diff --git a/012-nextcloud.conf b/012-nextcloud.conf index deb890a..413e2f2 100644 --- a/012-nextcloud.conf +++ b/012-nextcloud.conf @@ -98,16 +98,27 @@ server { # access it despite the existence of the regex rule # `location ~ /(\.|autotest|...)` which would otherwise handle requests # for `/.well-known`. +# location ^~ /.well-known { +# # The following 6 rules are borrowed from `.htaccess` +# +# rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last; +# rewrite ^/\.well-known/host-meta /public.php?service=host-meta last; +# rewrite ^/\.well-known/webfinger /public.php?service=webfinger last; +# rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last; +# +# location = /.well-known/carddav { return 301 /remote.php/dav/; } +# location = /.well-known/caldav { return 301 /remote.php/dav/; } +# +# try_files $uri $uri/ =404; +# } + location ^~ /.well-known { # The following 6 rules are borrowed from `.htaccess` - rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last; - rewrite ^/\.well-known/host-meta /public.php?service=host-meta last; - rewrite ^/\.well-known/webfinger /public.php?service=webfinger last; - rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last; - location = /.well-known/carddav { return 301 /remote.php/dav/; } location = /.well-known/caldav { return 301 /remote.php/dav/; } + # Anything else is dynamically handled by Nextcloud + location ^~ /.well-known { return 301 /index.php$uri; } try_files $uri $uri/ =404; } diff --git a/014-piwigo.conf b/014-piwigo.conf new file mode 100644 index 0000000..91fad66 --- /dev/null +++ b/014-piwigo.conf @@ -0,0 +1,110 @@ +#upstream php-handler { +# #server 127.0.0.1:9000; +# server unix:/var/run/php/php8.0-fpm.sock; +#} + +server { + listen 80; + #listen [::]:80; + server_name photos.solusar.de; + + # Enforce HTTPS + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + #listen [::]:443 ssl http2; + server_name photos.solusar.de; + + #ssl on; + ssl_certificate /etc/letsencrypt/live/photos.solusar.de/fullchain.pem; + ssl_trusted_certificate /etc/letsencrypt/live/photos.solusar.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/photos.solusar.de/privkey.pem; + + ssl_dhparam /etc/myssl/dh4096.pem; + ssl_protocols TLSv1.2; + ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK'; + ssl_session_timeout 5m; + ssl_prefer_server_ciphers on; + ssl_session_cache shared:SSL:50m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"; + #add_header X-Frame-Options "SAMEORIGIN"; + #add_header X-Content-Type-Options nosniff; + #add_header X-XSS-Protection "1; mode=block"; + #add_header Content-Security-Policy "default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline' https://nc.solusar.de; img-src * data:; object-src 'none'; style-src 'self' 'unsafe-inline' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self';"; + + # set max upload size + client_max_body_size 2048M; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + #gzip on; + #gzip_vary on; + #gzip_comp_level 4; + #gzip_min_length 256; + #gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + #gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + # Pagespeed is not supported by Nextcloud, so if your server is built + # with the `ngx_pagespeed` module, uncomment this line to disable it. + #pagespeed off; + + # HTTP response headers borrowed from Nextcloud `.htaccess` + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + # Path to the root of your installation + root /var/www/vhosts/solusar.de/subdomains/piwigo; + + # Specify how to handle directories -- specifying `/index.php$request_uri` + # here as the fallback means that Nginx always exhibits the desired behaviour + # when a client requests a path that corresponds to a directory that exists + # on the server. In particular, if that directory contains an index.php file, + # that file is correctly served; if it doesn't, then the request is passed to + # the front-end controller. This consistent behaviour means that we don't need + # to specify custom rules for certain paths (e.g. images and other assets, + # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus + # `try_files $uri $uri/ /index.php$request_uri` + # always provides the desired behaviour. + index index.php index.html /index.php$request_uri; + + # Default Cache-Control policy + expires 1m; + + # Ensure this block, which passes PHP files to the PHP process, is above the blocks + # which handle static assets (as seen below). If this block is not declared first, + # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php` + # to the URI, resulting in a HTTP 500 error response. + location ~ \.php(?:$|/) { + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + set $path_info $fastcgi_path_info; + + try_files $fastcgi_script_name =404; + + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + fastcgi_param HTTPS on; + + fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice + fastcgi_param front_controller_active true; # Enable pretty urls + fastcgi_pass php-handler; + + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + #location / { + # try_files $uri $uri/ /index.php$request_uri; + #} +} diff --git a/015-openhab-cloud.conf b/015-openhab-cloud.conf new file mode 100644 index 0000000..25d3b7a --- /dev/null +++ b/015-openhab-cloud.conf @@ -0,0 +1,95 @@ +server { + listen 80; + #listen [::]:80; + server_name ohc.solusar.de; + + # Enforce HTTPS + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + #listen [::]:443 ssl http2; + server_name ohc.solusar.de; + + #ssl on; + ssl_certificate /etc/letsencrypt/live/ohc.solusar.de/fullchain.pem; + ssl_trusted_certificate /etc/letsencrypt/live/ohc.solusar.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/ohc.solusar.de/privkey.pem; + + ssl_dhparam /etc/myssl/dh4096.pem; + ssl_protocols TLSv1.2; + ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK'; + ssl_session_timeout 5m; + ssl_prefer_server_ciphers on; + ssl_session_cache shared:SSL:50m; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"; + #add_header X-Frame-Options "SAMEORIGIN"; + #add_header X-Content-Type-Options nosniff; + #add_header X-XSS-Protection "1; mode=block"; + #add_header Content-Security-Policy "default-src 'none'; font-src 'self'; script-src 'self' 'unsafe-inline' https://nc.solusar.de; img-src * data:; object-src 'none'; style-src 'self' 'unsafe-inline' 'sha256-bQfd5MwpJ1ZxnVh373acxlqXQ8VwM88QhEHNuQ0ppNg='; frame-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self';frame-ancestors 'self';"; + + charset utf-8; + + access_log /var/log/nginx/openhabcloud.org-access.log; + error_log /var/log/nginx/openhabcloud-error.log; + client_max_body_size 300m; + + location /css { + alias /opt/openhab-cloud/public/css; + } + + location /js { + alias /opt/openhab-cloud/public/js; + } + + location /img { + alias /opt/openhab-cloud/public/img; + } + + location /bootstrap { + alias /opt/openhab-cloud/public/bootstrap; + } + + location /font-icons { + alias /opt/openhab-cloud/public/font-icons; + } + + location /fonts { + alias /opt/openhab-cloud/public/fonts; + } + + location /js-plugin { + alias /opt/openhab-cloud/public/js-plugin; + } + + location /staff/js-plugin { + alias /opt/openhab-cloud/public/js-plugin; + } + + location /downloads { + alias /opt/openhab-cloud/public/downloads; + } + + location / { + proxy_pass http://localhost:3000; + proxy_redirect off; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header X-Real-IP $remote_addr ; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for ; + proxy_set_header X-Forwarded-Proto https; + } + + #error_page 404 /404.html; + + # redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + location = /50x.html { + root html; + } +}