434 lines
9.5 KiB
HCL
434 lines
9.5 KiB
HCL
nginx_sites = {
|
|
bitwarden = {
|
|
service = "bitwarden-nginx-svc.bitwarden.svc:8080"
|
|
http2_bool = true
|
|
redirect_to_root_domain = false
|
|
}
|
|
|
|
bookstack = {
|
|
enabled = false
|
|
service = "bookstack-svc.bookstack.svc"
|
|
proxy_cache = false
|
|
}
|
|
|
|
|
|
django = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
admin = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
redirect = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
streaming = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
stash = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
simpsons = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
kubernetes = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
cloudmanager = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
podcast = {
|
|
enabled = false
|
|
|
|
service = "django-svc.django:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
|
|
}
|
|
django-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
admin-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
redirect-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
streaming-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
stash-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
simpsons-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
kubernetes-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
cloudmanager-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
podcast-testing = {
|
|
service = "django-testing-svc.django-testing.svc:8000"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
echo = {
|
|
enabled = true
|
|
service = "echo-svc.echo.svc"
|
|
docker_service = "echo-svc.echo.svc"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
}
|
|
|
|
sonarr = {
|
|
enabled = false
|
|
|
|
service = "sonarr-svc.servarr.svc:8989"
|
|
geoip_allow = ["FR", "GB", "NL"]
|
|
|
|
}
|
|
|
|
|
|
nextcloud = {
|
|
enabled = false
|
|
|
|
redirect_to_root_domain = false
|
|
service = "webserver.nextcloud.svc"
|
|
#service = "nextcloud-svc.next.svc"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
extra-value = <<EOT
|
|
|
|
|
|
location /.well-known/carddav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location /.well-known/caldav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location = /health {
|
|
default_type text/html;
|
|
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
|
|
}
|
|
EOT
|
|
}
|
|
|
|
|
|
|
|
router = {
|
|
enabled = false
|
|
|
|
service = "192.168.88.1"
|
|
authentication_required = true
|
|
}
|
|
|
|
octoprint = {
|
|
|
|
service = "192.168.0.32:5000"
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme; # Crucial for HTTPS to HTTP matching
|
|
|
|
# Required for OctoPrint WebSockets to function properly
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
client_max_body_size 0; # Allows large file uploads like gcode
|
|
EOT
|
|
|
|
}
|
|
onitama = {
|
|
service = "onitama-svc.onitama.svc:8080"
|
|
enabled = false
|
|
}
|
|
|
|
|
|
paperless = {
|
|
enabled = false
|
|
|
|
#service = "webserver.paperless.svc:8000"
|
|
service = "paperless-svc.paperless.svc:8000"
|
|
}
|
|
pihole = {
|
|
enabled = false
|
|
|
|
service = "172.16.0.60:8081"
|
|
enabled = false
|
|
}
|
|
|
|
prowlarr = {
|
|
enabled = false
|
|
|
|
service = "prowlarr-svc.servarr.svc:9696"
|
|
geoip_allow = ["FR", "GB", "NL"]
|
|
|
|
}
|
|
|
|
qbittorrent = {
|
|
enabled = false
|
|
service = "qbittorrent-svc.servarr.svc:8080"
|
|
geoip_allow = ["FR", "GB", "NL"]
|
|
|
|
}
|
|
radarr = {
|
|
enabled = false
|
|
|
|
service = "radarr-svc.servarr.svc:7878"
|
|
geoip_allow = ["FR", "GB", "NL"]
|
|
|
|
}
|
|
|
|
|
|
unifi = {
|
|
enabled = false
|
|
|
|
# service = "unifi.unifi.svc:8443"
|
|
service = "192.168.88.244:8443"
|
|
proxy_pass_https = true
|
|
}
|
|
unifi-inform = {
|
|
enabled = false
|
|
|
|
service = "192.168.88.50:8082"
|
|
}
|
|
|
|
|
|
immich = {
|
|
enabled = false
|
|
|
|
#service = "immich-server.immich.svc:2283"
|
|
service = "immich-svc.immich.svc:2283"
|
|
geoip_allow = ["FR", "GB", "NL"]
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
|
|
|
|
#adding websocket , usefull for reverse proxy
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
EOT
|
|
}
|
|
|
|
|
|
|
|
stirling = {
|
|
enabled = false
|
|
service = "stirling-svc.stirling.svc:8080"
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
#working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
|
|
|
|
|
|
EOT
|
|
}
|
|
|
|
|
|
|
|
openmediavault = {
|
|
service = "192.168.88.29"
|
|
}
|
|
pihole = {
|
|
enabled = false
|
|
service = "web.piholenew.svc"
|
|
}
|
|
|
|
synology = {
|
|
enabled = true
|
|
service = "192.168.88.39:5000"
|
|
}
|
|
|
|
gitea = {
|
|
enabled = true
|
|
service = "webserver.gitea.svc:3000"
|
|
docker_service = "webserver.gitea.svc:3000"
|
|
redirect_to_root_domain = false
|
|
}
|
|
|
|
next = {
|
|
enabled = false
|
|
service = "next-svc.next.svc"
|
|
proxy_cache = true
|
|
http2_bool = true
|
|
extra-value = <<EOT
|
|
|
|
|
|
location /.well-known/carddav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location /.well-known/caldav {
|
|
return 301 $scheme://$host/remote.php/dav;
|
|
}
|
|
|
|
location = /health {
|
|
default_type text/html;
|
|
return 200 "<!DOCTYPE html><h2>health check</h2>\n";
|
|
}
|
|
EOT
|
|
}
|
|
|
|
|
|
stash = {
|
|
enabled = false
|
|
service = "stash-svc.stash.svc:9999"
|
|
#geoip_blocking = false
|
|
#extra-value= <<EOT
|
|
# proxy_protocol on;
|
|
#EOT
|
|
extra-value-location = <<EOT
|
|
#don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
|
|
#Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
|
|
#proxy_bind $remote_addr transparent;
|
|
|
|
##used to be working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
#working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
EOT
|
|
|
|
geoip_allow = ["FR", "GB", "NL"]
|
|
}
|
|
neko = {
|
|
enabled = false
|
|
service = "neko-svc.neko.svc:8080"
|
|
http2_bool = true
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
|
|
EOT
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
wikijs = {
|
|
#enabled = false
|
|
geoip_blocking = false
|
|
service = "wikijs-svc.wikijs.svc:3000"
|
|
extra-value = <<EOT
|
|
client_max_body_size 20m;
|
|
proxy_request_buffering off;
|
|
EOT
|
|
}
|
|
|
|
|
|
|
|
|
|
tdarr = {
|
|
enabled = false
|
|
service = "tdarr-svc.servarr.svc:8265"
|
|
extra-value-location = <<EOT
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 60000s;
|
|
#working
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_cache_bypass $http_upgrade;
|
|
#end of working
|
|
|
|
|
|
|
|
EOT
|
|
|
|
}
|
|
|
|
}
|
|
deny_ip = ["1.2.3.4"]
|