Can you help me simplify and standardize my nginx config as much as possible? I want to categorize each site type for easy templates (ie: reverse proxy, static, PHP, etc.) Don't change the gitlab portions, but clean them up, organize, and preferably isolate them seperate from all my custom sites because gitlab is so unique and finicky. Revise strange configuration differences between sites of the same type - removing options you deem unneeded / not useful, bad practice, set by default already, etc. - adding options that 2025 best practices or industry standards would recommend You can safely make settings like the php timeouts, upload maximums, etc. all the same across sites - all sites are proxied by cloudflare so max individual chunk size is 100MB - timeouts and other settings should follow middle-of-the-road approach balancing performance and user experience. I can always tweak them later or override values if a specific site needs it All PHP sites that currently use php8.3-fpm.sock should be changed to use 'www.sock' instead. - I am phasing out use of the default PHP pool. My 4 core sites will be given semi-dedicated pools: theyellowsub.org = tys.sock desk.maxc.us, wiki.maxc.us = max.sock file.tyss.io = file.sock All other PHP sites should just use `unix:/run/php/www.sock` Lan Access Only Sites are sites that I have issued a custom cert for - all should be just a single name, no TLD - All These sites should allow the following subnets/ips only: ``` allow 10.0.0.0/24; allow 10.0.1.0/24; allow 192.168.2.2/32; deny all; ``` --- SSL / Cert notes: Locations: - All public facing websites have certs issued using acme.sh + letsencrypt using Cloudflare API for DNS. These certs are always stored at : `/etc/letsencrypt/live//` + `fullchain.pem` or `privkey.pem` ! There should be NO wildcard certs. Each subdomain should have its own cert. Correct any instances of this (likely shows up in config as something like _.domain.com or *.domain.com or a subdomain site using the base domain cert) - Private sites (LAN access only) certs are stored at `/etc/ssl/ca//` + `fullchain.pem` or `privkey.pem` * /etc/ssl/tys.crt contains ONLY my custom CA certs - no cloudflare certs. - the complete CA chain cert is at `/etc/nginx/ssl/bundle.crt` previously: `/etc/nginx/inc/bundle.crt` (change this in all configs). It includes 5 CA certs: all my custom CAs in the chain (3 total: root, sub, and sub sub) PLUS the 2 cloudflare Origin CA certs (one is ECC, one is RSA - I have needed both in the past due to compat issues, but I primarily only ever need the ECC / default one) * There is a 3rd site cert type that I sometimes use : cloudflare origin ca. I use this primarily when I am first testing a site and have not decided on what subdomains I want to use, so I will issue a cloudflare wildcard cert for an entire domain and just use that. These are always located at `/etc/ssl/cf//` + `fullchain.pem` and `privkey.pem`. --- ! I wound up reorganizing cert files in the nginx folder: - all CA certs/chains/bundles/etc. are now in `/etc/nginx/ssl/` - I copied /etc/ssl/tys.crt to `/etc/nginx/ssl/tys.crt` There are a total of 4 CA certs in the folder: tys.crt - my custom ca chain (3) bundle.crt - all 5 (3 custom in chain + 2 unique cloudflare) (symlink of /etc/ssl/bundle.crt) ecc_origin.crt - ecc origin cert (symlink of /etc/ssl/cf/origin_ca_ecc_root.pem) rsa_origin.crt - rsa origin cert (symlink of /etc/ssl/cf/origin_ca_rsa_root.pem) origin.crt - symlinked ecc cert for simplicity (! this should be the primary trusted cert for all public sites) I want my nginx folder to be very nice and organized, clean of bloat and all names as short as possible while still making sense. Please recommend any updates to my file tree, file / config / variable / etc. names, and make the new config(s) accordingly. ! i prefer short and sweet names, category names (ie '_csp' in dev_csp.conf) should always come AFTER the unique name so that I can quickly type something like 'dev' and press tab to autocomplete * notes: sites-available is a pile of legacy configs I don't want to delete so it is omitted from tree, Same goes for naming and organization schemas within nginx config as well. --- I have cloudflare authenticated origin pulls (mTLS) enabled on all sites. I would like a global toggle to have nginx verify this (easily disabled when I want - I do not want to be dependant on cloudflare). If that is not really best practice, stick to the cloudflare ip allow / deny config only. --- Log Notes: Locations & Naming: - store in /var/log/nginx/-` + access.log or error.log ! I have a lot of sites and it causes a VERY cluttered nginx log folder. Do you recommend a different structure for the log files? Only change the folder layout if you really think it will be beneficial in the long run, because I will have a lot of scripts, functions, aliases, habits, etc. to update if we change it. - fix my logging templates and log types Maybe 1 for each site type? or whatever you think the best option is? - I want them to be very detailed, easy for ME to read (whether thats directly or with a tool i dont care), and entries well organized ! The most important items to me are: the remote ip (not the cf ip), the page accessed, and the user agent. Other things are important too, but those 3 are most useful for both fixing issues and for identifying bot / bad actor traffic - I am not sure that log files are rolling properly, the seem to be getting massive and not becoming .1, .2, etc. soon enough. (If this is an nginx issue, fix it - if not, just say it is syslog/whatever and i will fix it myself) Log Format Options?: - all log types should be the same format, whichever we decide on Regular but custom format? (like my log_format main one with custom symbols for me to easily glance and grab the info I need) Json? Something else entirely? ?! Can nginx log to mysql (mariadb)? If so, I want to do that instead - SO LONG AS it is very easy to quickly read the logs and something is set up to warn me (motd type message) if log files are A. growing faster than normal or B. total size of old logs is getting too big. * If json logs are preferred: I will want to create sh command aliases / functions (at a later time, just make a short note about how to best do this) It will nicely format and print out the log file (last 10? entries by default unless a number is passed to command, then do that many). `logwww [type] [lines] name: type: e or error | a or access lines/entries: # of log entries to go back Example: `logwww theyellowsub.org e 15` -> reads the error log for the site (e, a for access, e by default if not set) and formats the most recent 15 lines and prints them to console nicely formatted, easy to read, and easy to copy/paste default is error log, last 10 entries (lines?) (or less if you think that will print too much * I would like a minimum unique chars required approach to the log / domain names. As in: 'logwww they' would reference theyellowub.org - if there is an app / cli tool that already exists to do this (jq, but with pretty displays) then use it. Otherwise just make something Some commands like this would be immensely useful no matter what format we go with - make notes accordingly, but hold off on making anything (we have a lot to do already) --- Content Security Policies (CSP) - The existing ones are broken, not secure, oversecure, or outdated. - many are commented out just to disable them because they fail to work right after hours and hours of work None of My sites are sensitive per-say (no transactions or personal data ever), but the server does store a lot of important files and exposes several different endpoints to directly manipulate said files. So, preventing malicious or damaging code injections is certainly a priority, but with the extreme diversity of my sites each one will need individual and meticulous custom CSP tailoring in order to only allow the needed styles and scripts and nothing else. Propose a few options and implement a simple skeleton / scaffold config template(s) that can be further refined later. How do small enterprise businesses handle this? (BIG business can just throw time and money at it, but I don't have a lot of either). Because the CSPs i have had to create to truly and completely harden just 1 of my more simple sites was an absolute behemoth monstrosity of values and urls. It just is not maintainable - there has to be a better way right? --- Unorganized additional notes: - cloudflare redirects www.domain_name.tld to domain_name.tld for all websites - no need to handle www. - cf also redirects all http to https - no need to handle this for public sites (I don't know if it needs to be handled for lan sites, maybe just a final catch all in default.conf that tries ssl? but idk what performance hit is on that - all reqs for a bad name will be processed twice?). See next note: - ALL client reqs for a site not explicitly configured should return absolute garbage. I am talking end the bot/scammer/hacker/whatever's whole career with a whole mess of redirects, bad data, loads, whatever you can think of to just mess with a hacker. i get WAY too much malicious traffic for my liking and want to fight back a little. Prepare a simple scaffold for something that may deter future re-attempts at connecting to my server with bad intentions. connecting by direct public ip (v4 and v6) should absolutely fall into this same category and be treated with the same retaliation. My LAN and WAN ip's in the ip allow list should be exempt from this - just return a 404/500/whatever is relevant, maybe show a basic page with useful info to help me fix the issue (only reason i would see this ever. It is safe to show semi-sensitive data here since we can most likely trust the client) - There is 1 proxy site that has an upstream that uses SSL. The cert is issued by my custom CA. It is the only site like this and honestly does not have to be (the backend is a QNAP nas device on the same LAN network). Making a template for SSL Proxy seems silly, but I also do not like that 1 site is different than all the others (as in no template). Choose whatever option you think best, I can always just disable ssl on the QNAP and call it a day. --- There is a lot that I have probably overlooked and failed to comment on. Let's discuss the best next steps - inquire regarding anything in the config containing inconsistencies or quirks (some may have a purpose, most are probably just copypasta). Walk me through your intended adjustments to the final configuration templates and highlight your recommendations as well as best practices. We will have a back and forth discussion in order to polish up and fine tune anything and everything within the configuration. --- Current nginx -T output (with redactions and removals for brevity): ``` # configuration file /etc/nginx/nginx.conf: user www-data; pid /run/nginx.pid; worker_processes auto; worker_cpu_affinity auto; worker_shutdown_timeout 5s; include /etc/nginx/modules-enabled/*.conf; events { worker_connections 1024; multi_accept on; use epoll; } http { ## # Logging Settings ## log_format main [$time_local][WWW]: '$remote_addr ($http_cf_connecting_ip::$http_cf_country+$http_cf_ipcity) = $http_user_agent' '\n' ' $ssl_server_name @ $http_referer - $request ? $status ' '*:$remote_user !:$http_exposed_credential_check' %:${body_bytes_sent}B :=: \n'; #'$request_body'; # Single line, human-friendly log_format static 'ts=$time_iso8601 cfray=$http_cf_ray ip=$remote_addr cfip=$http_cf_connecting_ip ' 'cc=$http_cf_country host=$host sni=$ssl_server_name scheme=$scheme ' '"$request" status=$status bytes=$bytes_sent body=$body_bytes_sent req_len=$request_length ' 'rt=$request_time ua="$http_user_agent" ref="$http_referer" ' 'tls=$ssl_protocol/$ssl_cipher reused=$ssl_session_reused'; log_format proxy [$time_local][PROXY] "'CF> $http_cf_connecting_ip $remote_addr ~ $http_cf_ipcountry'" '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" ' 'rt=$request_time uct="$upstream_connect_time" ' 'uht="$upstream_header_time" urt="$upstream_response_time"'; log_format json escape=json '{' '"ts":"$time_iso8601",' '"cfray":"$http_cf_ray","ip":"$remote_addr","cfip":"$http_cf_connecting_ip","cc":"$http_cf_country",' '"host":"$host","sni":"$ssl_server_name","scheme":"$scheme",' '"method":"$request_method","uri":"$request_uri","args":"$args","proto":"$server_protocol",' '"status":$status,"bytes":$bytes_sent,"body":$body_bytes_sent,"req_len":$request_length,' '"rt":$request_time,"urt":"$upstream_response_time","uht":"$upstream_header_time",' '"upstream":"$upstream_addr","ustatus":"$upstream_status","script":"$fastcgi_script_name",' '"ua":"$http_user_agent","ref":"$http_referer",' '"tls_proto":"$ssl_protocol","tls_cipher":"$ssl_cipher","tls_reused":"$ssl_session_reused"' '}'; access_log /var/log/nginx/access.log main; error_log /var/log/nginx/error.log; # Gitlab log_format gitlab_access '$remote_addr - $remote_user [$time_local] "$request_method $filtered_request_uri $server_protocol" $status $body_bytes_sent "$filtered_http_referer" "$http_user_agent" $gzip_ratio'; log_format gitlab_mattermost_access '$remote_addr - $remote_user [$time_local] "$request_method $filtered_request_uri $server_protocol" $status $body_bytes_sent "$filtered_http_referer" "$http_user_agent" $gzip_ratio'; proxy_cache_path proxy_cache keys_zone=gitlab:10m max_size=1g levels=1:2; proxy_cache gitlab; map $http_upgrade $connection_upgrade { default upgrade; '' close; } # Remove private_token from the request URI # In: /foo?private_token=unfiltered&authenticity_token=unfiltered&rss_token=unfiltered&token=glptt-unfiltered&... # Out: /foo?private_token=[FILTERED]&authenticity_token=unfiltered&rss_token=unfiltered&token=glptt-unfiltered... map $request_uri $temp_request_uri_1 { default $request_uri; ~(?i)^(?.*)(?[\?&]private[\-_]token)=[^&]*(?.*)$ "$start$temp=[FILTERED]$rest"; } # Remove authenticity_token from the request URI # In: /foo?private_token=[FILTERED]&authenticity_token=unfiltered&rss_token=unfiltered&token=glptt-unfiltered&.. # Out: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=unfiltered&token=glptt-unfiltered&.. map $temp_request_uri_1 $temp_request_uri_2 { default $temp_request_uri_1; ~(?i)^(?.*)(?[\?&]authenticity[\-_]token)=[^&]*(?.*)$ "$start$temp=[FILTERED]$rest"; } # Remove rss_token from the request URI # In: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=unfiltered&token=glptt-unfiltered&... # Out: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=[FILTERED]&token=glptt-unfiltered&... map $temp_request_uri_2 $temp_request_uri_3 { default $temp_request_uri_2; ~(?i)^(?.*)(?[\?&]rss[\-_]token)=[^&]*(?.*)$ "$start$temp=[FILTERED]$rest"; } # Remove pipeline trigger token from the request URI # In: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=[FILTERED]&token=glptt-unfiltered&... # Out: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=[FILTERED]&token=[FILTERED]&... map $temp_request_uri_3 $filtered_request_uri { default $temp_request_uri_3; ~(?i)^(?.*)(?[\?&]token)=glptt-[^&]*(?.*)$ "$start$temp=[FILTERED]$rest"; } # A version of the referer without the query string map $http_referer $filtered_http_referer { default $http_referer; ~^(?.*)\? $temp; } # Enable vts status module. # vhost_traffic_status_zone; upstream gitlab-workhorse { server unix:/var/opt/gitlab/gitlab-workhorse/sockets/socket; } # END GITLAB ## # Basic Settings ## # CF <-> Origin Keepalive keepalive_timeout 60s; autoindex off; sendfile on; sendfile_max_chunk 100m; tcp_nopush on; #tcp_nodelay on; types_hash_max_size 4096; server_tokens off; client_max_body_size 0; include /etc/nginx/mime.types; default_type application/octet-stream; ## # SSL Settings ## include inc/ssl.conf; ## # Gzip Settings ## include inc/gzip.conf; ## # Cloudflare Proxy IP List ## include inc/cloudflare.conf; real_ip_header CF-Connecting-IP; real_ip_recursive on; #include inc/ip.conf; ## # Include Site Configs ## include /etc/nginx/conf.d/*.conf; # include /etc/nginx/conf.d/desk.maxc.us.conf; # include /etc/nginx/conf.d/*/*.conf; # include /etc/nginx/conf.d/*/*/*.conf; # include /etc/nginx/sites-enabled/*.conf; # include /etc/nginx/sites-enabled/*/*.conf; # include /etc/nginx/sites-enabled/*/*/*.conf; ## # Default Site ## include inc/default.conf; } # configuration file /etc/nginx/mime.types: REDACTED (DEFAULT) # configuration file /etc/nginx/inc/ssl.conf: ssl_session_cache shared:SSL:50m; ssl_session_timeout 1d; ssl_session_tickets on; ssl_prefer_server_ciphers off; ssl_protocols TLSv1.3 TLSv1.2; ssl_ecdh_curve X25519:prime256v1:secp384r1; #ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'; #ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384'; #ssl_ciphers 'EECDH+AESGCM,EDH+AESGCM'; ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384'; # OCSP resolver 1.1.1.1 8.8.8.8; ssl_trusted_certificate ssl/origin.crt; ssl_client_certificate ssl/bundle.crt; #ssl_stapling on; #ssl_stapling_verify on; # Client mTLS #ssl_verify_client on; #ssl_verify_depth 1; # configuration file /etc/nginx/inc/gzip.conf: gzip on; gzip_vary on; gzip_proxied no-cache no-store private expired auth; gzip_comp_level 5; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_min_length 1024; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml application/font-woff2 image/webp image/x-icon; gunzip on; # configuration file /etc/nginx/inc/cloudflare.conf: # /etc/nginx/inc/cloudflare.conf # Generated: Sun Sep 28 00:12:49 PDT 2025 # Source: https://www.cloudflare.com/ips # CF IPv4 set_real_ip_from 173.245.48.0/20; set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 108.162.192.0/18; set_real_ip_from 190.93.240.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; set_real_ip_from 162.158.0.0/15; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 172.64.0.0/13; set_real_ip_from 131.0.72.0/22; # CF IPv6 set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32; # configuration file /etc/nginx/conf.d/1tile.app.conf: # Immich App on ACACIAPC server { server_name 1tile.app; access_log /var/log/nginx/cmd.app-access.log proxy; error_log /var/log/nginx/cmd.app-error.log error; ssl_certificate /etc/letsencrypt/live/1tile.app/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/1tile.app/privkey.pem; include inc/global.conf; client_max_body_size 0; location / { proxy_read_timeout 3600; proxy_connect_timeout 3600; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Accept-Encoding ""; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://localhost:6001; } } # configuration file /etc/nginx/inc/global.conf: listen 443 ssl; listen [::]:443 ssl; http2 on; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block"; add_header Referrer-Policy "strict-origin-when-cross-origin" always; #add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always; ssl_session_cache shared:SSL:50m; ssl_session_timeout 1d; #ssl_session_tickets off; #location ~ /\.(?!well-known(?:/|$)) { # deny all; ### access_log off; ### log_not_found off; # return 401; # #https://$server_name; #} # configuration file /etc/nginx/conf.d/admin.tyss.io.conf: server { server_name admin.tyss.io; root /var/www/tystfm; index index.php; access_log /var/log/nginx/admin.tyss.io-access.log main; error_log /var/log/nginx/admin.tyss.io-error.log error; ssl_certificate /etc/letsencrypt/live/admin.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/admin.tyss.io/privkey.pem; include inc/global.conf; location / { try_files $uri $uri/ /index.php?$query_string; } location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/run/php/www.sock; fastcgi_index index.php; include inc/fastcgi.conf; include inc/php.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } # configuration file /etc/nginx/inc/fastcgi.conf: REDACTED (DEFAULT) # configuration file /etc/nginx/inc/php.conf: fastcgi_intercept_errors off; fastcgi_buffer_size 16k; fastcgi_buffers 4 16k; fastcgi_connect_timeout 15; fastcgi_send_timeout 60; fastcgi_read_timeout 60; # configuration file /etc/nginx/conf.d/adminer.conf: server { server_name adminer; root /var/www/adminer; index index.php; access_log /var/log/nginx/adminer-access.log main; error_log /var/log/nginx/adminer-error.log error; ssl_certificate /etc/ssl/ca/adminer/fullchain.pem; ssl_certificate_key /etc/ssl/ca/adminer/privkey.pem; location / { try_files $uri $uri/ /index.php?$query_string; allow 10.0.0.0/24; allow 10.0.1.0/24; allow 192.168.2.0/24; deny all; } include inc/global.conf; include inc/dev_csp.conf; ssl_stapling off; location = /favicon.ico { access_log off; log_not_found off; } location = /robots.txt { access_log off; log_not_found off; } location ~ \.php$ { internal; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/run/php/www.sock; fastcgi_index index.php; include inc/fastcgi.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } # configuration file /etc/nginx/inc/dev_csp.conf: add_header Content-Security-Policy "sandbox allow-scripts; default-src 'self' * data: blob:; script-src 'self' * blob: 'unsafe-inline' 'unsafe-eval'; style-src 'self' * 'unsafe-inline'; img-src 'self' * data: blob:; font-src 'self' * data:; object-src 'none'; frame-ancestors 'self' *; connect-src 'self' *;" always; add_header 'Access-Control-Allow-Origin' '*' always; add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; #add_header 'Access-Control-Allow-Headers' '*' always; # configuration file /etc/nginx/conf.d/ads.tyss.io.conf: map $host $backend { cjs1.tyss.io http://10.0.0.5:8080; ext1.tyss.io http://10.0.0.6:8080; ext2.tyss.io http://10.0.0.7:8080; ext3.tyss.io http://10.0.0.8:8080; net1.tyss.io http://10.0.0.9:8090; } server { server_name cjs1.tyss.io ext1.tyss.io ext2.tyss.io net1.tyss.io; access_log /var/log/nginx/amp/ads-access.log proxy; error_log /var/log/nginx/amp/ads-error.log warn; ssl_certificate /etc/letsencrypt/live/_tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/_tyss.io/privkey.pem; include inc/global.conf; include inc/cdn_csp.conf; location / { proxy_pass $backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header X-AMP-Scheme $scheme; proxy_read_timeout 86400s; proxy_send_timeout 86400s; proxy_http_version 1.1; proxy_redirect off; proxy_buffering off; client_max_body_size 10240M; } } # configuration file /etc/nginx/inc/cdn_csp.conf: #add_header Content-Security-Policy "default-src 'self' https://tyss.io https://*.tyss.io https://tyss.dev https://*.tyss.dev; connect-src 'self' https://www.google.com; frame-src 'self' https://www.google.com; script-src 'self' https://tyss.io https://*.tyss.io https://tyss.dev https://*.tyss.dev https://cdn.jsdelivr.net https://fonts.googleapis.com https://cdnjs.cloudflare.com https://www.google.com/recaptcha https://www.google.com; style-src 'self' https://tyss.io https://*.tyss.io https://tyss.dev https://*.tyss.dev https://cdn.jsdelivr.net https://fonts.googleapis.com https://cdnjs.cloudflare.com 'unsafe-inline'; img-src 'self' data: https://tyss.io https://*.tyss.io https://tyss.dev https://*.tyss.dev *; font-src 'self' https://tyss.io https://*.tyss.io https://tyss.dev https://*.tyss.dev https://fonts.gstatic.com; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always; #add_header Content-Security-Policy "default-src 'self' https://tyss.io https://*.tyss.io https://tyss.dev https://*.tyss.dev;"; # TYS Sources #add_header Content-Security-Policy "default-src 'self' https://*.tyss.io https://*.tyss.dev; script-src 'self' https://*.tyss.io https://*.tyss.dev https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://www.google.com/recaptcha https://www.google.com; script-src-elem 'self' https://*.tyss.io https://*.tyss.dev https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://www.google.com/recaptcha https://www.gstatic.com/recaptcha/releases/ https://www.google.com; style-src 'self' https://*.tyss.io https://*.tyss.dev https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://fonts.googleapis.com/css https://www.google.com/recaptcha; style-src-elem 'self' https://*.tyss.io https://*.tyss.dev https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://fonts.googleapis.com/css https://www.google.com/recaptcha; font-src 'self' data: https://*.tyss.io https://*.tyss.dev https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://*.tyss.io https://*.tyss.dev; media-src 'self' data: https://*.tyss.io https://*.tyss.dev; object-src 'none'; base-uri 'self'; form-action 'self'; connect-src 'self' https://www.google.com; frame-ancestors 'self' https://www.google.com; frame-src 'self' https://www.google.com;" always; # configuration file /etc/nginx/conf.d/amp.tyss.io.conf: #Generated by CubeCoders AMP for ADS server { server_name amp.tyss.io; ssl_certificate /etc/letsencrypt/live/amp.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/amp.tyss.io/privkey.pem; access_log /var/log/nginx/amp/amp-access.log proxy; error_log /var/log/nginx/amp/amp-error.log error; include inc/global.conf; # include inc/cdn_csp.conf; location = /robots.txt { return 200 "User-agent: *\\nAllow /"; } location / { proxy_pass http://10.0.0.36:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_set_header X-AMP-Scheme $scheme; proxy_read_timeout 86400s; proxy_send_timeout 86400s; proxy_http_version 1.1; proxy_redirect off; proxy_buffering off; client_max_body_size 10240M; error_page 502 503 504 /NotRunning.html; location = /NotRunning.html { root /opt/cubecoders/amp/shared/WebRoot; internal; } location /shared/ { alias /opt/cubecoders/amp/shared/WebRoot/; } } } # configuration file /etc/nginx/conf.d/artist.tyss.dev.conf: upstream parallax { server 127.0.0.1:5183; keepalive 64; } # HTTPS vhost server { server_name artist.tyss.dev; access_log /var/log/nginx/artist.tyss.dev-access.log; error_log /var/log/nginx/artist.tyss.dev-error.log warn; ssl_certificate /etc/letsencrypt/live/artist.tyss.dev/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/artist.tyss.dev/privkey.pem; include inc/global.conf; # client_max_body_size 100m; #chunked_transfer_encoding on; # location ~ ^/(data)/ { # autoindex on; # autoindex_exact_size on; # autoindex_format html; # autoindex_localtime on; # } location ^~ /node_modules/.vite/ { auth_basic off; # auth_request off; # if you use auth_request proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Ssl on; proxy_set_header Authorization $http_authorization; proxy_buffering off; proxy_pass http://parallax; } location / { proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Ssl on; proxy_connect_timeout 60s; proxy_read_timeout 300s; proxy_send_timeout 300s; # proxy_request_buffering off; proxy_buffering off; proxy_pass http://parallax; } } # configuration file /etc/nginx/conf.d/cj36.org.conf: # Trilium Docker Container server { server_name cj36.org; access_log /var/log/nginx/cj36.org-access.log proxy; error_log /var/log/nginx/cj36.org-error.log error; ssl_certificate /etc/letsencrypt/live/cj36.org/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/cj36.org/privkey.pem; include inc/global.conf; client_max_body_size 0; # Fix accidental /login/* asset paths location ^~ /login/assets/ { proxy_set_header Host $host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_pass http://localhost:7070/assets/; } location ^~ /login/static/ { proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $host; proxy_pass http://localhost:7070/static/; } # Optional: favicon requested under /login/ location = /login/favicon.ico { proxy_pass http://localhost:7070/favicon.ico; } location / { proxy_read_timeout 3600; proxy_connect_timeout 3600; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Accept-Encoding ""; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://localhost:7070; } } # configuration file /etc/nginx/conf.d/desk.maxc.us.conf: server { server_name desk.maxc.us; root /var/www/maxdesk; index index.php; access_log /var/log/nginx/desk.maxc.us.app-access.log; error_log /var/log/nginx/desk.maxc.us.app-error.log error; ssl_certificate /etc/letsencrypt/live/maxc.us/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/maxc.us/privkey.pem; include inc/global.conf; include inc/hesk_csp.conf; # include inc/turnstile.conf; location / { try_files $uri $uri/ $uri.php$is_args$args; #$query_string; autoindex off; } location ~ \.php$ { #internal; try_files $uri $uri/ =404; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/run/php/www.sock; fastcgi_index index.php; include inc/fastcgi.conf; include inc/php.conf; #include inc/turnstile.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } # configuration file /etc/nginx/inc/hesk_csp.conf: add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com; script-src-elem 'self' 'unsafe-inline' https://challenges.cloudflare.com; script-src-attr 'unsafe-inline'; connect-src 'self' https://challenges.cloudflare.com; img-src 'self' data: blob: https://lirp.cdn-website.com; style-src 'self' 'unsafe-inline'; font-src 'self' data:; frame-src 'self' https://challenges.cloudflare.com; child-src 'self' https://challenges.cloudflare.com; worker-src 'self' blob:; media-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'" always; # configuration file /etc/nginx/conf.d/file.tyss.io.conf: server { server_name file.tyss.io; root /var/www/file/dist; index index.php; access_log /var/log/nginx/file.tyss.io-access.log main; error_log /var/log/nginx/file.tyss.io-error.log error; ssl_certificate /etc/letsencrypt/live/file.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/file.tyss.io/privkey.pem; include inc/global.conf; include inc/static.conf; include inc/cdn_csp.conf; location / { try_files $uri $uri/ /index.php?$query_string; } location ~ \.php$ { internal; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_index index.php; include inc/fastcgi.conf; include inc/php.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_pass unix:/run/php/file.sock; } } # configuration file /etc/nginx/inc/static.conf: location ~* \.(js|css|png|webp|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot|ttf|txt)$ { add_header 'Access-Control-Allow-Origin' '*' always; add_header Cache-Control "public, no-transform"; expires 4h; try_files $uri $uri/ =404; } location ~ ^/(dist|download|downloads|img)/ { autoindex on; autoindex_exact_size off; autoindex_format html; autoindex_localtime off; } # configuration file /etc/nginx/conf.d/git.tyss.io.conf: # This file is managed by gitlab-ctl. Manual changes will be # erased! To change the contents below, edit /etc/gitlab/gitlab.rb # and run `sudo gitlab-ctl reconfigure`. ## GitLab ## Modified from https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib/support/nginx/gitlab-ssl & https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib/support/nginx/gitlab ## ## Lines starting with two hashes (##) are comments with information. ## Lines starting with one hash (#) are configuration parameters that can be uncommented. ## ################################## ## CHUNKED TRANSFER ## ################################## ## ## It is a known issue that Git-over-HTTP requires chunked transfer encoding [0] ## which is not supported by Nginx < 1.3.9 [1]. As a result, pushing a large object ## with Git (i.e. a single large file) can lead to a 411 error. In theory you can get ## around this by tweaking this configuration file and either: ## - installing an old version of Nginx with the chunkin module [2] compiled in, or ## - using a newer version of Nginx. ## ## At the time of writing we do not know if either of these theoretical solutions works. ## As a workaround users can use Git over SSH to push large files. ## ## [0] https://git.kernel.org/cgit/git/git.git/tree/Documentation/technical/http-protocol.txt#n99 ## [1] https://github.com/agentzh/chunkin-nginx-module#status ## [2] https://github.com/agentzh/chunkin-nginx-module ## ################################### ## configuration ## ################################### ## Redirects all HTTP traffic to the HTTPS host server { ## HTTPS redirect server listen 80; listen [::]:80; server_name git.tyss.io; server_tokens off; ## Don't show the nginx version number, a security best practice location / { return 301 https://git.tyss.io:443$request_uri; } # Pass headers because we are serving monitoring endpoints directly without # redirection proxy_set_header Host $http_host_with_default; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-Proto https; # health checks configuration include /etc/nginx/inc/gitlab-health.conf; access_log /var/log/nginx/git.tyss.io-access.log gitlab_access; error_log /var/log/nginx/git.tyss.io-error.log error; } ## end HTTPS redirect server server { ## HTTPS server #include inc/global.conf; listen 443 ssl; listen [::]:443 ssl; http2 on; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header X-XSS-Protection "1; mode=block"; add_header Referrer-Policy "strict-origin-when-cross-origin" always; ssl_session_cache shared:SSL:50m; ssl_session_timeout 1d; ssl_session_tickets off; server_name git.tyss.io; ssl_certificate /etc/letsencrypt/live/git.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/git.tyss.io/privkey.pem; ## Increase this if you want to upload large attachments ## Or if you want to accept large git objects over http client_max_body_size 0; # Rails sets a default policy of strict-origin-when-cross-origin, so # hide that and just send the one we've configured for nginx proxy_hide_header Referrer-Policy; add_header Referrer-Policy strict-origin-when-cross-origin; ## Individual nginx logs for this GitLab vhost access_log /var/log/gitlab/nginx/gitlab_access.log gitlab_access; error_log /var/log/gitlab/nginx/gitlab_error.log error; if ($http_host = "") { set $http_host_with_default "git.tyss.io"; } if ($http_host != "") { set $http_host_with_default $http_host; } gzip on; gzip_static on; gzip_comp_level 2; gzip_http_version 1.1; gzip_vary on; gzip_disable "msie6"; gzip_min_length 250; gzip_proxied no-cache no-store private expired auth; gzip_types text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript application/json; ## https://github.com/gitlabhq/gitlabhq/issues/694 ## Some requests take more than 30 seconds. proxy_read_timeout 3600; proxy_connect_timeout 300; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Host $http_host_with_default; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header X-Forwarded-Ssl on; proxy_set_header X-Forwarded-Proto https; location ~ (/api/v\d/jobs/\d+/artifacts$|/import/gitlab_project$|\.git/git-receive-pack$|\.git/ssh-receive-pack$|\.git/ssh-upload-pack$|\.git/gitlab-lfs/objects|\.git/info/lfs/objects/batch$) { proxy_cache off; proxy_pass http://gitlab-workhorse; proxy_request_buffering off; } location ~ ^/api/v\d { proxy_cache off; proxy_pass http://gitlab-workhorse; proxy_intercept_errors off; } location = /-/kubernetes-agent/ { proxy_pass http://localhost:8150/; proxy_intercept_errors off; } location /-/kubernetes-agent/k8s-proxy/ { proxy_pass http://localhost:8154/; proxy_buffering off; proxy_intercept_errors off; } # health checks configuration include /etc/nginx/inc/gitlab-health.conf; location / { proxy_cache off; proxy_pass http://gitlab-workhorse; } location /assets { proxy_cache gitlab; proxy_pass http://gitlab-workhorse; } error_page 404 /404.html; error_page 500 /500.html; error_page 502 /502.html; location ~ ^/(404|500|502)(-custom)?\.html$ { root /opt/gitlab/embedded/service/gitlab-rails/public; internal; } } ## end HTTPS server # configuration file /etc/nginx/inc/gitlab-health.conf: # This file is managed by gitlab-ctl. Manual changes will be # erased! To change the contents below, edit /etc/gitlab/gitlab.rb # and run `sudo gitlab-ctl reconfigure`. location /error.txt { # return code here is ignored by the error_page directive return 500 'nginx returned $status when communicating with gitlab-workhorse\n'; } location /error.json { # return code here is ignored by the error_page directive return 500 '{"error":"nginx returned $status when communicating with gitlab-workhorse","status":$status}\n'; } location = /-/health { proxy_cache off; proxy_http_version 1.0; proxy_pass http://gitlab-workhorse; error_page 404 500 502 /error.txt; } location = /-/readiness { proxy_cache off; proxy_http_version 1.0; proxy_pass http://gitlab-workhorse; error_page 404 500 502 /error.json; } location = /-/liveness { proxy_cache off; proxy_http_version 1.0; proxy_pass http://gitlab-workhorse; error_page 404 500 502 /error.json; } # configuration file /etc/nginx/conf.d/keytest.org.conf: server { server_name keytest.org; root /var/www/keytest; index index.html; access_log /var/log/nginx/keytest.org-access.log main; error_log /var/log/nginx/keytest.org-error.log error; ssl_certificate /etc/letsencrypt/live/keytest.org/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/keytest.org/privkey.pem; include inc/global.conf; #include inc/strict.conf; #location / { # try_files $uri $uri/ /keyboard.html; #} # add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests; script-src 'self' https://cdn.tyss.io https> include inc/hsts.conf; } # configuration file /etc/nginx/conf.d/md.tyss.io.conf: server { server_name md.tyss.io; root /var/www/downview; index index.php; access_log /var/log/nginx/md.tyss.io-access.log main; error_log /var/log/nginx/md.tyss.io-error.log error; ssl_certificate /etc/letsencrypt/live/md.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/md.tyss.io/privkey.pem; include inc/global.conf; #include inc/static.conf; location ~* \.md$ { add_header Content-Type text/markdown; try_files $uri =404; } location / { try_files $uri /index.php$is_args$args; } location ~ \.php$ { include inc/fastcgi.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_pass unix:/run/php/www.sock; } } # configuration file /etc/nginx/conf.d/n.cj36.org.conf: server { server_name n.cj36.org; root /var/www/renote; index index.php; access_log /var/log/nginx/n.cj36.org-access.log main; error_log /var/log/nginx/n.cj36.org-error.log error; ssl_certificate /etc/letsencrypt/live/n.cj36.org/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/n.cj36.org/privkey.pem; include inc/global.conf; include inc/static.conf; # Protect raw data file from direct access location ^~ /data/ { deny all; } location / { try_files $uri /index.php; } location ~ \.php$ { include inc/fastcgi.conf; fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; fastcgi_pass unix:/run/php/www.sock; # adjust for your distro } } # configuration file /etc/nginx/conf.d/nas.tyss.io.conf: server { server_name nas.tyss.io; access_log /var/log/nginx/nas.tyss.io-access.log proxy; error_log /var/log/nginx/nas.tyss.io-error.log error; ssl_certificate /etc/letsencrypt/live/nas.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/nas.tyss.io/privkey.pem; include inc/global.conf; #include inc/cdn_csp.conf; location / { proxy_pass https://10.0.0.10; proxy_ssl_name TYSNAS; proxy_pass_header Authorization; proxy_set_header Host $host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_http_version 1.1; proxy_set_header Connection ""; proxy_buffering off; proxy_read_timeout 36000s; proxy_redirect off; proxy_ssl_verify on; proxy_ssl_trusted_certificate /etc/ssl/tys.crt; proxy_ssl_verify_depth 2; proxy_ssl_server_name on; } } # configuration file /etc/nginx/conf.d/nginx_all.conf: # configuration file /etc/nginx/conf.d/pass.tyss.io.conf: server { server_name pass.tyss.io; root /var/www/pass; index index.html; access_log /var/log/nginx/pass.tyss.io-access.log main; error_log /var/log/nginx/pass.tyss.io-error.log error; ssl_certificate /etc/letsencrypt/live/pass.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/pass.tyss.io/privkey.pem; include inc/global.conf; #include inc/cdn_csp.conf; include inc/static.conf; include inc/html.conf; if ($request_method !~ ^(GET|POST|HEAD|OPTIONS)$) { return 405; } autoindex off; types { text/plain txt; text/html html; text/css css; application/javascript js; } } # configuration file /etc/nginx/inc/html.conf: location = / { try_files /index.html =404; } location / { # if ($request_uri != "/") { # return 301 /; # } try_files /index.html =404; } # configuration file /etc/nginx/conf.d/pgptool.com.conf: server { server_name pgptool.com; # Your domain name root /var/www/secure; # Set the document root access_log /var/log/nginx/pgptool.com-access.log main; # Consider a more detailed format if needed error_log /var/log/nginx/pgptool.com-error.log warn; # Log warnings and more severe errors ssl_certificate /etc/letsencrypt/live/pgptool.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/pgptool.com/privkey.pem; add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; include inc/global.conf; include inc/cdn_csp.conf; location ~* \.(?:css|js|map|webp|jpe?g|png|gif|ico|eot|svg|ttf|woff|woff2)$ { try_files $uri =404; expires 1y; add_header Cache-Control "public, immutable"; access_log off; } location / { try_files $uri $uri/ /index.html; } } # configuration file /etc/nginx/conf.d/place.tyss.io.conf: server { server_name place.tyss.io; root /var/www/rplace; index index.html; access_log /var/log/nginx/place.tyss.io-access.log proxy; error_log /var/log/nginx/place.tyss.io-error.log error; ssl_certificate /etc/letsencrypt/live/place.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/place.tyss.io/privkey.pem; include inc/global.conf; } # configuration file /etc/nginx/conf.d/popllc.us.conf: server { server_name popllc.us; access_log /var/log/nginx/popllc.us-access.log proxy; error_log /var/log/nginx/popllc.us-error.log error; ssl_certificate /etc/letsencrypt/live/popllc.us/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/popllc.us/privkey.pem; include inc/global.conf; location / { proxy_pass http://127.0.0.1:6001; proxy_http_version 1.1; proxy_set_header Host $host; # Client IPs proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # WebSockets / SSE proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; # Let NGINX handle compression proxy_set_header Accept-Encoding ""; proxy_read_timeout 3600; proxy_send_timeout 3600; } } # configuration file /etc/nginx/conf.d/registry.tyss.io.conf: server { server_name registry.tyss.io; client_max_body_size 0; chunked_transfer_encoding on; ssl_certificate /etc/letsencrypt/live/registry.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/registry.tyss.io/privkey.pem; access_log /var/log/gitlab/nginx/registry.tyss.io-access.log gitlab_access; error_log /var/log/gitlab/nginx/registry.tyss.io-error.log error; include inc/global.conf; include inc/hsts.conf; location /.well-known/acme-challenge/ { root /var/opt/gitlab/nginx/www/; } location / { proxy_set_header Host $http_host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Ssl on; proxy_read_timeout 900; proxy_cache off; proxy_buffering off; proxy_request_buffering off; proxy_http_version 1.1; proxy_pass http://127.0.0.1:5000; } } # configuration file /etc/nginx/inc/hsts.conf: #6M #add_header Strict-Transport-Security "max-age=15768000; preload" always; add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always; #1Y #add_header Strict-Transport-Security "max-age=31536000;" always; #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; # configuration file /etc/nginx/conf.d/share.tyss.io.conf: # docker run -d -v `pwd`/data:/data -p 8222:8222 schollz/share -e url=https://share.tyss.io # https://github.com/schollz/share server { server_name share.tyss.io; access_log /var/log/nginx/share.tyss.io-access.log main; error_log /var/log/nginx/share.tyss.io-error.log error; ssl_certificate /etc/letsencrypt/live/share.tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/share.tyss.io/privkey.pem; include inc/global.conf; include inc/cdn_csp.conf; location / { proxy_pass http://localhost:6000; proxy_set_header Host $host; proxy_set_header X-Real-IP $http_cf_connecting_ip; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } } # configuration file /etc/nginx/conf.d/theyellowsub.org.conf: server { server_name theyellowsub.org; root /var/www/theyellowsub; index index.php; ssl_certificate /etc/letsencrypt/live/theyellowsub.org/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/theyellowsub.org/privkey.pem; access_log /var/log/nginx/theyellowsub.org-access.log json; error_log /var/log/nginx/theyellowsub.org-error.log error; include inc/global.conf; include inc/hsts.conf; include inc/static.conf; include inc/error.conf; include inc/cft_csp.conf; location ~ ^/(qa|sa) { location ~* \.css$ { add_header 'Access-Control-Allow-Origin' '*' always; add_header Content-Type text/css; try_files $uri =404; } try_files $uri $uri/ /index.php?$query_string; location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/run/php/tys.sock; fastcgi_index index.php; include inc/fastcgi.conf; include inc/php.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } add_header Speculation-Rules '"/speculation/rules.json"' always; location = /speculation/rules.json { default_type application/speculationrules+json; } if ($request_uri ~ ^/(.+)\.php$) { return 302 /$1$is_args$args; } location = /index { return 302 /$is_args$args; } location / { try_files $uri $uri/ $uri.html $uri.php$is_args$args; } location ~ \.php$ { internal; try_files $uri =404; include inc/fastcgi.conf; include inc/php.conf; fastcgi_pass unix:/run/php/tys.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_NAME $fastcgi_script_name; #include inc/turnstile.conf; } #location /admin/ { # return 401; #} } # configuration file /etc/nginx/inc/error.conf: proxy_intercept_errors on; error_page 400 401 403 404 500 /error; location = /error.php { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/run/php/tys.sock; include inc/fastcgi.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } # configuration file /etc/nginx/inc/cft_csp.conf: add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com https://code.jquery.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; script-src-elem 'self' 'unsafe-inline' https://challenges.cloudflare.com https://code.jquery.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; img-src 'self' data: blob: https://lirp.cdn-website.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com data:; frame-src 'self' https://challenges.cloudflare.com; child-src 'self' https://challenges.cloudflare.com; worker-src 'self' blob:; media-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'" always; add_header Cross-Origin-Embedder-Policy "" always; add_header Cross-Origin-Opener-Policy "unsafe-none" always; # configuration file /etc/nginx/conf.d/tyss.dev.conf: server { server_name tyss.dev; root /var/www/dev; index index.html; access_log /var/log/nginx/tyss.dev-access.log main; error_log /var/log/nginx/tyss.dev-error.log error; ssl_certificate /etc/letsencrypt/live/tyss.dev/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/tyss.dev/privkey.pem; # /pgp forces inline text location /pgp { add_header Content-Disposition "inline; filename=\"public_key.asc\""; add_header Content-Type text/plain; default_type text/plain; alias /var/www/dev/public_key.asc; } # /pgp location ~ \.asc$ { add_header Content-Disposition "inline; filename=\"public_key.asc\""; add_header Content-Type text/plain; default_type text/plain; alias /var/www/dev/public_key.asc; } include inc/global.conf; include inc/static.conf; #add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests; script-src 'self' https://cdn.tyss.io https://git.tyss.io https://cdnjs.cloudflare.com https://code.jquery.com 'report-sample'; style-src 'self' https://cdn.tyss.io https://git.tyss.io 'report-sample'; img-src 'self' data: blob: https://*.gravatar.com https://tyss.dev; font-src 'self' https://cdn.tyss.io https://git.tyss.io data:; connect-src 'self' https://git.tyss.io; frame-src 'self' https://cdn.tyss.io https://git.tyss.io" always; include inc/hsts.conf; location / { try_files $uri $uri/ index.html; } } server { server_name keytest.tyss.dev; include inc/global.conf; access_log off; error_log off; ssl_certificate /etc/letsencrypt/live/keytest.tyss.dev/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/keytest.tyss.dev/privkey.pem; return 301 https://keytest.org; } # configuration file /etc/nginx/conf.d/vacsafe.cc.conf: server { server_name vacsafe.cc; root /var/www/vacsafe; index index.html; access_log /var/log/nginx/vacsafe.cc-access.log main; error_log /var/log/nginx/vacsafe.cc-error.log error; ssl_certificate /etc/letsencrypt/live/vacsafe.cc/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/vacsafe.cc/privkey.pem; include inc/global.conf; include inc/cdn_csp.conf; include inc/static.conf; include inc/html.conf; } # configuration file /etc/nginx/conf.d/wiki.maxc.us.conf: server { server_name wiki.maxc.us; root /var/www/wiki/public; index index.php index.html index.htm; access_log /var/log/nginx/wiki.maxc.us.app-access.log main; error_log /var/log/nginx/wiki.maxc.us.app-error.log error; ssl_certificate /etc/letsencrypt/live/maxc.us/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/maxc.us/privkey.pem; include inc/global.conf; include inc/cdn_csp.conf; location / { try_files $uri $uri/ /index.php$is_args$args; autoindex off; } location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/run/php/www.sock; fastcgi_index index.php; include inc/fastcgi.conf; include inc/php.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } # configuration file /etc/nginx/conf.d/wol.conf: server { server_name wol; root /var/www/wol; index index.php; access_log /var/log/nginx/wol-access.log main; error_log /var/log/nginx/wol-error.log error; ssl_certificate /etc/ssl/ca/wol/fullchain.pem; ssl_certificate_key /etc/ssl/ca/wol/privkey.pem; include inc/global.conf; ssl_stapling off; location / { try_files $uri $uri/ /index.php; allow 10.0.0.0/24; allow 10.0.1.0/24; allow 192.168.1.95; deny all; } location = /favicon.ico { access_log off; log_not_found off; } location = /robots.txt { access_log off; log_not_found off; } location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/run/php/www.sock; fastcgi_index index.php; include inc/fastcgi.conf; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } } # configuration file /etc/nginx/inc/default.conf: server { if ($host = example.com) { return 301 https://$host$request_uri; } # managed by Certbot if ($host = www.example.com) { return 301 https://$host$request_uri; } # managed by Certbot listen 80; listen [::]:80; server_name example.com www.example.com; return 404; # managed by Certbot } server { listen 80 default_server; listen [::]:80 default_server; server_name _; return 301 https://$host$request_uri$is_args$args; } server { listen 443 ssl default_server; listen [::]:443 ssl default_server; http2 on; server_name _; # Prevent Handshake # ssl_reject_handshake on; ssl_certificate /etc/letsencrypt/live/_tyss.io/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/_tyss.io/privkey.pem; return 444; # 444 - stop | 400 - bad request | https://theyellowsub.org ... - redirect } ```