From 29c197a67b7278fe73cead0708e8d73fe06f1d11 Mon Sep 17 00:00:00 2001 From: Michael Winter Date: Fri, 22 Nov 2019 18:09:06 +0000 Subject: [PATCH] some updated nginx configs --- nginx/conf.d/default.conf | 48 +++++++++++++++++++++++--- nginx/vhost.d/default | 9 +++++ nginx/vhost.d/gitea.unboundedpress.org | 9 +++++ 3 files changed, 61 insertions(+), 5 deletions(-) create mode 100644 nginx/vhost.d/default diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf index d7ae2c6..1c417bb 100644 --- a/nginx/conf.d/default.conf +++ b/nginx/conf.d/default.conf @@ -59,11 +59,45 @@ server { ssl_certificate /etc/nginx/certs/default.crt; ssl_certificate_key /etc/nginx/certs/default.key; } +# express.unboundedpress.org +upstream express.unboundedpress.org { + ## Can be connected with "www_default" network + # mongo-express + server 172.18.0.8:8081; +} +server { + server_name express.unboundedpress.org; + listen 80 ; + access_log /var/log/nginx/access.log vhost; + return 301 https://$host$request_uri; +} +server { + server_name express.unboundedpress.org; + listen 443 ssl http2 ; + access_log /var/log/nginx/access.log vhost; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'; + ssl_prefer_server_ciphers on; + ssl_session_timeout 5m; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + ssl_certificate /etc/nginx/certs/express.unboundedpress.org.crt; + ssl_certificate_key /etc/nginx/certs/express.unboundedpress.org.key; + ssl_dhparam /etc/nginx/certs/express.unboundedpress.org.dhparam.pem; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/nginx/certs/express.unboundedpress.org.chain.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + include /etc/nginx/vhost.d/default; + location / { + proxy_pass http://express.unboundedpress.org; + } +} # gitea.unboundedpress.org upstream gitea.unboundedpress.org { ## Can be connected with "www_default" network # gitea - server 172.18.0.6:4000; + server 172.18.0.3:4000; } server { server_name gitea.unboundedpress.org; @@ -97,7 +131,7 @@ server { upstream nextcloud.unboundedpress.org { ## Can be connected with "www_default" network # nextcloud - server 172.18.0.7:80; + server 172.18.0.10:80; } server { server_name nextcloud.unboundedpress.org; @@ -122,6 +156,7 @@ server { ssl_stapling_verify on; ssl_trusted_certificate /etc/nginx/certs/nextcloud.unboundedpress.org.chain.pem; add_header Strict-Transport-Security "max-age=31536000" always; + include /etc/nginx/vhost.d/default; location / { proxy_pass http://nextcloud.unboundedpress.org; } @@ -130,7 +165,7 @@ server { upstream restheart.unboundedpress.org { ## Can be connected with "www_default" network # restheart - server 172.18.0.9:8080; + server 172.18.0.6:8080; } server { server_name restheart.unboundedpress.org; @@ -155,6 +190,7 @@ server { ssl_stapling_verify on; ssl_trusted_certificate /etc/nginx/certs/restheart.unboundedpress.org.chain.pem; add_header Strict-Transport-Security "max-age=31536000" always; + include /etc/nginx/vhost.d/default; location / { proxy_pass http://restheart.unboundedpress.org; } @@ -163,7 +199,7 @@ server { upstream unboundedpress.org { ## Can be connected with "www_default" network # unboundedpress - server 172.18.0.10:3000; + server 172.18.0.11:3000; } server { server_name unboundedpress.org; @@ -188,6 +224,7 @@ server { ssl_stapling_verify on; ssl_trusted_certificate /etc/nginx/certs/unboundedpress.org.chain.pem; add_header Strict-Transport-Security "max-age=31536000" always; + include /etc/nginx/vhost.d/default; location / { proxy_pass http://unboundedpress.org; } @@ -196,7 +233,7 @@ server { upstream www.unboundedpress.org { ## Can be connected with "www_default" network # unboundedpress - server 172.18.0.10:3000; + server 172.18.0.11:3000; } server { server_name www.unboundedpress.org; @@ -221,6 +258,7 @@ server { ssl_stapling_verify on; ssl_trusted_certificate /etc/nginx/certs/www.unboundedpress.org.chain.pem; add_header Strict-Transport-Security "max-age=31536000" always; + include /etc/nginx/vhost.d/default; location / { proxy_pass http://www.unboundedpress.org; } diff --git a/nginx/vhost.d/default b/nginx/vhost.d/default new file mode 100644 index 0000000..a25c774 --- /dev/null +++ b/nginx/vhost.d/default @@ -0,0 +1,9 @@ +## Start of configuration add by letsencrypt container +location ^~ /.well-known/acme-challenge/ { + auth_basic off; + allow all; + root /usr/share/nginx/html; + try_files $uri =404; + break; +} +## End of configuration add by letsencrypt container diff --git a/nginx/vhost.d/gitea.unboundedpress.org b/nginx/vhost.d/gitea.unboundedpress.org index 782022c..2eb01a6 100644 --- a/nginx/vhost.d/gitea.unboundedpress.org +++ b/nginx/vhost.d/gitea.unboundedpress.org @@ -1,3 +1,12 @@ +## Start of configuration add by letsencrypt container +location ^~ /.well-known/acme-challenge/ { + auth_basic off; + allow all; + root /usr/share/nginx/html; + try_files $uri =404; + break; +} +## End of configuration add by letsencrypt container location = / { rewrite ^ http://gitea.unboundedpress.org/mwinter/ redirect; }