mteehan
8feb56faf6
- Add find_cert_dir() to resolve both RSA and ECC (domain_ecc/) cert dirs - Copy acme deploy hook to /deploy/ where acme.sh resolves it - _parse_account_conf checks both legacy .account.conf and declarative config - Skip public DNS check when all local IPs are private (NAT) - Improve check message strings for validity and expiry status - Support timezone-aware date formats in _days_until parsing - Filter out "no" SAN domains in cert listing - Bump frontend asset version cache keys - Fix DOMContentLoaded race condition in app.js boot - Fix spread operator in certs.js modal template
106 lines
3.2 KiB
Plaintext
106 lines
3.2 KiB
Plaintext
# Auto-generated by Vacuum Wall — do not edit manually
|
|
# Domain: {{ domain }}
|
|
|
|
{% if force_ssl %}
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name {{ domain }};
|
|
|
|
# ACME HTTP-01 challenge
|
|
location /.well-known/acme-challenge/ {
|
|
root {{ acme_webroot }};
|
|
}
|
|
|
|
# Redirect all HTTP traffic to HTTPS
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
{% endif %}
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name {{ domain }};
|
|
|
|
{% if cert %}
|
|
{% if cert.type == "acme" %}
|
|
# Certificate managed by acme.sh
|
|
{% if cert.email %} # ACME contact: {{ cert.email }}
|
|
{% endif %} ssl_certificate {{ acme_cert_dir }}/fullchain.cer;
|
|
ssl_certificate_key {{ acme_cert_dir }}/{{ domain }}.key;
|
|
|
|
{% elif cert.type == "file" %}
|
|
ssl_certificate {{ cert.path }};
|
|
ssl_certificate_key {{ cert.key_path }};
|
|
|
|
{% elif cert.type == "selfsigned" %}
|
|
ssl_certificate {{ certs_dir }}/{{ domain }}.crt;
|
|
ssl_certificate_key {{ certs_dir }}/{{ domain }}.key;
|
|
|
|
{% endif %}
|
|
{% elif is_management %}
|
|
ssl_certificate {{ acme_cert_dir }}/fullchain.cer;
|
|
ssl_certificate_key {{ acme_cert_dir }}/{{ domain }}.key;
|
|
|
|
{% endif %}
|
|
# Shared SSL settings
|
|
include snippets/vacuum-wall-ssl.conf;
|
|
|
|
{% if auth %}
|
|
# HTTP basic authentication
|
|
auth_basic "{{ "Vacuum Wall" if is_management else "Restricted" }}";
|
|
auth_basic_user_file {{ auth.htpasswd }};
|
|
|
|
{% endif %}
|
|
{% if not is_management %}
|
|
# Security hardening headers
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header X-Frame-Options DENY always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
{% endif %}
|
|
location / {
|
|
# Proxy headers
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
{% if not is_management %}
|
|
{% for hname, hval in headers.items() %}
|
|
proxy_set_header {{ hname }} {{ hval }};
|
|
{% endfor %}
|
|
{% endif %}
|
|
# Proxy pass to backend
|
|
proxy_pass {{ backend.proto }}://{{ backend.host }}:{{ backend.port }};
|
|
proxy_http_version 1.1;
|
|
|
|
# Timeouts
|
|
proxy_connect_timeout 30s;
|
|
proxy_send_timeout 60s;
|
|
proxy_read_timeout 60s;
|
|
proxy_buffering off;
|
|
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
{% if is_management %}
|
|
location /ws {
|
|
auth_basic off;
|
|
proxy_pass http://127.0.0.1:9091;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
}
|
|
{% endif %}
|
|
|
|
{% if not is_management %}
|
|
# Access / error logs
|
|
access_log /var/log/nginx/{{ domain }}_access.log;
|
|
error_log /var/log/nginx/{{ domain }}_error.log warn;
|
|
{% else %}
|
|
access_log /var/log/nginx/wall_mgmt_access.log;
|
|
error_log /var/log/nginx/wall_mgmt_error.log warn;
|
|
{% endif %}
|
|
}
|