108 lines
3.6 KiB
Plaintext
108 lines
3.6 KiB
Plaintext
# Auto-generated by Vacuum Wall — do not edit manually
|
|
# Domain: {{ domain }}
|
|
|
|
{% if force_ssl %}
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name {{ domain }};
|
|
|
|
# ACME HTTP-01 challenge
|
|
location /.well-known/acme-challenge/ {
|
|
root {{ acme_webroot }};
|
|
}
|
|
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
{% endif %}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name {{ domain }};
|
|
|
|
{% if cert %}
|
|
{% if cert == "acme" %}
|
|
ssl_certificate {{ acme_cert_dir }}/fullchain.cer;
|
|
ssl_certificate_key {{ acme_cert_dir }}/{{ domain }}.key;
|
|
{% elif cert == "file" %}
|
|
ssl_certificate {{ cert_path }};
|
|
ssl_certificate_key {{ cert_key_path }};
|
|
{% elif cert == "selfsigned" %}
|
|
ssl_certificate {{ certs_dir }}/{{ domain }}.crt;
|
|
ssl_certificate_key {{ certs_dir }}/{{ domain }}.key;
|
|
{% endif %}
|
|
{% elif has_management %}
|
|
ssl_certificate {{ certs_dir }}/{{ domain }}.crt;
|
|
ssl_certificate_key {{ certs_dir }}/{{ domain }}.key;
|
|
{% endif %}
|
|
|
|
include snippets/vacuum-wall-ssl.conf;
|
|
|
|
{% if domain_auth %}
|
|
auth_basic "Restricted";
|
|
auth_basic_user_file {{ domain_auth.htpasswd }};
|
|
{% endif %}
|
|
|
|
{% if not has_management %}
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header X-Frame-Options DENY always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
{% endif %}
|
|
|
|
{% for ppath, pcfg in paths.items() %}
|
|
{% if pcfg.is_websocket %}
|
|
# {{ ppath }} -> {{ pcfg.backend.host }}:{{ pcfg.backend.port }} (WebSocket)
|
|
location {{ ppath }} {
|
|
auth_basic off;
|
|
proxy_pass http://{{ pcfg.backend.host }}:{{ pcfg.backend.port }};
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 86400s;
|
|
proxy_send_timeout 86400s;
|
|
}
|
|
{% else %}
|
|
# {{ ppath }} -> {{ pcfg.backend.host }}:{{ pcfg.backend.port }}
|
|
location {{ ppath }} {
|
|
{% if pcfg.auth is none %}
|
|
auth_basic off;
|
|
{% elif pcfg.auth is defined %}
|
|
auth_basic "Restricted";
|
|
auth_basic_user_file {{ pcfg.auth.htpasswd }};
|
|
{% endif %}
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
{% if not pcfg.is_management %}
|
|
{% for hname, hval in (pcfg.headers or {}).items() %}
|
|
proxy_set_header {{ hname }} {{ hval }};
|
|
{% endfor %}
|
|
{% endif %}
|
|
proxy_pass {{ pcfg.backend.proto }}://{{ pcfg.backend.host }}:{{ pcfg.backend.port }};
|
|
proxy_http_version 1.1;
|
|
proxy_connect_timeout 30s;
|
|
proxy_send_timeout 60s;
|
|
proxy_read_timeout 60s;
|
|
proxy_buffering off;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
{% endif %}
|
|
{% endfor %}
|
|
|
|
{% if has_management %}
|
|
access_log /var/log/nginx/wall_mgmt_access.log;
|
|
error_log /var/log/nginx/wall_mgmt_error.log warn;
|
|
{% else %}
|
|
access_log /var/log/nginx/{{ domain }}_access.log;
|
|
error_log /var/log/nginx/{{ domain }}_error.log warn;
|
|
{% endif %}
|
|
} |