305 lines
10 KiB
Plaintext
305 lines
10 KiB
Plaintext
# WebSocket support
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
# Redirect HTTP -> HTTPS
|
|
server {
|
|
listen 80;
|
|
server_name
|
|
cloud.someoneslinux.selfhost.eu
|
|
media.someoneslinux.selfhost.eu
|
|
audiobooks.someoneslinux.selfhost.eu
|
|
login.someoneslinux.selfhost.eu
|
|
auto.someoneslinux.selfhost.eu
|
|
music.someoneslinux.selfhost.eu
|
|
passwd.someoneslinux.selfhost.eu
|
|
requests.someoneslinux.selfhost.eu
|
|
torrent.someoneslinux.selfhost.eu
|
|
status.someoneslinux.selfhost.eu;
|
|
#ssl_conf_command Groups X25519:secp256r1:secp384r1;
|
|
# ssl_conf_command Groups X25519:prime256v1:secp384r1;
|
|
location /.well-known/acme-challenge/ {
|
|
root /usr/share/nginx/html;
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
# Common SSL settings
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers on;
|
|
|
|
###################
|
|
# NEXTCLOUD
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name cloud.someoneslinux.selfhost.eu;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
client_max_body_size 10G;
|
|
|
|
location / {
|
|
proxy_pass http://nextcloud:80;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# JELLYFIN
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name media.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://jellyfin:8096;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# AUDIOBOOKSHELF
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name audiobooks.someoneslinux.selfhost.eu;
|
|
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://audiobookshelf:80;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# AUTHENTIK
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name login.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://authentik-server-1:9000;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|
|
}
|
|
|
|
####################
|
|
## HOME ASSISTANT
|
|
####################
|
|
#server {
|
|
# listen 443 ssl;http2 on;
|
|
# server_name auto.someoneslinux.selfhost.eu;
|
|
#
|
|
# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
|
|
# add_header X-Frame-Options "SAMEORIGIN" always;
|
|
# add_header X-Content-Type-Options "nosniff" always;
|
|
# add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
#
|
|
# ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
# ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
#
|
|
# location / {
|
|
# proxy_pass http://192.168.0.4:8123;
|
|
# proxy_http_version 1.1;
|
|
#
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header Upgrade $http_upgrade;
|
|
# proxy_set_header Connection $connection_upgrade;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
# proxy_set_header X-Forwarded-Proto https;
|
|
# }
|
|
#}
|
|
|
|
###################
|
|
# NAVIDROME
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name music.someoneslinux.selfhost.eu;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://navidrome:4533;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# VAULTWARDEN
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name passwd.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://vaultwarden:80;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|
|
|
|
location /notifications/hub {
|
|
proxy_pass http://vaultwarden:3012;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# SEERR
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name requests.someoneslinux.selfhost.eu;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://seerr:5055;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# QBITTORRENT
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name torrent.someoneslinux.selfhost.eu;
|
|
|
|
add_header Content-Security-Policy "frame-ancestors 'self';" always;
|
|
# add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://192.168.0.2:8080;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|
|
|
|
###################
|
|
# GRFANA
|
|
###################
|
|
server {
|
|
listen 443 ssl;http2 on;
|
|
server_name status.someoneslinux.selfhost.eu;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
|
|
ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
|
|
ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
|
|
|
|
location / {
|
|
proxy_pass http://grafana:3000;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
}
|
|
}
|