initial commit
This commit is contained in:
Gitea
+108
@@ -0,0 +1,108 @@
|
||||
|
||||
##
|
||||
# SEARX config
|
||||
##
|
||||
|
||||
geo $limit {
|
||||
default 1;
|
||||
192.124.237.237 0;
|
||||
}
|
||||
|
||||
map $limit $limit_key {
|
||||
0 "";
|
||||
1 $binary_remote_addr;
|
||||
}
|
||||
|
||||
limit_req_zone $limit_key zone=search:10m rate=5r/s;
|
||||
|
||||
|
||||
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name searx.solusar.de www.searx.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name www.searx.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://searx.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/searx.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
#add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: http: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' http: https:; font-src 'self' data: http: https:; object-src 'none';";
|
||||
add_header Content-Security-Policy "default-src 'none'; font-src 'self'; script-src 'self' https://searx.solusar.de; img-src * data:; object-src 'none'; style-src 'self' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self';";
|
||||
|
||||
# default-src 'none'; font-src 'self'; script-src 'self' 'sha256-IP0Wu+32AyU/oDc6ZoLyf8izu/2fUvR7RAEf81sddNk='; img-src * data:; object-src 'none'; style-src 'self' 'sha256-PEo9RAB0C7Pw0EzsgS+HuVOHFPZRr93dZNJ9mYzz95A=' 'sha256-lrhGtO62QsLjBNsk1WGpvRZbHmXYMG/CmjhMFhLDJpg=' 'sha256-4SHcbKIX1Fx5rhlottWqqHggM5MSJz+xg9uwwq8UK74=' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg=' 'sha256-yIJ6JcbosmUis6IDdnDV7NU2qPkU/1KUJHRwj44Q32o='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self'; report-uri https://csp.itronic.at/report.php;
|
||||
}
|
||||
|
||||
server {
|
||||
#listen 80;
|
||||
listen 443 ssl http2;
|
||||
|
||||
access_log /var/log/nginx/002-searx-access.log;
|
||||
error_log /var/log/nginx/002-searx-error.log;
|
||||
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/searx.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/searx.solusar.de/privkey.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
#add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: http: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' http: https:; font-src 'self' data: http: https:; object-src 'none';";
|
||||
add_header Content-Security-Policy "default-src 'none'; font-src 'self'; script-src 'self' https://searx.solusar.de; img-src * data:; object-src 'none'; style-src 'self' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self';";
|
||||
|
||||
server_name searx.solusar.de;
|
||||
|
||||
location / {
|
||||
limit_req zone=search burst=10 nodelay;
|
||||
#limit_except GET {
|
||||
# allow 192.124.237.237;
|
||||
# allow 5.9.58.49;
|
||||
# deny all;
|
||||
#}
|
||||
if ($http_user_agent ~ (curl|cURL|Wget|python-requests|Scrapy|FeedFetcher|Go-http-client|UniversalFeedParser|feedparser|Ruby) ) {
|
||||
return 403;
|
||||
}
|
||||
if ($query_string = "format=rss" ) { return 403; }
|
||||
if ($query_string = "format=json" ) { return 403; }
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Scheme $scheme;
|
||||
#proxy_buffering off;
|
||||
proxy_pass http://localhost:4004;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
|
||||
|
||||
##
|
||||
# POSTFIX site
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name postfix.solusar.de www.postfix.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name www.postfix.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://postfix.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/postfix.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name postfix.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/003-postfix-access.log;
|
||||
error_log /var/log/nginx/003-postfix-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/postfix.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/postfix.solusar.de/privkey.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
root /var/www/vhosts/solusar.de/subdomains/postfix/public;
|
||||
index index.php
|
||||
|
||||
include global/restrictions.conf;
|
||||
include global/php.conf;
|
||||
}
|
||||
@@ -0,0 +1,125 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name diaspora.solusar.de www.diaspora.example.org;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# Redirect https://www.diaspora.example.org to https://diaspora.example.org
|
||||
server {
|
||||
listen 443 ssl http2; # Same rules as for listen [::]:80 apply.
|
||||
|
||||
server_name www.diaspora.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://diaspora.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
# SSL setup
|
||||
|
||||
# This file should also include any necessary intermediate certificates.
|
||||
# For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
|
||||
# For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
|
||||
# and /etc/letsencrypt/diaspora.example.org/privkey.pem
|
||||
ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
|
||||
# Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
# You might want to make these global
|
||||
|
||||
# generate with openssl dhparam 2048 > /path/to/dhparam.pem
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
# Actual proxy
|
||||
|
||||
server {
|
||||
listen 443 ssl http2; # Same rules as for listen [::]:80 apply.
|
||||
server_name diaspora.solusar.de;
|
||||
root /home/diaspora/diaspora/public;
|
||||
|
||||
access_log /var/log/nginx/004-diaspora-access.log;
|
||||
error_log /var/log/nginx/004-diaspora-error.log;
|
||||
|
||||
# Configure maximum picture size
|
||||
# Note that Diaspora has a client side check set at 4M
|
||||
client_max_body_size 5M;
|
||||
client_body_buffer_size 256K;
|
||||
|
||||
# SSL setup
|
||||
|
||||
# This file should also include any necessary intermediate certificates.
|
||||
# For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
|
||||
# For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
|
||||
# and /etc/letsencrypt/diaspora.example.org/privkey.pem
|
||||
ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
|
||||
# Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
# You might want to make these global
|
||||
|
||||
# generate with openssl dhparam 2048 > /path/to/dhparam.pem
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
# Proxy if requested file not found
|
||||
try_files $uri @diaspora;
|
||||
|
||||
location /assets/ {
|
||||
expires max;
|
||||
add_header Cache-Control public;
|
||||
}
|
||||
|
||||
# Camo support
|
||||
#location /camo/ {
|
||||
# proxy_redirect off;
|
||||
# proxy_pass http://camo/;
|
||||
# break;
|
||||
#}
|
||||
|
||||
location @diaspora {
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_redirect off;
|
||||
|
||||
proxy_pass http://localhost:3000;
|
||||
}
|
||||
}
|
||||
|
||||
# Proxy destination
|
||||
# Add as many server directives as you want
|
||||
# Also takes a socket, like unix:/path/to/some/socket.sock
|
||||
#upstream diaspora_server {
|
||||
# server unix:/home/diaspora/diaspora/tmp/diaspora.sock;
|
||||
#}
|
||||
|
||||
# Camo support
|
||||
#upstream camo {
|
||||
# server 127.0.0.1:8081;
|
||||
#}
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name diaspora.solusar.de www.diaspora.example.org;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
# Redirect https://www.diaspora.example.org to https://diaspora.example.org
|
||||
server {
|
||||
listen 443 ssl spdy; # Same rules as for listen [::]:80 apply.
|
||||
|
||||
server_name www.diaspora.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://diaspora.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
# SSL setup
|
||||
|
||||
# This file should also include any necessary intermediate certificates.
|
||||
# For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
|
||||
# For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
|
||||
# and /etc/letsencrypt/diaspora.example.org/privkey.pem
|
||||
ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
|
||||
# Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
# You might want to make these global
|
||||
|
||||
# generate with openssl dhparam 2048 > /path/to/dhparam.pem
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
# Actual proxy
|
||||
|
||||
server {
|
||||
listen 443 ssl spdy; # Same rules as for listen [::]:80 apply.
|
||||
server_name diaspora.solusar.de;
|
||||
root /home/diaspora/diaspora/public;
|
||||
|
||||
access_log /var/log/nginx/004-diaspora-access.log;
|
||||
error_log /var/log/nginx/004-diaspora-error.log;
|
||||
|
||||
# Configure maximum picture size
|
||||
# Note that Diaspora has a client side check set at 4M
|
||||
client_max_body_size 10M;
|
||||
client_body_buffer_size 512K;
|
||||
|
||||
# SSL setup
|
||||
|
||||
# This file should also include any necessary intermediate certificates.
|
||||
# For example for StartSSL that would be https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem
|
||||
# For Let's Encrypt use /etc/letsencrypt/live/diaspora.example.org/fullchain.pem
|
||||
# and /etc/letsencrypt/diaspora.example.org/privkey.pem
|
||||
ssl_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/diaspora.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/diaspora.solusar.de/fullchain.pem;
|
||||
|
||||
# Taken from https://wiki.mozilla.org/Security/Server_Side_TLS
|
||||
# You might want to make these global
|
||||
|
||||
# generate with openssl dhparam 2048 > /path/to/dhparam.pem
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
# Proxy if requested file not found
|
||||
try_files $uri @diaspora;
|
||||
|
||||
location /assets/ {
|
||||
expires max;
|
||||
add_header Cache-Control public;
|
||||
}
|
||||
|
||||
# Camo support
|
||||
#location /camo/ {
|
||||
# proxy_redirect off;
|
||||
# proxy_pass http://camo/;
|
||||
# break;
|
||||
#}
|
||||
|
||||
location @diaspora {
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_redirect off;
|
||||
|
||||
proxy_pass http://localhost:3000;
|
||||
}
|
||||
}
|
||||
|
||||
# Proxy destination
|
||||
# Add as many server directives as you want
|
||||
# Also takes a socket, like unix:/path/to/some/socket.sock
|
||||
#upstream diaspora_server {
|
||||
# server unix:/home/diaspora/diaspora/tmp/diaspora.sock;
|
||||
#}
|
||||
|
||||
# Camo support
|
||||
#upstream camo {
|
||||
# server 127.0.0.1:8081;
|
||||
#}
|
||||
|
||||
+133
@@ -0,0 +1,133 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name matrix.solusar.de www.matrix.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl; # Same rules as for listen [::]:80 apply.
|
||||
server_name www.matrix.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://matrix.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/matrix.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
#listen [::]:443 ssl;
|
||||
|
||||
server_name matrix.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/005-matrix-access.log;
|
||||
error_log /var/log/nginx/005-matrix-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/matrix.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
#index index.html index.htm;
|
||||
|
||||
#location /.well-known/matrix/ {
|
||||
# root /var/www/vhosts/solusar.de/subdomains/matrix/;
|
||||
# default_type application/json;
|
||||
# add_header Access-Control-Allow-Origin *;
|
||||
#}
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:8008;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
client_max_body_size 128m;
|
||||
}
|
||||
|
||||
location /.well-known/matrix/ {
|
||||
root /opt/synapse/nginx/www/;
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 8448 ssl default_server;
|
||||
#listen [::]:8448 ssl default_server;
|
||||
|
||||
server_name matrix.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/005-matrix-access.log;
|
||||
#access_log off;
|
||||
error_log /var/log/nginx/005-matrix-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/matrix.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/matrix.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
#index index.html index.htm;
|
||||
|
||||
#location /.well-known/matrix/ {
|
||||
# root /var/www/vhosts/solusar.de/subdomains/matrix/;
|
||||
# default_type application/json;
|
||||
# add_header Access-Control-Allow-Origin *;
|
||||
#}
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:8008;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
client_max_body_size 128m;
|
||||
}
|
||||
|
||||
location /.well-known/matrix/ {
|
||||
root /opt/synapse/nginx/www/;
|
||||
default_type application/json;
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
|
||||
|
||||
##
|
||||
# POSTFIX site
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name riot.solusar.de www.riot.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl spdy; # Same rules as for listen [::]:80 apply.
|
||||
server_name www.riot.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://riot.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/riot.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl spdy;
|
||||
|
||||
server_name riot.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/006-riot-access.log;
|
||||
error_log /var/log/nginx/006-riot-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/riot.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/riot.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
root /var/www/vhosts/solusar.de/subdomains/riot;
|
||||
index index.html index.htm;
|
||||
|
||||
location / {
|
||||
add_header Access-Control-Allow-Origin *;
|
||||
}
|
||||
|
||||
#include global/restrictions.conf;
|
||||
#include global/php.conf;
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
|
||||
|
||||
##
|
||||
# Indras site
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name indra.solusar.de www.indra.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2; # Same rules as for listen [::]:80 apply.
|
||||
server_name www.indra.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://indra.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/indra.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name indra.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/007-indra-access.log;
|
||||
error_log /var/log/nginx/007-indra-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/indra.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/indra.solusar.de/privkey.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
root /var/www/vhosts/solusar.de/subdomains/indra;
|
||||
index index.php
|
||||
|
||||
include global/restrictions.conf;
|
||||
include global/php.conf;
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
|
||||
|
||||
##
|
||||
# POSTFIX site
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name wiki.solusar.de www.wiki.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2; # Same rules as for listen [::]:80 apply.
|
||||
server_name www.wiki.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://wiki.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/wiki.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name wiki.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/008-wiki-access.log;
|
||||
error_log /var/log/nginx/008-wiki-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/wiki.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/wiki.solusar.de/privkey.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
#ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options "nosniff";
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
root /var/www/vhosts/solusar.de/subdomains/wiki;
|
||||
index index.php
|
||||
|
||||
include global/restrictions.conf;
|
||||
include global/php.conf;
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
|
||||
|
||||
##
|
||||
# POSTFIX site
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name webmail.solusar.de www.webmail.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2; # Same rules as for listen [::]:80 apply.
|
||||
server_name www.webmail.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://webmail.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/webmail.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name webmail.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/009-webmail-access.log;
|
||||
error_log /var/log/nginx/009-webmail-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/webmail.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/webmail.solusar.de/privkey.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
root /var/www/vhosts/solusar.de/subdomains/webmail;
|
||||
index index.php
|
||||
|
||||
include global/restrictions.conf;
|
||||
include global/php.conf;
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
|
||||
|
||||
##
|
||||
# POSTFIX site
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name gitea.solusar.de www.gitea.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2; # Same rules as for listen [::]:80 apply.
|
||||
server_name www.gitea.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://gitea.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/gitea.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
|
||||
server_name gitea.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/010-gitea-access.log;
|
||||
error_log /var/log/nginx/010-gitea-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/gitea.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/gitea.solusar.de/privkey.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
#root /var/www/vhosts/solusar.de/subdomains/gitea;
|
||||
#index index.php
|
||||
|
||||
#include global/restrictions.conf;
|
||||
#include global/php.conf;
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:4001;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,76 @@
|
||||
|
||||
|
||||
##
|
||||
# GRAFANA
|
||||
##
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name grafana.solusar.de www.grafana.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl; # Same rules as for listen [::]:80 apply.
|
||||
server_name www.grafana.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://grafana.solusar.de$request_uri;
|
||||
}
|
||||
|
||||
ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/grafana.solusar.de/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
|
||||
server_name grafana.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/011-grafana-access.log;
|
||||
error_log /var/log/nginx/011-grafana-error.log;
|
||||
|
||||
ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/grafana.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/grafana.solusar.de/privkey.pem;
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
|
||||
#root /var/www/vhosts/solusar.de/subdomains/awstats;
|
||||
#index index.php
|
||||
|
||||
#include global/restrictions.conf;
|
||||
#include global/php.conf;
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:3001;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
# Default server configuration
|
||||
#
|
||||
|
||||
server {
|
||||
listen 80 default_server;
|
||||
server_name solusar.de www.solusar.de;
|
||||
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2 default_server;
|
||||
|
||||
server_name solusar.de www.solusar.de;
|
||||
|
||||
access_log /var/log/nginx/default-access.log;
|
||||
error_log /var/log/nginx/default-error.log;
|
||||
|
||||
#ssl on;
|
||||
ssl_certificate /etc/letsencrypt/live/www.solusar.de/fullchain.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/www.solusar.de/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/www.solusar.de/privkey.pem;
|
||||
|
||||
|
||||
ssl_dhparam /etc/myssl/dh4096.pem;
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
|
||||
ssl_session_timeout 5m;
|
||||
ssl_prefer_server_ciphers on;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header Content-Security-Policy "default-src 'none'; child-src 'self'; connect-src 'self'; img-src 'self' data: https: *.gravatar.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' cdn.jsdelivr.net api.instagram.com pagead2.googlesyndication.com; style-src 'self' 'unsafe-inline' https: fonts.googleapis.com; font-src 'self' data: https: fonts.googleapis.com themes.googleusercontent.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self' www.paypal.com; media-src https:;";
|
||||
|
||||
#limit_req zone=one burst=10;
|
||||
|
||||
root /var/www/vhosts/solusar.de/httpdocs;
|
||||
index index.php;
|
||||
|
||||
include global/restrictions.conf;
|
||||
include global/php.conf;
|
||||
|
||||
location / {
|
||||
# This is cool because no php is touched for static content.
|
||||
# include the "$is_args$args" so non-default permalinks doesn't break when using query string
|
||||
try_files $uri $uri/ /index.php?q=$uri&$args;
|
||||
}
|
||||
|
||||
#location /filtron {
|
||||
# root /var/www/vhosts/solusar.de/subdomains/monitor/;
|
||||
# index index.html;
|
||||
#}
|
||||
|
||||
#location ~ \.php$ {
|
||||
# try_files $uri =404;
|
||||
# fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
# fastcgi_pass unix:/run/php/php7.3-fpm.sock;
|
||||
# fastcgi_index index.php;
|
||||
# include fastcgi_params;
|
||||
#}
|
||||
|
||||
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
|
||||
expires max;
|
||||
log_not_found off;
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user