mwinter/unboundedpress
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

some updated nginx configs

Browse source
This commit is contained in:
Michael Winter 2019-11-22 18:09:06 +00:00
parent cb01154984
commit 29c197a67b
3 changed files with 61 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

48
nginx/conf.d/default.conf
View file

@ -59,11 +59,45 @@ server {
ssl_certificate /etc/nginx/certs/default.crt;
ssl_certificate_key /etc/nginx/certs/default.key;
}
# express.unboundedpress.org
upstream express.unboundedpress.org {
## Can be connected with "www_default" network
# mongo-express
server 172.18.0.8:8081;
}
server {
server_name express.unboundedpress.org;
listen 80 ;
access_log /var/log/nginx/access.log vhost;
return 301 https://$host$request_uri;
}
server {
server_name express.unboundedpress.org;
listen 443 ssl http2 ;
access_log /var/log/nginx/access.log vhost;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS';
ssl_prefer_server_ciphers on;
ssl_session_timeout 5m;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_certificate /etc/nginx/certs/express.unboundedpress.org.crt;
ssl_certificate_key /etc/nginx/certs/express.unboundedpress.org.key;
ssl_dhparam /etc/nginx/certs/express.unboundedpress.org.dhparam.pem;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/express.unboundedpress.org.chain.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
include /etc/nginx/vhost.d/default;
location / {
proxy_pass http://express.unboundedpress.org;
}
}
# gitea.unboundedpress.org
upstream gitea.unboundedpress.org {
## Can be connected with "www_default" network
# gitea
server 172.18.0.6:4000;
server 172.18.0.3:4000;
}
server {
server_name gitea.unboundedpress.org;
@ -97,7 +131,7 @@ server {
upstream nextcloud.unboundedpress.org {
## Can be connected with "www_default" network
# nextcloud
server 172.18.0.7:80;
server 172.18.0.10:80;
}
server {
server_name nextcloud.unboundedpress.org;
@ -122,6 +156,7 @@ server {
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/nextcloud.unboundedpress.org.chain.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
include /etc/nginx/vhost.d/default;
location / {
proxy_pass http://nextcloud.unboundedpress.org;
}
@ -130,7 +165,7 @@ server {
upstream restheart.unboundedpress.org {
## Can be connected with "www_default" network
# restheart
server 172.18.0.9:8080;
server 172.18.0.6:8080;
}
server {
server_name restheart.unboundedpress.org;
@ -155,6 +190,7 @@ server {
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/restheart.unboundedpress.org.chain.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
include /etc/nginx/vhost.d/default;
location / {
proxy_pass http://restheart.unboundedpress.org;
}
@ -163,7 +199,7 @@ server {
upstream unboundedpress.org {
## Can be connected with "www_default" network
# unboundedpress
server 172.18.0.10:3000;
server 172.18.0.11:3000;
}
server {
server_name unboundedpress.org;
@ -188,6 +224,7 @@ server {
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/unboundedpress.org.chain.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
include /etc/nginx/vhost.d/default;
location / {
proxy_pass http://unboundedpress.org;
}
@ -196,7 +233,7 @@ server {
upstream www.unboundedpress.org {
## Can be connected with "www_default" network
# unboundedpress
server 172.18.0.10:3000;
server 172.18.0.11:3000;
}
server {
server_name www.unboundedpress.org;
@ -221,6 +258,7 @@ server {
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/certs/www.unboundedpress.org.chain.pem;
add_header Strict-Transport-Security "max-age=31536000" always;
include /etc/nginx/vhost.d/default;
location / {
proxy_pass http://www.unboundedpress.org;
}

9
nginx/vhost.d/default Normal file
View file

@ -0,0 +1,9 @@
## Start of configuration add by letsencrypt container
location ^~ /.well-known/acme-challenge/ {
auth_basic off;
allow all;
root /usr/share/nginx/html;
try_files $uri =404;
break;
}
## End of configuration add by letsencrypt container

9
nginx/vhost.d/gitea.unboundedpress.org
View file

@ -1,3 +1,12 @@
## Start of configuration add by letsencrypt container
location ^~ /.well-known/acme-challenge/ {
auth_basic off;
allow all;
root /usr/share/nginx/html;
try_files $uri =404;
break;
}
## End of configuration add by letsencrypt container
location = / {
rewrite ^ http://gitea.unboundedpress.org/mwinter/ redirect;
}