7dcdf4ef8f
All checks were successful
Gitea Actions Demo / Explore-Gitea-Actions (push) Successful in 0s
403 lines
14 KiB
Plaintext
403 lines
14 KiB
Plaintext
|
|
|
|
# server {
|
|
# listen 443 ssl http2 ;
|
|
|
|
# server_name guaranteedstruggle.host;
|
|
# return 302 https://dashy.guaranteedstruggle.host;
|
|
# # ssl_certificate /etc/angie/ssl/guaranteedstruggle.host/cert.pem;
|
|
# # ssl_certificate_key /etc/angie/ssl/guaranteedstruggle.host/key.pem;
|
|
|
|
# ssl_certificate /etc/angie/ssl/dashy.guaranteedstruggle.host/cert.pem;
|
|
# ssl_certificate_key /etc/angie/ssl/dashy.guaranteedstruggle.host/key.pem;
|
|
# }
|
|
|
|
|
|
##### 2026-08-12 EXPL! :: конфиг катится только на lb1 т.к на второй уезжает по rsync
|
|
|
|
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
|
|
server_name wikijs.guaranteedstruggle.host;
|
|
|
|
location / {
|
|
proxy_pass http://192.168.0.143:3000/;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
ssl_certificate /etc/angie/ssl/wikijs.guaranteedstruggle.host/cert.pem;
|
|
ssl_certificate_key /etc/angie/ssl/wikijs.guaranteedstruggle.host/key.pem;
|
|
|
|
|
|
# для огромных таблиц линк громадный
|
|
# https://stackoverflow.com/questions/1067334/how-to-set-the-allowed-url-length-for-a-nginx-request-error-code-414-uri-too
|
|
client_max_body_size 124M;
|
|
client_body_buffer_size 2M;
|
|
|
|
client_header_buffer_size 15120k;
|
|
large_client_header_buffers 16 15120k;
|
|
}
|
|
server {
|
|
listen 443 ssl http2;
|
|
|
|
server_name keycloak.guaranteedstruggle.host;
|
|
|
|
location / {
|
|
proxy_pass http://192.168.0.231:8080;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
ssl_certificate /etc/angie/ssl/keycloak.guaranteedstruggle.host/cert.pem;
|
|
ssl_certificate_key /etc/angie/ssl/keycloak.guaranteedstruggle.host/key.pem;
|
|
}
|
|
|
|
upstream netbird_dashboard {
|
|
server 192.168.0.39:8080;
|
|
keepalive 10;
|
|
}
|
|
upstream netbird_server {
|
|
server 192.168.0.39:8081;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name noir-films.guaranteedstruggle.host;
|
|
|
|
location / {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
server_name noir-films.guaranteedstruggle.host;
|
|
http2 on;
|
|
ssl_certificate /etc/angie/ssl/noir-films.guaranteedstruggle.host/cert.pem;
|
|
ssl_certificate_key /etc/angie/ssl/noir-films.guaranteedstruggle.host/key.pem;
|
|
|
|
# Recommended SSL settings
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
|
|
|
|
# Required for long-lived gRPC connections
|
|
client_header_timeout 1d;
|
|
client_body_timeout 1d;
|
|
|
|
# Common proxy headers
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Scheme $scheme;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
|
|
# WebSocket connections (relay, signal, management)
|
|
location ~ ^/(relay|ws-proxy/) {
|
|
proxy_pass http://netbird_server;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "Upgrade";
|
|
proxy_set_header Host $host;
|
|
proxy_read_timeout 1d;
|
|
}
|
|
|
|
# Native gRPC (signal + management)
|
|
location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ {
|
|
grpc_pass grpc://netbird_server;
|
|
grpc_read_timeout 1d;
|
|
grpc_send_timeout 1d;
|
|
grpc_socket_keepalive on;
|
|
}
|
|
|
|
# HTTP routes (API + OAuth2)
|
|
location ~ ^/(api|oauth2)/ {
|
|
proxy_pass http://netbird_server;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# Dashboard (catch-all)
|
|
location / {
|
|
proxy_pass http://netbird_dashboard;
|
|
}
|
|
}
|
|
|
|
|
|
##### 2026-08-12 EXPL! :: не очень удобно перенос делать и т.к пока не юзается то и ладно. если @liyha_LoX вспомнится то врубить
|
|
##### бекап валяется в @backups-slut1:/stolen-goods/valavala.ru.zip
|
|
valavala.ru.zip
|
|
# # # For WebSocket
|
|
# # map $http_upgrade $connection_upgrade {
|
|
# # default upgrade;
|
|
# # '' close;
|
|
# # }
|
|
# # proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache1:16m max_size=1g inactive=720m use_temp_path=off;
|
|
# # server {
|
|
# # listen 443 ssl;
|
|
# # http2 on;
|
|
# # server_name valavala.ru;
|
|
|
|
# # ssl_session_timeout 1d;
|
|
# # ssl_session_cache shared:ssl_session_cache:10m;
|
|
# # ssl_session_tickets off;
|
|
|
|
# # # SSL protocol settings
|
|
# # ssl_protocols TLSv1.2 TLSv1.3;
|
|
# # ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
|
# # ssl_prefer_server_ciphers off;
|
|
# # #####ssl_stapling on;
|
|
# # ####ssl_stapling_verify on;
|
|
|
|
|
|
# # location / {
|
|
# # proxy_pass http://192.168.0.55:3033/;
|
|
|
|
# # proxy_set_header Host $host;
|
|
# # proxy_http_version 1.1;
|
|
# # proxy_redirect off;
|
|
# # proxy_set_header X-Real-IP $remote_addr;
|
|
# # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
# # proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# # # For WebSocket
|
|
# # proxy_set_header Upgrade $http_upgrade;
|
|
# # proxy_set_header Connection $connection_upgrade;
|
|
|
|
# # # Cache settings
|
|
# # proxy_cache cache1;
|
|
# # proxy_cache_lock on;
|
|
# # proxy_cache_use_stale updating;
|
|
# # proxy_force_ranges on;
|
|
# # add_header X-Cache $upstream_cache_status;
|
|
# # }
|
|
# # ssl_certificate /etc/angie/ssl/valavala.ru/cert.pem;
|
|
# # ssl_certificate_key /etc/angie/ssl/valavala.ru/key.pem;
|
|
# # }
|
|
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
listen 8448 ssl http2;
|
|
|
|
server_name matrix-server.guaranteedstruggle.host;
|
|
|
|
location / {
|
|
proxy_pass http://192.168.0.180:8008/;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
|
|
# Установите лимит, соответствующий или превышающий Tuwunel
|
|
client_max_body_size 50M;
|
|
|
|
# Для больших файлов также полезно увеличить тайм-ауты
|
|
proxy_read_timeout 300s;
|
|
proxy_connect_timeout 300s;
|
|
proxy_send_timeout 300s;
|
|
}
|
|
ssl_certificate /etc/angie/ssl/matrix-server.guaranteedstruggle.host/cert.pem;
|
|
ssl_certificate_key /etc/angie/ssl/matrix-server.guaranteedstruggle.host/key.pem;
|
|
}
|
|
|
|
|
|
server {
|
|
listen 443 ssl http2;
|
|
|
|
server_name git.guaranteedstruggle.host;
|
|
ssl_certificate /etc/angie/ssl/git.guaranteedstruggle.host/cert.pem;
|
|
ssl_certificate_key /etc/angie/ssl/git.guaranteedstruggle.host/key.pem;
|
|
|
|
|
|
|
|
location / {
|
|
# proxy_pass http://localhost:3000;
|
|
proxy_pass http://192.168.0.33:3000;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
}
|
|
|
|
|
|
server {
|
|
listen 443 ssl ; # http2;
|
|
|
|
server_name mail.guaranteedstruggle.host imap.guaranteedstruggle.host pop3.guaranteedstruggle.host;
|
|
#ssl_certificate /etc/angie/ssl/mail.guaranteedstruggle.host/cert.pem;
|
|
# ssl_certificate_key /etc/angie/ssl/mail.guaranteedstruggle.host/key.pem;
|
|
|
|
location / {
|
|
#proxy_pass http://localhost:8880;
|
|
####proxy_pass http://192.168.0.251:8080;
|
|
proxy_pass https://mail.guaranteedstruggle.host;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# # # # Map server names to a composite string containing certificate file, key file, and proxy pass URL
|
|
# # # map $http_host $host_config {
|
|
# # # nihil-unbound.guaranteedstruggle.host "/etc/angie/ssl/nihil-unbound.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/nihil-unbound.guaranteedstruggle.host/privkey.pem:http://default_backend";
|
|
# # # blog.guaranteedstruggle.host "/etc/angie/ssl/blog.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/blog.guaranteedstruggle.host/privkey.pem:http://default_backend";
|
|
# # # mail.guaranteedstruggle.host "/etc/angie/ssl/mail.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/mail.guaranteedstruggle.host/privkey.pem:http://default_backend";
|
|
# # # pgadmin.guaranteedstruggle.host "/etc/angie/ssl/pgadmin.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/pgadmin.guaranteedstruggle.host/privkey.pem:http://pgadmin_on_swarm_cluster";
|
|
# # # ceph-dashboard.guaranteedstruggle.host "/etc/angie/ssl/ceph-dashboard.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/ceph-dashboard.guaranteedstruggle.host/privkey.pem:http://192.168.0.71:8080";
|
|
# # # k3s-rancher.guaranteedstruggle.host "/etc/angie/ssl/k3s-rancher.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/k3s-rancher.guaranteedstruggle.host/privkey.pem:https://192.168.0.30";
|
|
# # # wiki.guaranteedstruggle.host "/etc/angie/ssl/wiki.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/wiki.guaranteedstruggle.host/privkey.pem:http://wikijs_on_swarm_cluster";
|
|
# # # # portainer.guaranteedstruggle.host "/etc/angie/ssl/portainer.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/portainer.guaranteedstruggle.host/privkey.pem:https://swarm-node1.guaranteedstruggle.host:9443";
|
|
# # # kroki.guaranteedstruggle.host "/etc/angie/ssl/kroki.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/kroki.guaranteedstruggle.host/privkey.pem:http://swarm-node1.guaranteedstruggle.host:8008";
|
|
# # # guaranteedstruggle.host "/etc/angie/ssl/guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/guaranteedstruggle.host/privkey.pem:http://192.168.0.105";
|
|
# # # default "/etc/angie/ssl/default/fullchain.pem:/etc/angie/ssl/default/privkey.pem:http://default_backend";
|
|
# # # }
|
|
|
|
|
|
# # # # Extract SSL certificate file
|
|
# # # map $http_host $ssl_certificate_file {
|
|
# # # kroki.guaranteedstruggle.host "/etc/angie/ssl/asdf/fullchain.pem"
|
|
# # # default "/etc/angie/ssl/$http_host/fullchain.pem"
|
|
# # # }
|
|
|
|
|
|
# # # # Extract SSL certificate file
|
|
# # # map $host_config $ssl_certificate_file {
|
|
# # # "~^(?<certificate_file>[^:]+):" "$certificate_file";
|
|
# # # default "/etc/angie/ssl/default/fullchain.pem";
|
|
# # # }
|
|
|
|
# # # # Extract SSL certificate key file
|
|
# # # map $host_config $ssl_certificate_key_file {
|
|
# # # "~:[^:]+:(?<key_file>[^:]+)$" "$key_file";
|
|
# # # default "/etc/angie/ssl/default/privkey.pem";
|
|
# # # }
|
|
|
|
# # # # Extract proxy pass URL
|
|
# # # map $host_config $proxy_pass_url {
|
|
# # # "~:[^:]+:[^:]+:(?<proxy_url>.*)$" "$proxy_url";
|
|
# # # default "http://default_backend";
|
|
# # # }
|
|
|
|
|
|
# server {
|
|
# listen 443 ssl http2;
|
|
|
|
# server_name harbor.guaranteedstruggle.host;
|
|
# ssl_certificate /etc/angie/ssl/harbor.guaranteedstruggle.host/cert.pem;
|
|
# ssl_certificate_key /etc/angie/ssl/harbor.guaranteedstruggle.host/key.pem;
|
|
|
|
|
|
# location / {
|
|
# proxy_pass http://localhost:8880;
|
|
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# }
|
|
# }
|
|
|
|
|
|
|
|
|
|
|
|
server {
|
|
listen 80; # http2;
|
|
|
|
server_name mail.guaranteedstruggle.host imap.guaranteedstruggle.host pop3.guaranteedstruggle.host;
|
|
#ssl_certificate /etc/angie/ssl/mail.guaranteedstruggle.host/cert.pem;
|
|
# ssl_certificate_key /etc/angie/ssl/mail.guaranteedstruggle.host/key.pem;
|
|
|
|
location / {
|
|
#proxy_pass http://localhost:8880;
|
|
####proxy_pass http://192.168.0.251:8080;
|
|
proxy_pass http://192.168.0.251:8080;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|
|
server {
|
|
listen 80 default_server;
|
|
#default_server;
|
|
#listen [::]:80 default_server;
|
|
|
|
server_name _;
|
|
return 302 https://$host$request_uri;
|
|
|
|
}
|
|
|
|
|
|
server {
|
|
listen 8080;
|
|
server_name localhost;
|
|
#access_log /var/log/angie/host.access.log main;
|
|
|
|
location / {
|
|
root /usr/share/angie/html;
|
|
index index.html index.htm;
|
|
}
|
|
|
|
location /status/ {
|
|
api /status/;
|
|
allow all;
|
|
deny all;
|
|
}
|
|
|
|
|
|
location /console/ {
|
|
|
|
allow all;
|
|
deny all;
|
|
|
|
auto_redirect on;
|
|
|
|
alias /usr/share/angie-console-light/html/;
|
|
index index.html;
|
|
|
|
|
|
location /console/api/ {
|
|
api /status/;
|
|
}
|
|
|
|
location /console/api/config/ {
|
|
#auth_basic ;
|
|
#auth_basic_user_file conf/htpasswd;
|
|
api /config/;
|
|
}
|
|
}
|
|
|
|
error_page 500 502 503 504 /50x.html;
|
|
location = /50x.html {
|
|
root /usr/share/angie/html;
|
|
}
|
|
|
|
} |