Initial commit
This commit is contained in:
Waffles
@@ -0,0 +1,29 @@
|
||||
#Cloudflare
|
||||
|
||||
# - IPv4
|
||||
set_real_ip_from 173.245.48.0/20;
|
||||
set_real_ip_from 103.21.244.0/22;
|
||||
set_real_ip_from 103.22.200.0/22;
|
||||
set_real_ip_from 103.31.4.0/22;
|
||||
set_real_ip_from 141.101.64.0/18;
|
||||
set_real_ip_from 108.162.192.0/18;
|
||||
set_real_ip_from 190.93.240.0/20;
|
||||
set_real_ip_from 188.114.96.0/20;
|
||||
set_real_ip_from 197.234.240.0/22;
|
||||
set_real_ip_from 198.41.128.0/17;
|
||||
set_real_ip_from 162.158.0.0/15;
|
||||
set_real_ip_from 104.16.0.0/13;
|
||||
set_real_ip_from 104.24.0.0/14;
|
||||
set_real_ip_from 172.64.0.0/13;
|
||||
set_real_ip_from 131.0.72.0/22;
|
||||
|
||||
# - IPv6
|
||||
set_real_ip_from 2400:cb00::/32;
|
||||
set_real_ip_from 2606:4700::/32;
|
||||
set_real_ip_from 2803:f800::/32;
|
||||
set_real_ip_from 2405:b500::/32;
|
||||
set_real_ip_from 2405:8100::/32;
|
||||
set_real_ip_from 2a06:98c0::/29;
|
||||
set_real_ip_from 2c0f:f248::/32;
|
||||
|
||||
real_ip_header CF-Connecting-IP;
|
||||
@@ -0,0 +1,4 @@
|
||||
# Example
|
||||
#location = /cache/media_attachments/files/109/437/372/880/064/218/original/3260dbbf5bbdce0e.jpg {
|
||||
# deny all;
|
||||
#}
|
||||
@@ -0,0 +1,90 @@
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name {{ ENV_PRODUCTION['S3_ALIAS_HOST'] }};
|
||||
root /var/www/html;
|
||||
# Useful for Let's Encrypt
|
||||
location /.well-known/acme-challenge/ { allow all; }
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
}
|
||||
|
||||
log_format files_cache '$remote_addr - $upstream_cache_status [$time_local] '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent"';
|
||||
|
||||
proxy_cache_path /data/nginx/cache keys_zone=mycache:50m inactive=3d;
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name {{ ENV_PRODUCTION['S3_ALIAS_HOST'] }};
|
||||
root /var/www/html;
|
||||
|
||||
include /etc/nginx/cloudflare;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}/privkey.pem;
|
||||
|
||||
access_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.access.log files_cache;
|
||||
error_log /var/log/nginx/{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}.error.log;
|
||||
|
||||
proxy_cache mycache;
|
||||
keepalive_timeout 30;
|
||||
|
||||
# Don't allow directory listings
|
||||
location ~ ^.*/$ {
|
||||
deny all;
|
||||
}
|
||||
|
||||
include /etc/nginx/dmca;
|
||||
|
||||
location ~ .+ {
|
||||
try_files $uri @s3;
|
||||
}
|
||||
|
||||
set $s3_backend '{{ ENV_PRODUCTION['S3_HOSTNAME'] }}';
|
||||
|
||||
location @s3 {
|
||||
limit_except GET {
|
||||
deny all;
|
||||
}
|
||||
|
||||
resolver 8.8.8.8;
|
||||
proxy_set_header Host yttrx.sfo3.digitaloceanspaces.com;
|
||||
proxy_set_header Connection '';
|
||||
proxy_set_header Authorization '';
|
||||
proxy_hide_header Set-Cookie;
|
||||
proxy_hide_header 'Access-Control-Allow-Origin';
|
||||
proxy_hide_header 'Access-Control-Allow-Methods';
|
||||
proxy_hide_header 'Access-Control-Allow-Headers';
|
||||
#proxy_hide_header x-amz-id-2;
|
||||
#proxy_hide_header x-amz-request-id;
|
||||
#proxy_hide_header x-amz-meta-server-side-encryption;
|
||||
#proxy_hide_header x-amz-server-side-encryption;
|
||||
#proxy_hide_header x-amz-bucket-region;
|
||||
#proxy_hide_header x-amzn-requestid;
|
||||
proxy_ignore_headers Set-Cookie;
|
||||
proxy_pass $s3_backend$uri;
|
||||
#proxy_intercept_errors off;
|
||||
# turn this on so that we can capture and redirect bad links to the main 404 page
|
||||
proxy_intercept_errors on;
|
||||
|
||||
#proxy_cache_valid 200 48h;
|
||||
proxy_cache_valid 48h;
|
||||
proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
|
||||
proxy_cache_lock on;
|
||||
proxy_cache_key $uri;
|
||||
|
||||
# Download stale data only if it has been modified on origin
|
||||
proxy_cache_revalidate off;
|
||||
|
||||
expires 30d;
|
||||
add_header Pragma public;
|
||||
add_header Cache-Control "public";
|
||||
add_header 'Access-Control-Allow-Origin' '*';
|
||||
add_header X-Cache-Status $upstream_cache_status;
|
||||
|
||||
error_page 403 https://{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/404.html;
|
||||
error_page 404 https://{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/404.html;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,117 @@
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name {{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}
|
||||
root /home/mastodon/live/public;
|
||||
# Useful for Let's Encrypt
|
||||
location /.well-known/acme-challenge/ { allow all; }
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
}
|
||||
|
||||
upstream webbackend {
|
||||
{% for server in webapp_hosts %}
|
||||
server {{ server }}:3000;
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
upstream streamingbackend {
|
||||
{% for server in webapp_hosts %}
|
||||
server {{ server }}:4000;
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name {{ ENV_PRODUCTION['LOCAL_DOMAIN'] }};
|
||||
|
||||
include /etc/nginx/cloudflare;
|
||||
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers HIGH:!MEDIUM:!LOW:!aNULL:!NULL:!SHA; ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:10m;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/{{ ENV_PRODUCTION['LOCAL_DOMAIN'] }}/privkey.pem;
|
||||
|
||||
keepalive_timeout 70;
|
||||
sendfile on;
|
||||
client_max_body_size 80m;
|
||||
|
||||
root /home/mastodon/live/public;
|
||||
|
||||
gzip on;
|
||||
gzip_disable "msie6";
|
||||
gzip_vary on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 6;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_http_version 1.1;
|
||||
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000";
|
||||
|
||||
location / {
|
||||
try_files $uri @proxy;
|
||||
}
|
||||
|
||||
# WITH S3
|
||||
location ~ ^/(emoji|packs) {
|
||||
add_header Cache-Control "public, max-age=31536000, immutable";
|
||||
try_files $uri @proxy;
|
||||
}
|
||||
|
||||
location /system {
|
||||
rewrite ^/system(.*) https://{{ ENV_PRODUCTION['S3_ALIAS_HOST'] }}$1 permanent;
|
||||
}
|
||||
# END OF S3
|
||||
location /sw.js {
|
||||
#add_header Cache-Control "public, max-age=0";
|
||||
add_header Cache-Control "public, max-age=604800, must-revalidate";
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
|
||||
try_files $uri @proxy;
|
||||
}
|
||||
|
||||
location @proxy {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header Proxy "";
|
||||
proxy_pass_header Server;
|
||||
|
||||
|
||||
proxy_pass http://webbackend;
|
||||
proxy_buffering off;
|
||||
proxy_redirect off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
|
||||
tcp_nodelay on;
|
||||
}
|
||||
|
||||
location /api/v1/streaming {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header Proxy "";
|
||||
|
||||
proxy_pass http://streamingbackend;
|
||||
proxy_buffering off;
|
||||
proxy_redirect off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
|
||||
tcp_nodelay on;
|
||||
}
|
||||
|
||||
error_page 500 501 502 503 504 /500.html;
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
server {
|
||||
listen 81 default_server;
|
||||
listen [::]:81 default_server;
|
||||
|
||||
root /var/www/html;
|
||||
index index.html index.htm index.nginx-debian.html;
|
||||
|
||||
server_name _;
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location /nginx_status {
|
||||
stub_status;
|
||||
#allow 127.0.0.1;
|
||||
#deny all;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
##
|
||||
# You should look at the following URL's in order to grasp a solid understanding
|
||||
# of Nginx configuration files in order to fully unleash the power of Nginx.
|
||||
# https://www.nginx.com/resources/wiki/start/
|
||||
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
|
||||
# https://wiki.debian.org/Nginx/DirectoryStructure
|
||||
#
|
||||
# In most cases, administrators will remove this file from sites-enabled/ and
|
||||
# leave it as reference inside of sites-available where it will continue to be
|
||||
# updated by the nginx packaging team.
|
||||
#
|
||||
# This file will automatically load configuration files provided by other
|
||||
# applications, such as Drupal or Wordpress. These applications will be made
|
||||
# available underneath a path with that package name, such as /drupal8.
|
||||
#
|
||||
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
|
||||
##
|
||||
|
||||
# Default server configuration
|
||||
#
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name tusky.yttrx.com;
|
||||
root /var/www/html/tusky;
|
||||
# Useful for Let's Encrypt
|
||||
location /.well-known/acme-challenge/ { allow all; }
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name tusky.yttrx.com;
|
||||
root /var/www/html/tusky;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/tusky.yttrx.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/tusky.yttrx.com/privkey.pem;
|
||||
access_log /var/log/nginx/tusky.access.log;
|
||||
error_log /var/log/nginx/static.error.log;
|
||||
|
||||
|
||||
location / {
|
||||
# First attempt to serve request as file, then
|
||||
# as directory, then fall back to displaying a 404.
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
location /statsd {
|
||||
try_files $uri @proxy;
|
||||
}
|
||||
|
||||
location /metrics {
|
||||
try_files $uri @proxy;
|
||||
}
|
||||
|
||||
location @proxy {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header Proxy "";
|
||||
|
||||
proxy_pass http://127.0.0.1:9102;
|
||||
proxy_buffering off;
|
||||
proxy_redirect off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
|
||||
tcp_nodelay on;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
##
|
||||
# You should look at the following URL's in order to grasp a solid understanding
|
||||
# of Nginx configuration files in order to fully unleash the power of Nginx.
|
||||
# https://www.nginx.com/resources/wiki/start/
|
||||
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
|
||||
# https://wiki.debian.org/Nginx/DirectoryStructure
|
||||
#
|
||||
# In most cases, administrators will remove this file from sites-enabled/ and
|
||||
# leave it as reference inside of sites-available where it will continue to be
|
||||
# updated by the nginx packaging team.
|
||||
#
|
||||
# This file will automatically load configuration files provided by other
|
||||
# applications, such as Drupal or Wordpress. These applications will be made
|
||||
# available underneath a path with that package name, such as /drupal8.
|
||||
#
|
||||
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
|
||||
##
|
||||
|
||||
# Default server configuration
|
||||
#
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name waffles.yttrx.com;
|
||||
root /var/www/html/waffles;
|
||||
# Useful for Let's Encrypt
|
||||
location /.well-known/acme-challenge/ { allow all; }
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name waffles.yttrx.com;
|
||||
root /var/www/html/waffles;
|
||||
|
||||
include /etc/nginx/cloudflare;
|
||||
ssl_certificate /etc/letsencrypt/live/waffles.yttrx.com/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/waffles.yttrx.com/privkey.pem; # managed by Certbot
|
||||
access_log /var/log/nginx/waffles.access.log;
|
||||
error_log /var/log/nginx/waffles.error.log;
|
||||
|
||||
location = /.well-known/webfinger {
|
||||
types {} default_type "application/jrd+json";
|
||||
add_header Access-Control-Allow-Origin "*";
|
||||
}
|
||||
|
||||
location / {
|
||||
# First attempt to serve request as file, then
|
||||
# as directory, then fall back to displaying a 404.
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user