchflat.svc:8945"
|
|
}
|
|
|
|
jobspy = {
|
|
enabled = false
|
|
service = "jobspy-svc.jobspy.svc:8000"
|
|
}
|
|
tprowlarr = {
|
|
enabled = false
|
|
service = "prowlarr-svc.tservarr.svc:9696"
|
|
}
|
|
tradarr = {
|
|
enabled = false
|
|
service = "radarr-svc.tservarr.svc:7878"
|
|
}
|
|
tsonarr = {
|
|
enabled = false
|
|
service = "sonarr-svc.tservarr.svc:8989"
|
|
}
|
|
tqbitorrent = {
|
|
enabled = false
|
|
service = "qbitorrent-svc.tservarr.svc:8080"
|
|
}
|
|
|
|
poste = {
|
|
enabled = false
|
|
service = "poste-svc.poste.svc:443"
|
|
proxy_pass_https = true
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
#working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
|
|
|
|
|
|
EOT
|
|
}
|
|
wikijs = {
|
|
#enabled = false
|
|
service = "wikijs-svc.wikijs.svc:3000"
|
|
extra-value = <<EOT
|
|
client_max_body_size 20m;
|
|
proxy_request_buffering off;
|
|
EOT
|
|
}
|
|
|
|
keycloak = {
|
|
enabled = false
|
|
service = "keycloak-svc.keycloak.svc:8080"
|
|
extra-value = <<EOT
|
|
|
|
set_real_ip_from 0.0.0.0/0;
|
|
real_ip_header X-Real-IP;
|
|
real_ip_recursive on;
|
|
EOT
|
|
}
|
|
oauthn = {
|
|
enabled = false
|
|
service = "oauth2-proxy-svc.oauth2-proxy.svc:4180"
|
|
|
|
# extra-value = <<EOT
|
|
# location /oauth2/ {
|
|
# proxy_pass http://oauthn_backend;
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Scheme $scheme;
|
|
# }
|
|
# EOT
|
|
|
|
|
|
}
|
|
emailproxy = {
|
|
enabled = false
|
|
service = "emailproxy-svc.paper.svc:80"
|
|
}
|
|
tdarr = {
|
|
#enabled = false
|
|
service = "tdarr-svc.servarr.svc:8265"
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
#working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
|
|
|
|
|
|
EOT
|
|
|
|
}
|
|
|
|
}
|
|
deny_ip = ["1.2.3.4"]
|