From 5924764aead4f4c69449704ca725560d2d208051 Mon Sep 17 00:00:00 2001 From: Michael Winter Date: Tue, 23 Jul 2019 21:32:47 +0000 Subject: [PATCH] updating nginx settings --- README.md | 2 +- nginx/conf.d/default.conf | 227 +++++++++++++++++++++++++ nginx/conf.d/wildcard.conf | 7 + nginx/vhost.d/gitea.unboundedpress.org | 3 + 4 files changed, 238 insertions(+), 1 deletion(-) create mode 100644 nginx/conf.d/default.conf create mode 100644 nginx/conf.d/wildcard.conf create mode 100644 nginx/vhost.d/gitea.unboundedpress.org diff --git a/README.md b/README.md index 71a0227..aa29980 100644 --- a/README.md +++ b/README.md @@ -47,7 +47,7 @@ docker-compose exec --user www-data nextcloud php occ maintenance:repair # set ROOT_URL in gitea/gitea/app.ini and restart container ROOT_URL = https://gitea.unboundedpress.org # TODO: change gitea to reroute to /mwinter -# TODO: migrate repose from github +# migrate repose from github # UNBOUNDEDPRESS # example of restoring the mongodb diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf new file mode 100644 index 0000000..2c6308f --- /dev/null +++ b/nginx/conf.d/default.conf @@ -0,0 +1,227 @@ +# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the +# scheme used to connect to this server +map $http_x_forwarded_proto $proxy_x_forwarded_proto { + default $http_x_forwarded_proto; + '' $scheme; +} +# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the +# server port the client connected to +map $http_x_forwarded_port $proxy_x_forwarded_port { + default $http_x_forwarded_port; + '' $server_port; +} +# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any +# Connection header that may have been passed to this server +map $http_upgrade $proxy_connection { + default upgrade; + '' close; +} +# Apply fix for very long server names +server_names_hash_bucket_size 128; +# Default dhparam +ssl_dhparam /etc/nginx/dhparam/dhparam.pem; +# Set appropriate X-Forwarded-Ssl header +map $scheme $proxy_x_forwarded_ssl { + default off; + https on; +} +gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript; +log_format vhost '$host $remote_addr - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent"'; +access_log off; +resolver 127.0.0.11; +# HTTP 1.1 support +proxy_http_version 1.1; +proxy_buffering off; +proxy_set_header Host $http_host; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header Connection $proxy_connection; +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; +proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl; +proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port; +# Mitigate httpoxy attack (see README for details) +proxy_set_header Proxy ""; +server { + server_name _; # This is just an invalid value which will never trigger on a real hostname. + listen 80; + access_log /var/log/nginx/access.log vhost; + return 503; +} +server { + server_name _; # This is just an invalid value which will never trigger on a real hostname. + listen 443 ssl http2; + access_log /var/log/nginx/access.log vhost; + return 503; + ssl_session_tickets off; + ssl_certificate /etc/nginx/certs/default.crt; + ssl_certificate_key /etc/nginx/certs/default.key; +} +# gitea.unboundedpress.org +upstream gitea.unboundedpress.org { + ## Can be connected with "www_default" network + # gitea + server 172.18.0.7:4000; +} +server { + server_name gitea.unboundedpress.org; + listen 80 ; + access_log /var/log/nginx/access.log vhost; + return 301 https://$host$request_uri; +} +server { + server_name gitea.unboundedpress.org; + listen 443 ssl http2 ; + access_log /var/log/nginx/access.log vhost; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'; + ssl_prefer_server_ciphers on; + ssl_session_timeout 5m; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + ssl_certificate /etc/nginx/certs/gitea.unboundedpress.org.crt; + ssl_certificate_key /etc/nginx/certs/gitea.unboundedpress.org.key; + ssl_dhparam /etc/nginx/certs/gitea.unboundedpress.org.dhparam.pem; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/nginx/certs/gitea.unboundedpress.org.chain.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + include /etc/nginx/vhost.d/gitea.unboundedpress.org; + location / { + proxy_pass http://gitea.unboundedpress.org; + } +} +# nextcloud.unboundedpress.org +upstream nextcloud.unboundedpress.org { + ## Can be connected with "www_default" network + # nextcloud + server 172.18.0.9:80; +} +server { + server_name nextcloud.unboundedpress.org; + listen 80 ; + access_log /var/log/nginx/access.log vhost; + return 301 https://$host$request_uri; +} +server { + server_name nextcloud.unboundedpress.org; + listen 443 ssl http2 ; + access_log /var/log/nginx/access.log vhost; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'; + ssl_prefer_server_ciphers on; + ssl_session_timeout 5m; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + ssl_certificate /etc/nginx/certs/nextcloud.unboundedpress.org.crt; + ssl_certificate_key /etc/nginx/certs/nextcloud.unboundedpress.org.key; + ssl_dhparam /etc/nginx/certs/nextcloud.unboundedpress.org.dhparam.pem; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/nginx/certs/nextcloud.unboundedpress.org.chain.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + location / { + proxy_pass http://nextcloud.unboundedpress.org; + } +} +# restheart.unboundedpress.org +upstream restheart.unboundedpress.org { + ## Can be connected with "www_default" network + # restheart + server 172.18.0.11:8080; +} +server { + server_name restheart.unboundedpress.org; + listen 80 ; + access_log /var/log/nginx/access.log vhost; + return 301 https://$host$request_uri; +} +server { + server_name restheart.unboundedpress.org; + listen 443 ssl http2 ; + access_log /var/log/nginx/access.log vhost; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'; + ssl_prefer_server_ciphers on; + ssl_session_timeout 5m; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + ssl_certificate /etc/nginx/certs/restheart.unboundedpress.org.crt; + ssl_certificate_key /etc/nginx/certs/restheart.unboundedpress.org.key; + ssl_dhparam /etc/nginx/certs/restheart.unboundedpress.org.dhparam.pem; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/nginx/certs/restheart.unboundedpress.org.chain.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + location / { + proxy_pass http://restheart.unboundedpress.org; + } +} +# unboundedpress.org +upstream unboundedpress.org { + ## Can be connected with "www_default" network + # unboundedpress + server 172.18.0.6:3000; +} +server { + server_name unboundedpress.org; + listen 80 ; + access_log /var/log/nginx/access.log vhost; + return 301 https://$host$request_uri; +} +server { + server_name unboundedpress.org; + listen 443 ssl http2 ; + access_log /var/log/nginx/access.log vhost; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'; + ssl_prefer_server_ciphers on; + ssl_session_timeout 5m; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + ssl_certificate /etc/nginx/certs/unboundedpress.org.crt; + ssl_certificate_key /etc/nginx/certs/unboundedpress.org.key; + ssl_dhparam /etc/nginx/certs/unboundedpress.org.dhparam.pem; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/nginx/certs/unboundedpress.org.chain.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + location / { + proxy_pass http://unboundedpress.org; + } +} +# www.unboundedpress.org +upstream www.unboundedpress.org { + ## Can be connected with "www_default" network + # unboundedpress + server 172.18.0.6:3000; +} +server { + server_name www.unboundedpress.org; + listen 80 ; + access_log /var/log/nginx/access.log vhost; + return 301 https://$host$request_uri; +} +server { + server_name www.unboundedpress.org; + listen 443 ssl http2 ; + access_log /var/log/nginx/access.log vhost; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; + ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:!DSS'; + ssl_prefer_server_ciphers on; + ssl_session_timeout 5m; + ssl_session_cache shared:SSL:50m; + ssl_session_tickets off; + ssl_certificate /etc/nginx/certs/www.unboundedpress.org.crt; + ssl_certificate_key /etc/nginx/certs/www.unboundedpress.org.key; + ssl_dhparam /etc/nginx/certs/www.unboundedpress.org.dhparam.pem; + ssl_stapling on; + ssl_stapling_verify on; + ssl_trusted_certificate /etc/nginx/certs/www.unboundedpress.org.chain.pem; + add_header Strict-Transport-Security "max-age=31536000" always; + location / { + proxy_pass http://www.unboundedpress.org; + } +} diff --git a/nginx/conf.d/wildcard.conf b/nginx/conf.d/wildcard.conf new file mode 100644 index 0000000..444fee2 --- /dev/null +++ b/nginx/conf.d/wildcard.conf @@ -0,0 +1,7 @@ +server { + listen 80; + server_name *.unboundedpress.org; + + #Rewrite all nonssl requests to ssl. + return 301 https://unboundedpress.org$request_uri; +} diff --git a/nginx/vhost.d/gitea.unboundedpress.org b/nginx/vhost.d/gitea.unboundedpress.org new file mode 100644 index 0000000..782022c --- /dev/null +++ b/nginx/vhost.d/gitea.unboundedpress.org @@ -0,0 +1,3 @@ +location = / { + rewrite ^ http://gitea.unboundedpress.org/mwinter/ redirect; +}