76 lines
2.8 KiB
Plaintext
76 lines
2.8 KiB
Plaintext
# SPDX-FileCopyrightText: 2021 The NGI Pointer Secure-Scuttlebutt Team of 2020/2021
|
|
#
|
|
# SPDX-License-Identifier: Unlicense
|
|
|
|
server {
|
|
server_name hermies.club;
|
|
|
|
listen 443 ssl; # managed by Certbot
|
|
|
|
ssl_certificate /etc/letsencrypt/live/hermies.club/fullchain.pem; # managed by Certbot
|
|
ssl_certificate_key /etc/letsencrypt/live/hermies.club/privkey.pem; # managed by Certbot
|
|
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
|
|
location / {
|
|
proxy_pass http://localhost:8899;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
# for websocket
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
# requires a $connection_upgrade definition in /etc/nginx/nginx.conf
|
|
# see https://futurestud.io/tutorials/nginx-how-to-fix-unknown-connection_upgrade-variable
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
|
|
# TODO: https://blog.tarq.io/nginx-catch-all-error-pages/
|
|
}
|
|
|
|
# this server uses the (same) wildcard cert as the one above but uses a regular expression on the hostname
|
|
# which extracts the first subdomain which holds the alias and forwards that to the prox_pass server
|
|
server {
|
|
server_name "~^(?<alias>\w+)\.hermies\.club$";
|
|
|
|
listen 443 ssl; # managed by Certbot
|
|
|
|
ssl_certificate /etc/letsencrypt/live/hermies.club/fullchain.pem; # managed by Certbot
|
|
ssl_certificate_key /etc/letsencrypt/live/hermies.club/privkey.pem; # managed by Certbot
|
|
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
|
|
|
location = / {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
# "rewrite" requests with subdomains to the non-wildcard url for alias resolving
|
|
# $is_args$args pass on ?encoding=json if present
|
|
proxy_pass http://localhost:8899/alias/$alias$is_args$args;
|
|
}
|
|
|
|
location / {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_pass http://localhost:8899;
|
|
}
|
|
|
|
# TODO: https://blog.tarq.io/nginx-catch-all-error-pages/
|
|
}
|
|
|
|
server {
|
|
if ($host ~ hermies.club$ ) {
|
|
return 301 https://$host$request_uri;
|
|
} # managed by Certbot
|
|
|
|
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
server_name hermies.club;
|
|
return 404; # managed by Certbot
|
|
}
|