From 801124b2cfbdd46debb195d31cdb27d91bc4cc0d Mon Sep 17 00:00:00 2001 From: unfaiyted Date: Mon, 3 Jun 2024 12:37:24 -0500 Subject: [PATCH] chore: fix --- nginx/proxy-confs/nextcloud.subdomain.conf | 110 +++++++++++++++++++-- 1 file changed, 104 insertions(+), 6 deletions(-) diff --git a/nginx/proxy-confs/nextcloud.subdomain.conf b/nginx/proxy-confs/nextcloud.subdomain.conf index df4bee1..60ca14e 100644 --- a/nginx/proxy-confs/nextcloud.subdomain.conf +++ b/nginx/proxy-confs/nextcloud.subdomain.conf @@ -21,17 +21,115 @@ server { include /config/nginx/ssl.conf; - client_max_body_size 0; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305; + ssl_prefer_server_ciphers on; + + +# client_max_body_size 0; location / { include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app 192.168.0.123; - set $upstream_port 8443; - set $upstream_proto https; - proxy_pass $upstream_proto://$upstream_app:$upstream_port; + set $upstream_port 8080; + set $upstream_proto http; - proxy_hide_header X-Frame-Options; - proxy_max_temp_file_size 2048m; + + + proxy_pass $upstream_proto://$upstream_app:$upstream_port$request_uri; + + + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-Scheme $scheme; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Accept-Encoding ""; + proxy_set_header Host $host; + + client_body_buffer_size 512k; + proxy_read_timeout 86400s; + client_max_body_size 0; + + # Websocket + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + + + + proxy_hide_header X-Frame-Options; + proxy_max_temp_file_size 2048m; } } + + + + + +server { + listen 80; + #listen [::]:80; # comment to disable IPv6 + + if ($scheme = "http") { + return 301 https://$host$request_uri; + } + + listen 443 ssl http2; # for nginx versions below v1.25.1 + #listen [::]:443 ssl http2; # for nginx versions below v1.25.1 - comment to disable IPv6 + + # listen 443 ssl; # for nginx v1.25.1+ + # listen [::]:443 ssl; # for nginx v1.25.1+ - keep comment to disable IPv6 + + # http2 on; # uncomment to enable HTTP/2 - supported on nginx v1.25.1+ + # http3 on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ + # quic_retry on; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ + # add_header Alt-Svc 'h3=":443"; ma=86400'; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ + # listen 443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport + # listen [::]:443 quic reuseport; # uncomment to enable HTTP/3 / QUIC - supported on nginx v1.25.0+ - please remove "reuseport" if there is already another quic listener on port 443 with enabled reuseport - keep comment to disable IPv6 + + server_name cloud.example.com; + + location / { + proxy_pass http://127.0.0.1:32323$request_uri; + + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Port $server_port; + proxy_set_header X-Forwarded-Scheme $scheme; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Accept-Encoding ""; + proxy_set_header Host $host; + + client_body_buffer_size 512k; + proxy_read_timeout 86400s; + client_max_body_size 0; + + # Websocket + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + } + + ssl_certificate /etc/letsencrypt/live/cloud.example.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/cloud.example.com/privkey.pem; # managed by Certbot + + ssl_session_timeout 1d; + ssl_session_cache shared:MozSSL:10m; # about 40000 sessions + ssl_session_tickets off; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305; + ssl_prefer_server_ciphers on; + + # Optional settings: + + # OCSP stapling + # ssl_stapling on; + # ssl_stapling_verify on; + # ssl_trusted_certificate /etc/letsencrypt/live//chain.pem; + + # replace with the IP address of your resolver + # resolver 127.0.0.1; # needed for oscp stapling: e.g. use 94.140.15.15 for adguard / 1.1.1.1 for cloudflared or 8.8.8.8 for google - you can use the same nameserver as listed in your /etc/resolv.conf file +} \ No newline at end of file