main.conf - Opengist

main.conf · 4.3 KiB · Text Raw

map "$http_upgrade_insecure_requests:$scheme" $do_upgrade { "1:http" 1; default 0; } map $request_method $var_auth_basic { default "Restricted"; GET off; HEAD off; } server { # Listen listen 443 quic reuseport; listen [::]:443 quic reuseport; listen 443 ssl; listen [::]:443 ssl; listen 80; listen [::]:80; server_name swee.codes; # other 101% important nginx stuff index index.php index.html index.htm; root /var/www/swee.codes; error_page 404 /errors/404.html; error_page 418 /errors/418.html; error_page 500 /errors/500.html; error_page 502 /errors/502.html; # Headers add_header 'Access-Control-Allow-Origin' '*'; add_header "Cache-Control" "public, max-age=300"; add_header "X-Frame-Policy" "SAMEORIGIN"; # TODO: Find a way to fix the header adding without setting it her add_header Alt-Svc 'h3=":443"; ma=86400, h3-29=":443"; ma=86400' always; add_header x-quic 'h3' always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; # Upgrade HTTP if required if ($do_upgrade) { return 302 https://$host$request_uri; } # Rewrite PHP if exists location / { if (-e $request_filename.php){ rewrite ^/(.*)$ /$1.php; } try_files $uri $uri.html $uri.htm $uri/ /special.php$request_uri; } # Fancy directory listings fancyindex on; fancyindex_exact_size off; fancyindex_css_href "https://cdn.swee.codes/assets/fancyindex.css"; # Handle PHP location ~ \.php(?:$|/) { fastcgi_split_path_info ^(.+\.php)(/.*)$; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; include fastcgi_params; include fastcgi.conf; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_intercept_errors on; } # Block sensitive directories location /.git { return 418; } # OCI registry location /v2/ { client_max_body_size 5G; proxy_pass http://127.0.0.1:5678/v2/; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Connection ""; chunked_transfer_encoding off; auth_basic $var_auth_basic; auth_basic_user_file /etc/registry/htpasswd; } # Proxy matrix client location ~ ^/_(matrix|synapse)/client { proxy_pass https://matrix.swee.codes; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; proxy_http_version 1.1; } # Redirect sweetlogo to its repo location ~ ^/sweetlogo.(.*)$ { return 301 https://git.swee.codes/swee/sweetlogo/raw/branch/main/sweetlogo.$1; } # Redirect uploads to R2 location ~ ^/uploads/(.*)$ { return 301 https://cdn.swee.codes/uploads/$1; } # Redirect apt repo to cdn2 location ~ ^/apt-repo/(.*)$ { return 301 https://debian.pkg.swee.codes/$1; } # TODO: Use this again when chainlink is up #location /u/ { #rewrite /u/(.*) /$1 break; #proxy_pass https://u.swee.codes/; #proxy_ssl_server_name on; #proxy_set_header Host u.swee.codes; #} # Certbot shit ssl_certificate /etc/letsencrypt/live/swee.codes/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/swee.codes/privkey.pem; # managed by Certbot include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot }

1	map "$http_upgrade_insecure_requests:$scheme" $do_upgrade {
2	"1:http" 1;
3	default 0;
4	}
5
6	map $request_method $var_auth_basic {
7	default "Restricted";
8	GET off;
9	HEAD off;
10	}
11
12	server {
13	# Listen
14	listen 443 quic reuseport;
15	listen [::]:443 quic reuseport;
16	listen 443 ssl;
17	listen [::]:443 ssl;
18	listen 80;
19	listen [::]:80;
20	server_name swee.codes;
21
22	# other 101% important nginx stuff
23
24	index index.php index.html index.htm;
25	root /var/www/swee.codes;
26	error_page 404 /errors/404.html;
27	error_page 418 /errors/418.html;
28	error_page 500 /errors/500.html;
29	error_page 502 /errors/502.html;
30
31	# Headers
32	add_header 'Access-Control-Allow-Origin' '*';
33	add_header "Cache-Control" "public, max-age=300";
34	add_header "X-Frame-Policy" "SAMEORIGIN";
35	# TODO: Find a way to fix the header adding without setting it her
36	add_header Alt-Svc 'h3=":443"; ma=86400, h3-29=":443"; ma=86400' always;
37	add_header x-quic 'h3' always;
38	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
39
40	# Upgrade HTTP if required
41	if ($do_upgrade) {
42	return 302 https://$host$request_uri;
43	}
44
45	# Rewrite PHP if exists
46	location / {
47	if (-e $request_filename.php){
48	rewrite ^/(.*)$ /$1.php;
49	}
50	try_files $uri $uri.html $uri.htm $uri/ /special.php$request_uri;
51	}
52
53	# Fancy directory listings
54	fancyindex on;
55	fancyindex_exact_size off;
56	fancyindex_css_href "https://cdn.swee.codes/assets/fancyindex.css";
57
58	# Handle PHP
59	location ~ \.php(?:$\|/) {
60	fastcgi_split_path_info ^(.+\.php)(/.*)$;
61	fastcgi_pass 127.0.0.1:9000;
62	fastcgi_index index.php;
63	include fastcgi_params;
64	include fastcgi.conf;
65	fastcgi_param PATH_INFO $fastcgi_path_info;
66	fastcgi_intercept_errors on;
67	}
68
69	# Block sensitive directories
70	location /.git {
71	return 418;
72	}
73
74	# OCI registry
75	location /v2/ {
76	client_max_body_size 5G;
77	proxy_pass http://127.0.0.1:5678/v2/;
78	proxy_set_header Host $host;
79	proxy_set_header X-Real-IP $remote_addr;
80	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
81	proxy_set_header X-Forwarded-Proto $scheme;
82	proxy_http_version 1.1;
83	proxy_set_header Connection "";
84	chunked_transfer_encoding off;
85
86	auth_basic $var_auth_basic;
87	auth_basic_user_file /etc/registry/htpasswd;
88	}
89
90	# Proxy matrix client
91
92	location ~ ^/_(matrix\|synapse)/client {
93	proxy_pass https://matrix.swee.codes;
94	proxy_set_header X-Forwarded-For $remote_addr;
95	proxy_set_header X-Forwarded-Proto $scheme;
96	proxy_set_header Host $host;
97	proxy_http_version 1.1;
98	}
99
100
101	# Redirect sweetlogo to its repo
102
103	location ~ ^/sweetlogo.(.*)$ {
104	return 301 https://git.swee.codes/swee/sweetlogo/raw/branch/main/sweetlogo.$1;
105	}
106
107	# Redirect uploads to R2
108
109	location ~ ^/uploads/(.*)$ {
110	return 301 https://cdn.swee.codes/uploads/$1;
111	}
112
113	# Redirect apt repo to cdn2
114
115	location ~ ^/apt-repo/(.*)$ {
116	return 301 https://debian.pkg.swee.codes/$1;
117	}
118
119	# TODO: Use this again when chainlink is up
120
121	#location /u/ {
122	#rewrite /u/(.*) /$1 break;
123	#proxy_pass https://u.swee.codes/;
124	#proxy_ssl_server_name on;
125	#proxy_set_header Host u.swee.codes;
126	#}
127
128	# Certbot shit
129
130	ssl_certificate /etc/letsencrypt/live/swee.codes/fullchain.pem; # managed by Certbot
131	ssl_certificate_key /etc/letsencrypt/live/swee.codes/privkey.pem; # managed by Certbot
132	include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
133	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
134	}