diff options
Diffstat (limited to 'straper/db/public/nginx/etc-nginx/sites-available')
14 files changed, 465 insertions, 0 deletions
diff --git a/straper/db/public/nginx/etc-nginx/sites-available/bin.labunix.xyz-9443.conf b/straper/db/public/nginx/etc-nginx/sites-available/bin.labunix.xyz-9443.conf new file mode 100644 index 0000000..399893f --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/bin.labunix.xyz-9443.conf @@ -0,0 +1,23 @@ +server { + listen 443 ssl; + http2 on; + server_name bin.labunix.xyz; + + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + + client_max_body_size 50m; + + location / { + proxy_pass http://127.0.0.1:8081; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + + proxy_http_version 1.1; + proxy_set_header Connection ""; + } +} + diff --git a/straper/db/public/nginx/etc-nginx/sites-available/cloud-wg.conf b/straper/db/public/nginx/etc-nginx/sites-available/cloud-wg.conf new file mode 100644 index 0000000..1209383 --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/cloud-wg.conf @@ -0,0 +1,17 @@ +server { + listen 443 ssl; + http2 on; + server_name cloud.labunix.xyz; + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + client_max_body_size 2G; + + location / { + proxy_pass http://127.0.0.1:9091; # adjust if your upstream differs + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + diff --git a/straper/db/public/nginx/etc-nginx/sites-available/default b/straper/db/public/nginx/etc-nginx/sites-available/default new file mode 100644 index 0000000..c5af914 --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/default @@ -0,0 +1,91 @@ +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# https://www.nginx.com/resources/wiki/start/ +# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/ +# https://wiki.debian.org/Nginx/DirectoryStructure +# +# In most cases, administrators will remove this file from sites-enabled/ and +# leave it as reference inside of sites-available where it will continue to be +# updated by the nginx packaging team. +# +# This file will automatically load configuration files provided by other +# applications, such as Drupal or Wordpress. These applications will be made +# available underneath a path with that package name, such as /drupal8. +# +# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. +## + +# Default server configuration +# +server { + listen 80 default_server; + listen [::]:80 default_server; + + # SSL configuration + # + # listen 443 ssl default_server; + # listen [::]:443 ssl default_server; + # + # Note: You should disable gzip for SSL traffic. + # See: https://bugs.debian.org/773332 + # + # Read up on ssl_ciphers to ensure a secure configuration. + # See: https://bugs.debian.org/765782 + # + # Self signed certs generated by the ssl-cert package + # Don't use them in a production server! + # + # include snippets/snakeoil.conf; + + root /var/www/html; + + # Add index.php to the list if you are using PHP + index index.html index.htm index.nginx-debian.html; + + server_name _; + + location / { + # First attempt to serve request as file, then + # as directory, then fall back to displaying a 404. + try_files $uri $uri/ =404; + } + + # pass PHP scripts to FastCGI server + # + #location ~ \.php$ { + # include snippets/fastcgi-php.conf; + # + # # With php-fpm (or other unix sockets): + # fastcgi_pass unix:/run/php/php7.4-fpm.sock; + # # With php-cgi (or other tcp sockets): + # fastcgi_pass 127.0.0.1:9000; + #} + + # deny access to .htaccess files, if Apache's document root + # concurs with nginx's one + # + #location ~ /\.ht { + # deny all; + #} +} + + +# Virtual Host configuration for example.com +# +# You can move that to a different file under sites-available/ and symlink that +# to sites-enabled/ to enable it. +# +#server { +# listen 80; +# listen [::]:80; +# +# server_name example.com; +# +# root /var/www/example.com; +# index index.html; +# +# location / { +# try_files $uri $uri/ =404; +# } +#} diff --git a/straper/db/public/nginx/etc-nginx/sites-available/etherpad b/straper/db/public/nginx/etc-nginx/sites-available/etherpad new file mode 100644 index 0000000..e7adb82 --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/etherpad @@ -0,0 +1,63 @@ +server { + listen 443 ssl; + http2 on; + server_name ether.labunix.xyz; + + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + + limit_req zone=etherpad_req burst=60 nodelay; + limit_conn etherpad_conn 20; + client_max_body_size 1m; +# Admin only (protect both /admin and /admin/) + location = /admin { + auth_basic "Etherpad Admin"; + auth_basic_user_file /etc/nginx/htpasswd-etherpad-admin; + + proxy_pass http://127.0.0.1:9001; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 120s; + proxy_send_timeout 120s; + proxy_buffering off; + } + + location ^~ /admin/ { + auth_basic "Etherpad Admin"; + auth_basic_user_file /etc/nginx/htpasswd-etherpad-admin; + + proxy_pass http://127.0.0.1:9001; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 120s; + proxy_send_timeout 120s; + proxy_buffering off; + } + location / { + proxy_pass http://127.0.0.1:9001; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 120s; + proxy_send_timeout 120s; + proxy_buffering off; + } +} diff --git a/straper/db/public/nginx/etc-nginx/sites-available/labunix-i2p.conf b/straper/db/public/nginx/etc-nginx/sites-available/labunix-i2p.conf new file mode 100644 index 0000000..9c9ab7e --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/labunix-i2p.conf @@ -0,0 +1,15 @@ +server { + listen 127.0.0.1:8089; + listen [::1]:8089; + server_name _; + + root /srv/www/labunix/public; + index index.html; + + access_log /var/log/nginx/labunix-i2p.access.log; + error_log /var/log/nginx/labunix-i2p.error.log; + + location / { + try_files $uri $uri/ =404; + } +} diff --git a/straper/db/public/nginx/etc-nginx/sites-available/labunix-onion.conf b/straper/db/public/nginx/etc-nginx/sites-available/labunix-onion.conf new file mode 100644 index 0000000..b451e66 --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/labunix-onion.conf @@ -0,0 +1,20 @@ +server { + listen 127.0.0.1:8088; + server_name _; + + root /srv/www/labunix/public; + index index.html; + + access_log /var/log/nginx/labunix-onion.access.log; + error_log /var/log/nginx/labunix-onion.error.log; + + location / { + try_files $uri $uri/ =404; + } + + location ~* \.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff2?)$ { + expires 30d; + add_header Cache-Control "public, max-age=2592000, immutable"; + try_files $uri =404; + } +} diff --git a/straper/db/public/nginx/etc-nginx/sites-available/labunix.conf b/straper/db/public/nginx/etc-nginx/sites-available/labunix.conf new file mode 100644 index 0000000..01043ff --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/labunix.conf @@ -0,0 +1,47 @@ +# HTTP on :9080 (optional: redirect to HTTPS :9443) +server { + listen 9080; + server_name labunix.xyz www.labunix.xyz 10.50.0.1; + + # If you want redirect to HTTPS on :9443: + return 301 https://$host:443$request_uri; + + # If you prefer serving plain HTTP instead, comment the return above + # and uncomment this: + # root /srv/www/labunix/public; + # index index.html; + # location / { try_files $uri $uri/ =404; } +} + +# HTTPS on :9443 +server { + listen 443 ssl; + http2 on; + server_name labunix.xyz www.labunix.xyz 10.50.0.1; + + root /srv/www/labunix/public; + index index.html; + + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + + add_header Onion-Location "http://l6xtdi33ubszm2gswstchrb6o4d6aw3ewj2irexlsbzk6pvesky7p2ad.onion$request_uri" always; + + location / { + try_files $uri $uri/ =404; + } + location /stats/ { + alias /srv/stats/; + index goaccess.html; + allow 127.0.0.1; + allow 10.50.0.0/24; + allow 192.168.33.0/24; + deny all; + } + + location ~* \.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff2?)$ { + expires 30d; + add_header Cache-Control "public, max-age=2592000, immutable"; + try_files $uri =404; + } +} diff --git a/straper/db/public/nginx/etc-nginx/sites-available/labunix.xyz b/straper/db/public/nginx/etc-nginx/sites-available/labunix.xyz new file mode 100644 index 0000000..a6267a4 --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/labunix.xyz @@ -0,0 +1,9 @@ +server { + listen 9080; + server_name labunix.xyz www.labunix.xyz cloud.labunix.xyz vpn.labunix.xyz; + + root /var/www/labunix; + index index.html; +} + + diff --git a/straper/db/public/nginx/etc-nginx/sites-available/lufi.conf b/straper/db/public/nginx/etc-nginx/sites-available/lufi.conf new file mode 100644 index 0000000..0051841 --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/lufi.conf @@ -0,0 +1,34 @@ +server { + listen 443 ssl; + http2 on; + server_name lufi.labunix.xyz; + + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + + auth_basic "Restricted"; + auth_basic_user_file /etc/nginx/lufi.htpasswd; + + access_log /var/log/nginx/vhost.access.log vhost; + error_log /var/log/nginx/lufi.error.log; + + location / { + proxy_pass http://127.0.0.1:8090; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Port 443; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + add_header X-Frame-Options SAMEORIGIN always; + add_header X-Content-Type-Options nosniff always; + client_max_body_size 2G; + proxy_read_timeout 3600s; + } +} + diff --git a/straper/db/public/nginx/etc-nginx/sites-available/pad.labunix.xyz-9443.conf b/straper/db/public/nginx/etc-nginx/sites-available/pad.labunix.xyz-9443.conf new file mode 100644 index 0000000..b0b47df --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/pad.labunix.xyz-9443.conf @@ -0,0 +1,67 @@ +# pad.labunix.xyz (main) → HTTP:3101, WS:3103 +server { + listen 443 ssl; + http2 on; + server_name pad.labunix.xyz; + access_log /var/log/nginx/vhost.access.log vhost; + ssl_certificate /etc/letsencrypt/live/pad.labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/pad.labunix.xyz/privkey.pem; + client_max_body_size 100m; + auth_basic "Restricted"; + auth_basic_user_file /etc/nginx/htpasswd-cryptpad; + + location /cryptpad_websocket { + proxy_pass http://127.0.0.1:3103; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + + location / { + proxy_pass http://127.0.0.1:3101; + proxy_http_version 1.1; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } +} + +# pad-sandbox.labunix.xyz (sandbox) → HTTP:3101, WS:3103 +server { + listen 443 ssl; + http2 on; + server_name pad-sandbox.labunix.xyz; + access_log /var/log/nginx/vhost.access.log vhost; + ssl_certificate /etc/letsencrypt/live/pad.labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/pad.labunix.xyz/privkey.pem; + client_max_body_size 100m; + + location /cryptpad_websocket { + proxy_pass http://127.0.0.1:3103; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + + location / { + proxy_pass http://127.0.0.1:3101; + proxy_http_version 1.1; + proxy_set_header Host $http_host; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } +} diff --git a/straper/db/public/nginx/etc-nginx/sites-available/search.labunix.xyz.conf b/straper/db/public/nginx/etc-nginx/sites-available/search.labunix.xyz.conf new file mode 100644 index 0000000..64c151d --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/search.labunix.xyz.conf @@ -0,0 +1,22 @@ +limit_req_zone $binary_remote_addr zone=searxng:10m rate=30r/m; + +server { + listen 443 ssl; + http2 on; + server_name search.labunix.xyz; + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + + location / { + limit_req zone=searxng burst=50 nodelay; + limit_req_status 429; + + proxy_pass http://10.50.0.1:8080; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + proxy_http_version 1.1; + proxy_set_header Connection ""; + } +} diff --git a/straper/db/public/nginx/etc-nginx/sites-available/upload.labunix.xyz-9443.conf b/straper/db/public/nginx/etc-nginx/sites-available/upload.labunix.xyz-9443.conf new file mode 100644 index 0000000..11d7c82 --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/upload.labunix.xyz-9443.conf @@ -0,0 +1,24 @@ +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name upload.labunix.xyz; + + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + + client_max_body_size 21m; + + location / { + proxy_pass http://127.0.0.1:5280; + + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_request_buffering off; + proxy_buffering off; + } +} + diff --git a/straper/db/public/nginx/etc-nginx/sites-available/vault.labunix.xyz b/straper/db/public/nginx/etc-nginx/sites-available/vault.labunix.xyz new file mode 100644 index 0000000..5b1d7de --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/vault.labunix.xyz @@ -0,0 +1,2 @@ +# disabled: vault.labunix.xyz config moved elsewhere + diff --git a/straper/db/public/nginx/etc-nginx/sites-available/vault.labunix.xyz-9443.conf b/straper/db/public/nginx/etc-nginx/sites-available/vault.labunix.xyz-9443.conf new file mode 100644 index 0000000..022539a --- /dev/null +++ b/straper/db/public/nginx/etc-nginx/sites-available/vault.labunix.xyz-9443.conf @@ -0,0 +1,31 @@ +server { + listen 443 ssl; + server_name vault.labunix.xyz; + + ssl_certificate /etc/letsencrypt/live/labunix.xyz/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/labunix.xyz/privkey.pem; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + client_max_body_size 100m; + + location / { + proxy_pass http://127.0.0.1:9081; + } + + # keep only if you publish 127.0.0.1:3012:3012 + location /notifications/hub { + proxy_pass http://127.0.0.1:3012; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + } + + location /notifications/hub/negotiate { + proxy_pass http://127.0.0.1:9081; + } +} + |