lucas
52c02beb3d
add gite to shared proxy add usb dev and NET privilige to HA add immich image server remove sonarr-en add jackett indexer for ABB add gluetun-proxy for general proxy add blackbox exporter to check https sites set node-exporter to network host to see interface traffic decrease resolution of cadvisor to save RAM add status and code SANs for nginx add upstream block so sites are not redirecte to cloud... add homeassistant config add nginx exporter for prometheus
373 lines
12 KiB
Plaintext
373 lines
12 KiB
Plaintext
# WebSocket support
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# Redirect HTTP -> HTTPS
|
|
server {
|
|
listen 80;
|
|
server_name
|
|
cloud.someoneslinux.selfhost.eu
|
|
media.someoneslinux.selfhost.eu
|
|
audiobooks.someoneslinux.selfhost.eu
|
|
login.someoneslinux.selfhost.eu
|
|
auto.someoneslinux.selfhost.eu
|
|
music.someoneslinux.selfhost.eu
|
|
passwd.someoneslinux.selfhost.eu
|
|
requests.someoneslinux.selfhost.eu
|
|
torrent.someoneslinux.selfhost.eu
|
|
status.someoneslinux.selfhost.eu
|
|
code.someoneslinux.selfhost.eu;
|
|
#ssl_conf_command Groups X25519:secp256r1:secp384r1;
|
|
# ssl_conf_command Groups X25519:prime256v1:secp384r1;
|
|
location /.well-known/acme-challenge/ {
|
|
root /usr/share/nginx/html;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
|
|
}
|
|
|
|
listen 8080;
|
|
location /nginx_status {
|
|
stub_status;
|
|
allow 172.16.0.0/12;
|
|
deny all;
|
|
}
|
|
}
|
|
|
|
# Common SSL settings
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
server {
|
|
listen 443 ssl default_server;
|
|
server_name _;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
return 404;
|
|
}
|
|
|
|
###################
|
|
# NEXTCLOUD
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name cloud.someoneslinux.selfhost.eu;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
client_max_body_size 10G;
|
|
|
|
location / {
|
|
proxy_pass http://nextcloud:80;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# JELLYFIN
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name media.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://jellyfin:8096;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# AUDIOBOOKSHELF
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name audiobooks.someoneslinux.selfhost.eu;
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://audiobookshelf:80;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
####################
|
|
## AUTHENTIK
|
|
####################
|
|
#server {
|
|
# listen 443 ssl;http2 on;
|
|
# server_name login.someoneslinux.selfhost.eu;
|
|
#
|
|
# add_header Content-Security-Policy "frame-ancestors 'self';" always;
|
|
# add_header X-Frame-Options "SAMEORIGIN" always;
|
|
# add_header X-Content-Type-Options "nosniff" always;
|
|
# add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
#
|
|
# ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
# ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
#
|
|
# location / {
|
|
# proxy_pass http://authentik-server-1:9000;
|
|
# proxy_http_version 1.1;
|
|
#
|
|
# proxy_set_header X-Forwarded-Proto https;
|
|
# proxy_set_header X-Forwarded-Host $host;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
# }
|
|
#}
|
|
|
|
###################
|
|
# HOME ASSISTANT
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name auto.someoneslinux.selfhost.eu;
|
|
|
|
# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://192.168.0.4:8123;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# NAVIDROME
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name music.someoneslinux.selfhost.eu;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://navidrome:4533;
|
|
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# VAULTWARDEN
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name passwd.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://vaultwarden:80;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|
|
|
|
location /notifications/hub {
|
|
proxy_pass http://vaultwarden:3012;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# SEERR
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name requests.someoneslinux.selfhost.eu;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://seerr:5055;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# QBITTORRENT
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name torrent.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "frame-ancestors 'self';" always;
|
|
# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://192.168.0.2:8080;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
|
|
}
|
|
|
|
###################
|
|
# GRFANA
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name status.someoneslinux.selfhost.eu;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://grafana:3000;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# GITEA
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name code.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://gitea:3000;
|
|
# Do not try another upstream on errors
|
|
proxy_next_upstream off;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
}
|