cmc/dotfiles
Using GNU Stow to manage my dotfiles.
clone: git clone https://gitbay.org/cmc/dotfiles.git
7c3385ccef593943a3e6d0838ced4ce584466419
verified · cmc
author: Christian Cleberg <hello@cleberg.net> · 2026-02-16T01:28:22Z
common/gnupg/.gnupg/gpg-agent.conf | 2 + linux/nginx/etc/nginx/conf.d/ao.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/art.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/auth.conf | 42 +++++ linux/nginx/etc/nginx/conf.d/br.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/bt.conf | 46 +++++ linux/nginx/etc/nginx/conf.d/bw.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/cc.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/cleberg.io | 54 ++++++ linux/nginx/etc/nginx/conf.d/cleberg.net.conf | 70 ++++++++ linux/nginx/etc/nginx/conf.d/cv.conf | 37 ++++ linux/nginx/etc/nginx/conf.d/ddns.conf | 44 +++++ linux/nginx/etc/nginx/conf.d/default.conf | 33 ++++ linux/nginx/etc/nginx/conf.d/docker.conf | 44 +++++ linux/nginx/etc/nginx/conf.d/files.conf | 40 +++++ linux/nginx/etc/nginx/conf.d/gh.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/ha.conf | 46 +++++ linux/nginx/etc/nginx/conf.d/hat.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/hn.conf | 27 +++ linux/nginx/etc/nginx/conf.d/img.conf | 37 ++++ linux/nginx/etc/nginx/conf.d/irc.conf | 44 +++++ linux/nginx/etc/nginx/conf.d/ld.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/lemmy.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/lt.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/mz.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/no-ssl.default.conf | 27 +++ linux/nginx/etc/nginx/conf.d/office.conf | 35 ++++ linux/nginx/etc/nginx/conf.d/org.conf | 35 ++++ linux/nginx/etc/nginx/conf.d/paste.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/pb.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/pgp.conf | 37 ++++ linux/nginx/etc/nginx/conf.d/photos.conf | 54 ++++++ linux/nginx/etc/nginx/conf.d/pin.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/piped.conf | 40 +++++ linux/nginx/etc/nginx/conf.d/projects.conf | 36 ++++ linux/nginx/etc/nginx/conf.d/rd.conf | 39 ++++ .../etc/nginx/conf.d/reminiscecleberg.com.conf | 56 ++++++ linux/nginx/etc/nginx/conf.d/rimgo.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/rl.conf | 44 +++++ linux/nginx/etc/nginx/conf.d/rss.conf | 58 ++++++ linux/nginx/etc/nginx/conf.d/search.conf | 44 +++++ linux/nginx/etc/nginx/conf.d/send.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/slash.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/small.conf | 39 ++++ linux/nginx/etc/nginx/conf.d/ssh.conf | 44 +++++ linux/nginx/etc/nginx/conf.d/teddit.conf | 44 +++++ linux/nginx/etc/nginx/conf.d/wyl.conf | 44 +++++ linux/nginx/etc/nginx/custom.d/basic.conf | 8 + .../etc/nginx/custom.d/cross-origin/requests.conf | 18 ++ .../custom.d/cross-origin/resource_timing.conf | 15 ++ .../etc/nginx/custom.d/errors/custom_errors.conf | 9 + .../custom.d/location/security_file_access.conf | 41 +++++ ...b_performance_filename-based_cache_busting.conf | 14 ++ .../location/web_performance_svgz-compression.conf | 18 ++ .../custom.d/media_types/character_encodings.conf | 32 ++++ .../nginx/custom.d/media_types/media_types.conf | 18 ++ .../etc/nginx/custom.d/reverse_proxy/authelia.conf | 28 +++ .../custom.d/reverse_proxy/authelia_request.conf | 10 ++ .../etc/nginx/custom.d/reverse_proxy/basic.conf | 16 ++ .../custom.d/security/content-security-policy.conf | 28 +++ .../custom.d/security/cross-origin-policy.conf | 44 +++++ .../custom.d/security/permissions-policy.conf | 24 +++ .../nginx/custom.d/security/referrer-policy.conf | 25 +++ linux/nginx/etc/nginx/custom.d/security/robots.txt | 3 + .../nginx/custom.d/security/robots_index_only.conf | 4 + .../security/server_software_information.conf | 9 + .../security/strict-transport-security.conf | 38 ++++ .../custom.d/security/x-content-type-options.conf | 17 ++ .../nginx/custom.d/security/x-frame-options.conf | 37 ++++ .../etc/nginx/custom.d/tls/certificate_files.conf | 33 ++++ .../etc/nginx/custom.d/tls/ocsp_stapling.conf | 34 ++++ .../etc/nginx/custom.d/tls/policy_balanced.conf | 20 +++ .../etc/nginx/custom.d/tls/policy_strict.conf | 50 ++++++ linux/nginx/etc/nginx/custom.d/tls/ssl_engine.conf | 47 +++++ .../custom.d/web_performance/cache-control.conf | 43 +++++ .../web_performance/cache-file-descriptors.conf | 34 ++++ .../custom.d/web_performance/cache_expiration.conf | 63 +++++++ .../custom.d/web_performance/compression.conf | 71 ++++++++ .../web_performance/content_transformation.conf | 30 ++++ .../pre-compressed_content_brotli.conf | 17 ++ .../pre-compressed_content_gzip.conf | 13 ++ linux/nginx/etc/nginx/fastcgi_params | 25 +++ linux/nginx/etc/nginx/mime.types | 138 ++++++++++++++ linux/nginx/etc/nginx/nginx.conf | 198 +++++++++++++++++++++ linux/nginx/etc/nginx/scgi_params | 17 ++ linux/nginx/etc/nginx/uwsgi_params | 17 ++ 86 files changed, 3211 insertions(+) new file mode 100644 @@ -0,0 +1,2 @@ +pinentry-program /usr/bin/pinentry-curses +allow-loopback-pinentry new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name ao.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:9380; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name ao.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name art.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:3003; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name art.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,42 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name auth.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + set $upstream http://127.0.0.1:9092; + + location / { + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + location /api/verify { + proxy_pass $upstream; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name auth.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name br.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:3030; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name br.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,46 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name bt.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + set $upstream http://127.0.0.1:9091; + + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + # include custom.d/reverse_proxy/basic.conf; + proxy_pass_header X-bt-Session-Id; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name bt.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name bw.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:10416; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name bw.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name cc.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:8111; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name cc.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,54 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name www.cleberg.io cleberg.io; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/policy_balanced.conf; +# include custom.d/tls/certificate_files.conf; + ssl_certificate /etc/letsencrypt/live/cleberg.io/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/cleberg.io/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem; + + return 301 $scheme://cleberg.io$request_uri; +} + + +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name cleberg.io; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + +# include custom.d/tls/certificate_files.conf; + ssl_certificate /etc/letsencrypt/live/cleberg.io/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/cleberg.io/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + return 301 https://cleberg.net; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name www.cleberg.io cleberg.io; + + return 301 https://cleberg.io$request_uri; +} new file mode 100644 @@ -0,0 +1,70 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name www.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + + return 301 $scheme://cleberg.net$request_uri; +} + + +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + root /var/www/cleberg.net/; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ =404; + } + + # fix: redirect blog & wiki posts from "/" to ".html" + location /blog/ { + rewrite ^/blog/((?!index)[^/]+)/(.*)$ /blog/$1.html permanent; + } + + location /wiki/ { + rewrite ^/wiki/((?!index)[^/]+)/(.*)$ /wiki/$1.html permanent; + } + + # fix: redirect atom.xml to feed.xml + location /atom.xml { + return 301 $scheme://$host/feed.xml; + } + + # fix: redirect salary page + location /blog/salary-transparency.html { + return 301 $scheme://$host/salary/; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name www.cleberg.net cleberg.net; + + return 301 https://cleberg.net$request_uri; +} new file mode 100644 @@ -0,0 +1,37 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name cv.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + root /var/www/cv/; + autoindex on; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ /index.html; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name cv.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name ddns.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + set $upstream http://127.0.0.1:8097; + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name ddns.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,33 @@ +# ---------------------------------------------------------------------- +# | Default behavior for unknown hosts | +# ---------------------------------------------------------------------- +# +# Drop requests for unknown hosts. +# +# If no default server is defined, Nginx will use the first found server. +# To prevent host header attacks, or other potential problems when an unknown +# server name is used in a request, it's recommended to drop the request +# returning 444 "No Response". + +server { + listen [::]:443 ssl default_server; + listen 443 ssl default_server; + http2 on; + + server_name _; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + + return 444; +} + +server { + listen [::]:80; + listen 80; + + server_name _; + + return 444; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name docker.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + set $upstream http://127.0.0.1:3777; + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name docker.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,40 @@ +# ---------------------------------------------------------------------- +# | Config file for files.cleberg.net host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + # The host name to respond to + server_name files.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + root /var/www/files/; + autoindex on; + + # Include the basic custom.d config set + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ /index.html; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure cleberg.net host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name files.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name gh.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://192.168.0.251:3039; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name gh.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,46 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name ha.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + set $upstream http://192.168.0.214:8123; + + location / { + proxy_pass $upstream; + proxy_set_header X-Forwarded-For $remote_addr; + } + + location /api/websocket { + proxy_pass $upstream; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name ha.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name hat.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://192.168.0.251:3991; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name hat.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,27 @@ +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name hn.cleberg.net r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion; + root /var/www/hn/output/; + autoindex on; + add_header Onion-Location http://r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + location / { + try_files $uri $uri/ /index.html; + } +} + +server { + listen [::]:80; + listen 80; + server_name hn.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,37 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name img.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + root /var/www/img/; + autoindex on; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ =404; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name img.cleberg.net; + + return 301 https://img.cleberg.net$request_uri; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name irc.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + set $upstream http://192.168.0.251:9900; + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name irc.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name ld.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:3004; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name ld.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name lemmy.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:10633; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name lemmy.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name lt.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:5000; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name lt.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name mz.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:3474; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name mz.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,27 @@ +# ---------------------------------------------------------------------- +# | Default behavior for unknown hosts | +# ---------------------------------------------------------------------- +# +# Drop requests for unknown hosts. +# +# If no default server is defined, Nginx will use the first found server. +# To prevent host header attacks, or other potential problems when an unknown +# server name is used in a request, it's recommended to drop the request +# returning 444 "No Response". +# +# (1) In production, only secure hosts should be used (all `no-ssl` disabled). +# If so, redirect first ANY request to a secure connection before handling +# it, even if the host is unknown. +# +# https://observatory.mozilla.org/faq/ + +server { + listen [::]:80 default_server deferred; + listen 80 default_server deferred; + + server_name _; + + # (1) + return 301 https://$host$request_uri; + # return 444; +} new file mode 100644 @@ -0,0 +1,35 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name office.cleberg.net; + root /var/www/office/; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ /index.html; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name office.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,35 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name org.cleberg.net; + root /var/www/org/; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ /index.html; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name org.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name paste.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:8084; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name paste.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name pb.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:8745; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + # include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name pb.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,37 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name pgp.cleberg.net; + root /var/www/pgp/; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ /index.html; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name pgp.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,54 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name photos.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + # allow large file uploads + client_max_body_size 50000M; + + # Set headers + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # enable websockets: http://nginx.org/en/docs/http/websocket.html + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_redirect off; + + # set timeout + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + + location / { + proxy_pass http://127.0.0.1:2283; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name photos.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name pin.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:8086; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name pin.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,40 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name piped.cleberg.net pipedapi.cleberg.net pipedproxy.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:8077; + proxy_pass $upstream; + + proxy_set_header Host $host; + # include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name piped.cleberg.net pipedapi.cleberg.net pipedproxy.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,36 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name projects.cleberg.net; + root /var/www/projects/; + autoindex on; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ /index.html; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name projects.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name rd.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:5758; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name rd.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,56 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name www.reminiscecleberg.com; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/policy_balanced.conf; + # include custom.d/tls/certificate_files.conf; + ssl_certificate /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem; + + return 301 $scheme://reminiscecleberg.com$request_uri; +} + + +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name reminiscecleberg.com; + root /var/www/reminiscecleberg.com/; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + # include custom.d/tls/certificate_files.conf; + ssl_certificate /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + try_files $uri $uri/ =404; + } + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name www.reminiscecleberg.com reminiscecleberg.com; + + return 301 https://reminiscecleberg.com$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name rimgo.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:3869; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name rimgo.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name rl.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + set $upstream http://192.168.0.251:8983; + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name rl.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,58 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +upstream freshrss { + server 192.168.0.251:8081; + keepalive 64; +} + +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name rss.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + proxy_pass http://freshrss/; + + # include custom.d/reverse_proxy/basic.conf; + + add_header X-Frame-Options SAMEORIGIN; + add_header X-XSS-Protection "1; mode=block"; + proxy_redirect off; + proxy_buffering off; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Port $server_port; + proxy_read_timeout 90; + + # Forward the Authorization header for the Google Reader API. + proxy_set_header Authorization $http_authorization; + proxy_pass_header Authorization; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name rss.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name search.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:9191; + proxy_pass $upstream; + + # include custom.d/reverse_proxy/basic.conf; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_http_version 1.1; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name search.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name send.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:1443; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name send.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name slash.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://192.168.0.251:5231; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name slash.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,39 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name small.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location / { + set $upstream http://127.0.0.1:8002; + proxy_pass $upstream; + + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name small.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name ssh.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + set $upstream http://127.0.0.1:8169; + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name ssh.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name teddit.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + set $upstream http://192.168.0.251:8181; + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name teddit.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Config file for host | +# ---------------------------------------------------------------------- +server { + listen [::]:443 ssl; + listen 443 ssl; + http2 on; + + server_name wyl.cleberg.net; + + include custom.d/tls/ssl_engine.conf; + include custom.d/tls/certificate_files.conf; + include custom.d/tls/policy_balanced.conf; + include custom.d/basic.conf; + + # ---------------------------------------------------------------------- + # | Custom rules & config for specific website | + # ---------------------------------------------------------------------- + location /authelia { + include custom.d/reverse_proxy/authelia.conf; + } + + location / { + set $upstream http://192.168.0.251:8840; + proxy_pass $upstream; + + include custom.d/reverse_proxy/authelia_request.conf; + include custom.d/reverse_proxy/basic.conf; + } + + include custom.d/security/robots_index_only.conf; + # ---------------------------------------------------------------------- +} + +# ---------------------------------------------------------------------- +# | Config file for non-secure host | +# ---------------------------------------------------------------------- +server { + listen [::]:80; + listen 80; + server_name wyl.cleberg.net; + + return 301 https://$host$request_uri; +} new file mode 100644 @@ -0,0 +1,8 @@ +# Nginx Server Configs | MIT License +# https://github.com/h5bp/server-configs-nginx + +include custom.d/security/referrer-policy.conf; +include custom.d/security/x-content-type-options.conf; +include custom.d/security/x-frame-options.conf; +include custom.d/location/security_file_access.conf; +#include custom.d/cross-origin/requests.conf; new file mode 100644 @@ -0,0 +1,18 @@ +# ---------------------------------------------------------------------- +# | Cross-origin requests | +# ---------------------------------------------------------------------- + +# Allow cross-origin requests. +# +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS +# https://enable-cors.org/ +# https://www.w3.org/TR/cors/ + +# (!) Do not use this without understanding the consequences. +# This will permit access from any other website. +# Instead of using this file, consider using a specific rule such as +# allowing access based on (sub)domain: +# +# add_header Access-Control-Allow-Origin "subdomain.example.com"; + +# add_header Access-Control-Allow-Origin $cors; new file mode 100644 @@ -0,0 +1,15 @@ +# ---------------------------------------------------------------------- +# | Cross-origin resource timing | +# ---------------------------------------------------------------------- + +# Allow cross-origin access to the timing information for all resources. +# +# If a resource isn't served with a `Timing-Allow-Origin` header that would +# allow its timing information to be shared with the document, some of the +# attributes of the `PerformanceResourceTiming` object will be set to zero. +# +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Timing-Allow-Origin +# https://www.w3.org/TR/resource-timing/ +# https://www.stevesouders.com/blog/2014/08/21/resource-timing-practical-tips/ + +# add_header Timing-Allow-Origin "*"; new file mode 100644 @@ -0,0 +1,9 @@ +# ---------------------------------------------------------------------- +# | Custom error messages/pages | +# ---------------------------------------------------------------------- + +# Customize what Nginx returns to the client in case of an error. +# +# https://nginx.org/en/docs/http/ngx_http_core_module.html#error_page + +# error_page 404 /404.html; new file mode 100644 @@ -0,0 +1,41 @@ +# ---------------------------------------------------------------------- +# | File access | +# ---------------------------------------------------------------------- + +# Block access to all hidden files and directories except for the +# visible content from within the `/.well-known/` hidden directory. +# +# These types of files usually contain user preferences or the preserved state +# of a utility, and can include rather private places like, for example, the +# `.git` or `.svn` directories. +# +# The `/.well-known/` directory represents the standard (RFC 5785) path prefix +# for "well-known locations" (e.g.: `/.well-known/manifest.json`, +# `/.well-known/keybase.txt`), and therefore, access to its visible content +# should not be blocked. +# +# https://www.mnot.net/blog/2010/04/07/well-known +# https://tools.ietf.org/html/rfc5785 + +location ~* /\.(?!well-known\/) { + deny all; +} + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Block access to files that can expose sensitive information. +# +# By default, block access to backup and source files that may be left by some +# text editors and can pose a security risk when anyone has access to them. +# +# https://feross.org/cmsploit/ +# +# (!) Update the `location` regular expression from below to include any files +# that might end up on your production server and can expose sensitive +# information about your website. These files may include: configuration +# files, files that contain metadata about the project (e.g.: project +# dependencies, build scripts, etc.). + +location ~* (?:#.*#|\.(?:bak|conf|dist|fla|in[ci]|log|orig|psd|sh|sql|sw[op])|~)$ { + deny all; +} new file mode 100644 @@ -0,0 +1,14 @@ +# ---------------------------------------------------------------------- +# | Filename-based cache busting | +# ---------------------------------------------------------------------- + +# If you're not using a build process to manage your filename version revving, +# you might want to consider enabling the following directives. +# +# To understand why this is important and even a better solution than using +# something like `*.css?v231`, please see: +# https://www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/ + +location ~* (.+)\.(?:\w+)\.(avifs?|bmp|css|cur|gif|ico|jpe?g|jxl|m?js|a?png|svgz?|webp|webmanifest)$ { + try_files $uri $1.$2; +} new file mode 100644 @@ -0,0 +1,18 @@ +# ---------------------------------------------------------------------- +# | SVGZ Compression | +# ---------------------------------------------------------------------- + +# SVGZ files are already compressed. +# Disable gzip function for `.svgz` files. + +location ~* \.svgz$ { + gzip off; + add_header Content-Encoding gzip; + + include custom.d/security/x-content-type-options.conf; + include custom.d/security/content-security-policy.conf; + include custom.d/security/referrer-policy.conf; + include custom.d/security/permissions-policy.conf; + include custom.d/security/cross-origin-policy.conf; + include custom.d/cross-origin/requests.conf; +} new file mode 100644 @@ -0,0 +1,32 @@ +# ---------------------------------------------------------------------- +# | Character encodings | +# ---------------------------------------------------------------------- + +# Serve all resources labeled as `text/html` or `text/plain` with the media type +# `charset` parameter set to `UTF-8`. +# +# https://nginx.org/en/docs/http/ngx_http_charset_module.html#charset + +charset utf-8; + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Update charset_types to match updated mime.types. +# `text/html` is always included by charset module. +# Default: text/html text/xml text/plain text/vnd.wap.wml application/javascript application/rss+xml +# +# https://nginx.org/en/docs/http/ngx_http_charset_module.html#charset_types + +charset_types + text/css + text/plain + text/vnd.wap.wml + text/javascript + text/markdown + text/calendar + text/x-component + text/vcard + text/cache-manifest + text/vtt + application/json + application/manifest+json; new file mode 100644 @@ -0,0 +1,18 @@ +# ---------------------------------------------------------------------- +# | Media types | +# ---------------------------------------------------------------------- + +# Serve resources with the proper media types (f.k.a. MIME types). +# +# https://www.iana.org/assignments/media-types/media-types.xhtml +# https://nginx.org/en/docs/http/ngx_http_core_module.html#types + +include mime.types; + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +# Default: text/plain +# +# https://nginx.org/en/docs/http/ngx_http_core_module.html#default_type + +default_type application/octet-stream; new file mode 100644 @@ -0,0 +1,28 @@ +internal; +set $upstream_authelia http://127.0.0.1:9092/api/verify; #change the IP and Port to match the IP and Port of your Authelia container +proxy_pass_request_body off; +proxy_pass $upstream_authelia; +proxy_set_header Content-Length ""; + +# Timeout if the real server is dead +proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; +client_body_buffer_size 128k; +proxy_set_header Host $host; +proxy_set_header X-Original-URL $scheme://$http_host$request_uri; +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $remote_addr; +proxy_set_header X-Forwarded-Proto $scheme; +proxy_set_header X-Forwarded-Host $http_host; +proxy_set_header X-Forwarded-Uri $request_uri; +proxy_set_header X-Forwarded-Ssl on; +proxy_redirect http:// $scheme://; +proxy_http_version 1.1; +proxy_set_header Connection ""; +proxy_cache_bypass $cookie_session; +proxy_no_cache $cookie_session; +proxy_buffers 4 32k; + +send_timeout 5m; +proxy_read_timeout 240; +proxy_send_timeout 240; +proxy_connect_timeout 240; new file mode 100644 @@ -0,0 +1,10 @@ +auth_request /authelia; +auth_request_set $target_url https://$http_host$request_uri; +auth_request_set $user $upstream_http_remote_user; +auth_request_set $email $upstream_http_remote_email; +auth_request_set $groups $upstream_http_remote_groups; +proxy_set_header Remote-User $user; +proxy_set_header Remote-Email $email; +proxy_set_header Remote-Groups $groups; + +error_page 401 =302 https://auth.cleberg.net/?rd=$target_url; new file mode 100644 @@ -0,0 +1,16 @@ +proxy_set_header Host $host; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header Connection upgrade; +proxy_set_header Accept-Encoding gzip; +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Proto $scheme; +proxy_set_header X-Forwarded-Host $http_host; +proxy_set_header X-Forwarded-Uri $request_uri; +proxy_set_header X-Forwarded-Ssl on; +proxy_redirect http:// $scheme://; +proxy_http_version 1.1; +proxy_set_header Connection ""; +proxy_cache_bypass $cookie_session; +proxy_no_cache $cookie_session; +proxy_buffers 64 256k; new file mode 100644 @@ -0,0 +1,28 @@ +# ---------------------------------------------------------------------- +# | Content Security Policy (CSP) | +# ---------------------------------------------------------------------- + +# Mitigate the risk of cross-site scripting and other content-injection +# attacks. +# +# This can be done by setting a Content Security Policy which permits +# trusted sources of content for your website. +# +# There is no policy that fits all websites, you will have to modify the +# `Content-Security-Policy` directives in the example depending on your needs. +# +# To make your CSP implementation easier, you can use an online CSP header +# generator such as: +# https://report-uri.com/home/generate/ +# +# It is encouraged that you validate your CSP header using a CSP validator +# such as: +# https://csp-evaluator.withgoogle.com +# +# https://www.w3.org/TR/CSP/ +# https://owasp.org/www-project-secure-headers/#content-security-policy +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy +# https://developers.google.com/web/fundamentals/security/csp +# https://content-security-policy.com/ + +add_header Content-Security-Policy $content_security_policy always; new file mode 100644 @@ -0,0 +1,44 @@ +# ---------------------------------------------------------------------- +# | Cross Origin Policy | +# ---------------------------------------------------------------------- + +# Set strict a Cross Origin Policy to mitigate information leakage. +# +# (1) Cross-Origin-Embedder-Policy prevents a document from loading any +# cross-origin resources that don’t explicitly grant the document +# permission. +# https://html.spec.whatwg.org/multipage/origin.html#coep +# https://owasp.org/www-project-secure-headers/#cross-origin-embedder-policy +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy +# +# (2) Cross-Origin-Opener-Policy allows you to ensure a top-level document does +# not share a browsing context group with cross-origin documents. +# https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policies +# https://owasp.org/www-project-secure-headers/#cross-origin-opener-policy +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy +# +# (3) Cross-Origin-Resource-Policy allows to define a policy that lets web +# sites and applications opt in to protection against certain requests from +# other origins, to mitigate speculative side-channel attacks. +# https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header +# https://owasp.org/www-project-secure-headers/#cross-origin-resource-policy +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy +# https://resourcepolicy.fyi/ +# +# To check your Cross Origin Policy, you can use an online service, such as: +# https://securityheaders.com/ +# https://observatory.mozilla.org/ +# +# https://web.dev/coop-coep/ +# https://web.dev/why-coop-coep/ +# https://web.dev/cross-origin-isolation-guide/ +# https://scotthelme.co.uk/coop-and-coep/ + +# (1) +add_header Cross-Origin-Embedder-Policy $coep_policy always; + +# (2) +add_header Cross-Origin-Opener-Policy $coop_policy always; + +# (3) +add_header Cross-Origin-Resource-Policy $corp_policy always; new file mode 100644 @@ -0,0 +1,24 @@ +# ---------------------------------------------------------------------- +# | Permissions Policy | +# ---------------------------------------------------------------------- + +# Set a strict Permissions Policy to mitigate access to browser features. +# +# The header uses a structured syntax, and allows sites to more tightly +# restrict which origins can be granted access to features. +# The list of available features: +# https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md +# +# The example policy below aims to disable all features expect synchronous +# `XMLHttpRequest` requests on the same origin. +# +# To check your Permissions Policy, you can use an online service, such as: +# https://securityheaders.com/ +# https://observatory.mozilla.org/ +# +# https://www.w3.org/TR/permissions-policy-1/ +# https://owasp.org/www-project-secure-headers/#permissions-policy +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy +# https://scotthelme.co.uk/a-new-security-header-feature-policy/ + +add_header Permissions-Policy $permissions_policy always; new file mode 100644 @@ -0,0 +1,25 @@ +# ---------------------------------------------------------------------- +# | Referrer Policy | +# ---------------------------------------------------------------------- + +# Set a strict Referrer Policy to mitigate information leakage. +# +# (1) The `Referrer-Policy` header is included in responses for resources +# that are able to request (or navigate to) other resources. +# +# This includes the commonly used resource types: +# HTML, CSS, XML/SVG, PDF documents, scripts and workers. +# +# To prevent referrer leakage entirely, specify the `no-referrer` value +# instead. Note that the effect could impact analytics metrics negatively. +# +# To check your Referrer Policy, you can use an online service, such as: +# https://securityheaders.com/ +# https://observatory.mozilla.org/ +# +# https://www.w3.org/TR/referrer-policy/ +# https://owasp.org/www-project-secure-headers/#referrer-policy +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy +# https://scotthelme.co.uk/a-new-security-header-referrer-policy/ + +add_header Referrer-Policy $referrer_policy always; new file mode 100644 @@ -0,0 +1,3 @@ +User-agent: * +Disallow: / +Allow: /$ new file mode 100644 @@ -0,0 +1,4 @@ +location = /robots.txt { + default_type text/plain; + alias /etc/nginx/custom.d/security/robots.txt; +} new file mode 100644 @@ -0,0 +1,9 @@ +# ---------------------------------------------------------------------- +# | Server software information | +# ---------------------------------------------------------------------- + +# Prevent Nginx from sending its version number in the "Server" response header. +# +# https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens + +server_tokens off; new file mode 100644 @@ -0,0 +1,38 @@ +# ---------------------------------------------------------------------- +# | HTTP Strict Transport Security (HSTS) | +# ---------------------------------------------------------------------- + +# Force client-side TLS (Transport Layer Security) redirection. +# +# If a user types `example.com` in their browser, even if the server redirects +# them to the secure version of the website, that still leaves a window of +# opportunity (the initial HTTP connection) for an attacker to downgrade or +# redirect the request. +# +# The following header ensures that a browser only connects to your server +# via HTTPS, regardless of what the users type in the browser's address bar. +# +# (!) Be aware that Strict Transport Security is not revokable and you +# must ensure being able to serve the site over HTTPS for the duration +# you've specified in the `max-age` directive. When you don't have a +# valid TLS connection anymore (e.g. due to an expired TLS certificate) +# your visitors will see a nasty error message even when attempting to +# connect over HTTP. +# +# (1) Preloading Strict Transport Security. +# To submit your site for HSTS preloading, it is required that: +# * the `includeSubDomains` directive is specified +# * the `preload` directive is specified +# * the `max-age` is specified with a value of at least 31536000 seconds +# (1 year). +# https://hstspreload.org/#deployment-recommendations +# +# https://tools.ietf.org/html/rfc6797#section-6.1 +# https://owasp.org/www-project-secure-headers/#http-strict-transport-security +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security +# https://www.html5rocks.com/en/tutorials/security/transport-layer-security/ +# https://hstspreload.org/ + +# add_header Strict-Transport-Security "max-age=16070400; includeSubDomains" always; +# (1) Enable your site for HSTS preload inclusion. +add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; new file mode 100644 @@ -0,0 +1,17 @@ +# ---------------------------------------------------------------------- +# | Content Type Options | +# ---------------------------------------------------------------------- + +# Prevent some browsers from MIME-sniffing the response. +# +# This reduces exposure to drive-by download attacks and cross-origin data +# leaks, and should be left uncommented, especially if the server is serving +# user-uploaded content or content that could potentially be treated as +# executable by the browser. +# +# https://owasp.org/www-project-secure-headers/#x-content-type-options +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options +# https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/ +# https://mimesniff.spec.whatwg.org/ + +add_header X-Content-Type-Options nosniff always; new file mode 100644 @@ -0,0 +1,37 @@ +# ---------------------------------------------------------------------- +# | Frame Options | +# ---------------------------------------------------------------------- + +# Protect website against clickjacking. +# +# The example below sends the `X-Frame-Options` response header with the value +# `DENY`, informing browsers not to display the content of the web page in any +# frame. +# +# This might not be the best setting for everyone. You should read about the +# other two possible values the `X-Frame-Options` header field can have: +# `SAMEORIGIN` and `ALLOW-FROM`. +# https://tools.ietf.org/html/rfc7034#section-2.1. +# +# Keep in mind that while you could send the `X-Frame-Options` header for all +# of your website's pages, this has the potential downside that it forbids even +# non-malicious framing of your content. +# +# Nonetheless, you should ensure that you send the `X-Frame-Options` header for +# all pages that allow a user to make a state-changing operation (e.g: pages +# that contain one-click purchase links, checkout or bank-transfer confirmation +# pages, pages that make permanent configuration changes, etc.). +# +# Sending the `X-Frame-Options` header can also protect your website against +# more than just clickjacking attacks. +# https://cure53.de/xfo-clickjacking.pdf. +# +# (!) The `Content-Security-Policy` header has a `frame-ancestors` directive +# which obsoletes this header for supporting browsers. +# +# https://tools.ietf.org/html/rfc7034 +# https://owasp.org/www-project-secure-headers/#x-frame-options +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options +# https://docs.microsoft.com/archive/blogs/ieinternals/combating-clickjacking-with-x-frame-options + +add_header X-Frame-Options $x_frame_options always; new file mode 100644 @@ -0,0 +1,33 @@ +# ---------------------------------------------------------------------- +# | Certificate files | +# ---------------------------------------------------------------------- + +# This default SSL certificate will be served whenever the client lacks support +# for SNI (Server Name Indication). +# +# (1) Certificate and key files location +# The certificate file can contain an intermediate certificate. +# +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate +# +# (2) Intermediate certificate location if loaded certificate (1) does not +# contain intermediate certificate when enabling OCSP stapling. +# +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate +# +# (3) CA certificate file location for client certificate authentication. +# +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate + +# (1) +# ssl_certificate /etc/nginx/certs/default.crt; +# ssl_certificate_key /etc/nginx/certs/default.key; +ssl_certificate /etc/letsencrypt/live/cleberg.net/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/cleberg.net/privkey.pem; + +# (2) +# ssl_trusted_certificate /path/to/ca.crt; +ssl_trusted_certificate /etc/letsencrypt/live/cleberg.net/chain.pem; + +# (3) +# ssl_client_certificate /etc/nginx/default_ssl.crt; new file mode 100644 @@ -0,0 +1,34 @@ +# ---------------------------------------------------------------------- +# | Online Certificate Status Protocol stapling | +# ---------------------------------------------------------------------- + +# OCSP is a lightweight, only one record to help clients verify the validity of +# the server certificate. +# OCSP stapling allows the server to send its cached OCSP record during the TLS +# handshake, without the need of 3rd party OCSP responder. +# +# https://wiki.mozilla.org/Security/Server_Side_TLS#OCSP_Stapling +# https://tools.ietf.org/html/rfc6066#section-8 +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling +# +# (1) Use Cloudflare 1.1.1.1 DNS resolver +# https://developers.cloudflare.com/1.1.1.1/setting-up-1.1.1.1/ +# +# (2) Use Google 8.8.8.8 DNS resolver +# https://developers.google.com/speed/public-dns/docs/using +# +# (3) Use OpenDNS resolver +# https://use.opendns.com + +ssl_stapling on; +ssl_stapling_verify on; + +resolver + # (1) + 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001] + # (2) + 8.8.8.8 8.8.4.4 [2001:4860:4860::8888] [2001:4860:4860::8844] + # (3) + # 208.67.222.222 208.67.220.220 [2620:119:35::35] [2620:119:53::53] + valid=60s; +resolver_timeout 2s; new file mode 100644 @@ -0,0 +1,20 @@ +# ---------------------------------------------------------------------- +# | SSL policy - Balanced | +# ---------------------------------------------------------------------- + +# For services that need to support a wide range of clients, this configuration +# is reasonably balanced. +# +# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak +# and potentially vulnerable but are required to support Microsoft Edge +# and Safari. +# https://safecurves.cr.yp.to/ +# +# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html + +ssl_protocols TLSv1.2; +ssl_ciphers EECDH+CHACHA20:EECDH+AES; + +# (1) +ssl_ecdh_curve X25519:prime256v1:secp521r1:secp384r1; new file mode 100644 @@ -0,0 +1,50 @@ +# ---------------------------------------------------------------------- +# | SSL policy - Strict | +# ---------------------------------------------------------------------- + +# For services that don't need backward compatibility, the parameters below +# provide the highest level of security and performance. +# +# (!) This policy enforces a strong TLS configuration, which may raise +# errors with old clients. +# If a more compatible profile is required, use the "balanced" policy. +# +# (!) TLSv1.3 and its 0-RTT feature require NGINX >=1.15.4 and OpenSSL >=1.1.1 +# to be installed. +# +# (!) Don't enable `ssl_early_data` blindly! Requests sent within early data are +# subject to replay attacks. +# +# (1) The NIST curves (prime256v1, secp384r1, secp521r1) are known to be weak +# and potentially vulnerable. +# +# Add them back to the parameter `ssl_ecdh_curve` below to support +# Microsoft Edge and Safari. +# +# https://safecurves.cr.yp.to/ +# +# (2) Enables TLS 1.3 0-RTT, allows for faster resumption of TLS sessions. +# +# (!) Requests sent within early data are subject to replay attacks. +# To protect against such attacks at the application layer, the +# `$ssl_early_data` variable should be used: +# +# proxy_set_header Early-Data $ssl_early_data; +# +# The application should return response code 425 "Too Early" for anything +# that could contain user supplied data. +# +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/425 +# +# https://github.com/certbot/certbot/issues/6367 +# https://github.com/mozilla/server-side-tls/issues/217 +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html + +ssl_protocols TLSv1.2 TLSv1.3; +ssl_ciphers EECDH+CHACHA20:EECDH+AES; + +# (1) +ssl_ecdh_curve X25519; + +# (2) +#ssl_early_data on; new file mode 100644 @@ -0,0 +1,47 @@ +# ---------------------------------------------------------------------- +# | SSL engine | +# ---------------------------------------------------------------------- + +# (1) Optimize SSL by caching session parameters for 24 hours. +# This cuts down on the number of expensive SSL handshakes. +# By enabling a cache, we tell the client to re-use the already +# negotiated state. +# Here 10m (10 MB) in ssl_session_cache is size value (not time). +# 1 MB cache can store about 4000 sessions, so we can store 40000 sessions. +# +# (2) Use a higher keepalive timeout to reduce the need for repeated handshakes +# (!) Shouldn't be done unless you serve primarily HTTPS. +# Default is 75s +# +# (3) SSL buffer size +# Set 1400 bytes to fit in one MTU. +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size +# +# (4) Disable session tickets +# Session tickets keys are not auto-rotated. Only a HUP / restart will do +# so and when a restart is performed the previous key is lost, which resets +# all previous sessions. +# Only enable session tickets if you set up a manual rotation mechanism. +# https://trac.nginx.org/nginx/changeset/1356a3b9692441e163b4e78be4e9f5a46c7479e9/nginx +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets +# +# (5) The TLS 1.2 and 1.3 ciphers in use in current policies are not considered +# dangerous. This directive let the client choose the one that best fits their needs. +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_prefer_server_ciphers +# https://wiki.mozilla.org/Security/Server_Side_TLS + +# (1) +ssl_session_timeout 24h; +ssl_session_cache shared:SSL:10m; + +# (2) +keepalive_timeout 300s; + +# (3) +# ssl_buffer_size 1400; + +# (4) +ssl_session_tickets off; + +# (5) +ssl_prefer_server_ciphers off; new file mode 100644 @@ -0,0 +1,43 @@ +# ---------------------------------------------------------------------- +# | Cache Control | +# ---------------------------------------------------------------------- + +# Serve resources with appropriate cache control directives. +# +# The `Cache-Control` header field holds directives (instructions) that control +# caching in browsers and shared caches (e.g. Proxies, CDNs). +# Its use targets web performances improvement by specifying the expected +# client and network caches behaviors. +# +# The usable cache directives are listed here: +# https://www.iana.org/assignments/http-cache-directives/http-cache-directives.xml +# +# The cache directives are documented here: +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#response_directives +# +# (!) Enable and configure this configuration with care. +# Default values should embrace conformance for static files and simple +# apps, but cache control definition at backend level is highly preferred. +# Incorrect directives can lead to data leaks, or can degrade performances. +# +# More specifically, in-depth understanding on `public` vs `private` +# directives meanings is highly recommended. A resource with `public` will +# be cached by shared caches like CDN, even if a user session is active. +# +# (*) To avoid duplication of the directive `no-cache` on `Cache-Control`, +# the value is skipped here. +# The directive `no-cache` is already defined by Nginx `expires` when set +# to `epoch`. This ensure a correct value enforcement whenever cache +# control configuration is used or not. +# Cache expiration configuration `expires` is described in the file +# custom.d/web_performance/cache_expiration.conf. +# https://nginx.org/en/docs/http/ngx_http_headers_module.html#expires +# +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control +# https://www.rfc-editor.org/rfc/rfc9111.html +# https://www.rfc-editor.org/rfc/rfc8246.html +# https://www.rfc-editor.org/rfc/rfc5861.html +# https://www.iana.org/assignments/http-cache-directives/http-cache-directives.xml +# https://cache-tests.fyi/ + +add_header Cache-Control $cache_control; new file mode 100644 @@ -0,0 +1,34 @@ +# ---------------------------------------------------------------------- +# | Cache file-descriptors | +# ---------------------------------------------------------------------- + +# This tells Nginx to cache open file handles, "Not Found" errors and +# metadata about files and their permissions. +# +# Based on these cached metadata, Nginx can immediately begin sending data when +# a popular file is requested, and will also know to immediately send a 404 if a +# file is missing on disk, and so on. +# +# (!) It also means that the server won't react immediately to changes on disk, +# which may be undesirable. +# As only metadata are cached, edited files may be truncated until the cache +# is refreshed. +# https://github.com/h5bp/server-configs-nginx/issues/203 +# +# In the below configuration, inactive files are released from the cache after +# 20 seconds, whereas active (recently requested) files are re-validated every +# 30 seconds. +# Descriptors will not be cached unless they are used at least 2 times within +# 20 seconds (the inactive time). +# A maximum of the 1000 most recently used file descriptors can be cached at +# any time. +# +# Production servers with stable file collections will definitely want to enable +# the cache. +# +# https://nginx.org/en/docs/http/ngx_http_core_module.html#open_file_cache + +open_file_cache max=1000 inactive=20s; +open_file_cache_valid 30s; +open_file_cache_min_uses 2; +open_file_cache_errors on; new file mode 100644 @@ -0,0 +1,63 @@ +# ---------------------------------------------------------------------- +# | Cache expiration | +# ---------------------------------------------------------------------- + +# Serve resources with a far-future expiration date. +# +# (!) If you don't control versioning with filename-based cache busting, you +# should consider lowering the cache times to something like one week. +# +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expires +# https://nginx.org/en/docs/http/ngx_http_headers_module.html#expires + +map $sent_http_content_type $expires { + # Default: Fallback + default 1y; + + # Default: No content + "" off; + + # Specific: Assets + ~*image/svg\+xml 1y; + ~*image/vnd.microsoft.icon 1w; + ~*image/x-icon 1w; + + # Specific: Manifests + ~*application/manifest\+json 1w; + ~*text/cache-manifest epoch; + + # Specific: Data interchange + ~*application/atom\+xml 1h; + ~*application/rdf\+xml 1h; + ~*application/rss\+xml 1h; + + # Specific: Documents + ~*text/html epoch; + ~*text/markdown epoch; + ~*text/calendar epoch; + + # Specific: Other + ~*text/x-cross-domain-policy 1w; + + # Generic: Data + ~*json epoch; + ~*xml epoch; + + # Generic: WebAssembly + # ~*application/wasm 1y; # default + + # Generic: Assets + # ~*application/javascript 1y; # default + # ~*application/x-javascript 1y; # default + # ~*text/javascript 1y; # default + # ~*text/css 1y; # default + + # Generic: Medias + # ~*audio/ 1y; # default + # ~*image/ 1y; # default + # ~*video/ 1y; # default + # ~*font/ 1y; # default +} + +expires $expires; new file mode 100644 @@ -0,0 +1,71 @@ +# ---------------------------------------------------------------------- +# | Compression | +# ---------------------------------------------------------------------- + +# https://nginx.org/en/docs/http/ngx_http_gzip_module.html + +# Enable gzip compression. +# Default: off +gzip on; + +# Compression level (1-9). +# 5 is a perfect compromise between size and CPU usage, offering about 75% +# reduction for most ASCII files (almost identical to level 9). +# Default: 1 +gzip_comp_level 5; + +# Don't compress anything that's already small and unlikely to shrink much if at +# all (the default is 20 bytes, which is bad as that usually leads to larger +# files after gzipping). +# Default: 20 +gzip_min_length 256; + +# Compress data even for clients that are connecting to us via proxies, +# identified by the "Via" header (required for CloudFront). +# Default: off +gzip_proxied any; + +# Tell proxies to cache both the gzipped and regular version of a resource +# whenever the client's Accept-Encoding capabilities header varies; +# Avoids the issue where a non-gzip capable client (which is extremely rare +# today) would display gibberish if their proxy gave them the gzipped version. +# Default: off +gzip_vary on; + +# Compress all output labeled with one of the following MIME-types. +# `text/html` is always compressed by gzip module. +# Default: text/html +gzip_types + application/atom+xml + application/geo+json + application/javascript + application/x-javascript + application/json + application/ld+json + application/manifest+json + application/rdf+xml + application/rss+xml + application/vnd.ms-fontobject + application/wasm + application/x-web-app-manifest+json + application/xhtml+xml + application/xml + font/eot + font/otf + font/ttf + image/bmp + image/svg+xml + image/vnd.microsoft.icon + image/x-icon + text/cache-manifest + text/calendar + text/css + text/javascript + text/markdown + text/plain + text/xml + text/vcard + text/vnd.rim.location.xloc + text/vtt + text/x-component + text/x-cross-domain-policy; new file mode 100644 @@ -0,0 +1,30 @@ +# ---------------------------------------------------------------------- +# | Content transformation | +# ---------------------------------------------------------------------- + +# Prevent intermediate caches or proxies (such as those used by mobile +# network providers) and browsers data-saving features from modifying +# the website's content using the `no-transform` directive for +# `Cache-Control` header. +# +# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control +# https://tools.ietf.org/html/rfc7234#section-5.2.2.4 +# +# (!) Carefully consider the impact on your visitors before disabling +# content transformation. These transformations are performed to +# improve the experience for data- and cost-constrained users +# (e.g. users on a 2G connection). +# +# You can test the effects of content transformation applied by +# Google's Lite Mode by visiting: https://googleweblight.com/i?u=https://www.example.com +# +# https://support.google.com/webmasters/answer/6211428 +# +# (!) If you are using `ngx_pagespeed`, note that disabling this will +# prevent `PageSpeed` from rewriting HTML files, and, if the +# `pagespeed DisableRewriteOnNoTransform` directive isn't set to +# `off`, also from rewriting other resources. +# +# https://developers.google.com/speed/pagespeed/module/configuration#notransform + +add_header Cache-Control "no-transform"; new file mode 100644 @@ -0,0 +1,17 @@ +# ---------------------------------------------------------------------- +# | Brotli pre-compressed content | +# ---------------------------------------------------------------------- + +# Serve brotli compressed CSS, JS, HTML, SVG, ICS and JSON files if they exist +# and if the client accepts br encoding. +# +# (!) To make this part relevant, you need to generate encoded files by your +# own. Enabling this part will not auto-generate brotlied files. +# +# Note that some clients (e.g. browsers) require a secure connection to request +# brotli-compressed resources. +# https://www.chromestatus.com/feature/5420797577396224 +# +# https://github.com/eustas/ngx_brotli/#brotli_static + +brotli_static on; new file mode 100644 @@ -0,0 +1,13 @@ +# ---------------------------------------------------------------------- +# | GZip pre-compressed content | +# ---------------------------------------------------------------------- + +# Serve gzip compressed CSS, JS, HTML, SVG, ICS, and JSON files if they exist +# and if the client accepts gzip encoding. +# +# (!) To make this part relevant, you need to generate encoded files by your +# own. Enabling this part will not auto-generate gziped files. +# +# https://nginx.org/en/docs/http/ngx_http_gzip_static_module.html + +gzip_static on; new file mode 100644 @@ -0,0 +1,25 @@ + +fastcgi_param QUERY_STRING $query_string; +fastcgi_param REQUEST_METHOD $request_method; +fastcgi_param CONTENT_TYPE $content_type; +fastcgi_param CONTENT_LENGTH $content_length; + +fastcgi_param SCRIPT_NAME $fastcgi_script_name; +fastcgi_param REQUEST_URI $request_uri; +fastcgi_param DOCUMENT_URI $document_uri; +fastcgi_param DOCUMENT_ROOT $document_root; +fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_param REQUEST_SCHEME $scheme; +fastcgi_param HTTPS $https if_not_empty; + +fastcgi_param GATEWAY_INTERFACE CGI/1.1; +fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + +fastcgi_param REMOTE_ADDR $remote_addr; +fastcgi_param REMOTE_PORT $remote_port; +fastcgi_param SERVER_ADDR $server_addr; +fastcgi_param SERVER_PORT $server_port; +fastcgi_param SERVER_NAME $server_name; + +# PHP only, required if PHP was built with --enable-force-cgi-redirect +fastcgi_param REDIRECT_STATUS 200; new file mode 100644 @@ -0,0 +1,138 @@ +types { + + # Data interchange + + application/atom+xml atom; + application/json json map topojson; + application/ld+json jsonld; + application/rss+xml rss; + # Normalize to standard type. + # https://tools.ietf.org/html/rfc7946#section-12 + application/geo+json geojson; + application/xml xml; + # Normalize to standard type. + # https://tools.ietf.org/html/rfc3870#section-2 + application/rdf+xml rdf; + + + # JavaScript + + # Servers should use text/javascript for JavaScript resources. + # https://html.spec.whatwg.org/multipage/scripting.html#scriptingLanguages + text/javascript js mjs; + application/wasm wasm; + + # Manifest files + + application/manifest+json webmanifest; + application/x-web-app-manifest+json webapp; + text/cache-manifest appcache; + + + # Media files + + audio/midi mid midi kar; + audio/mp4 aac f4a f4b m4a; + audio/mpeg mp3; + audio/ogg oga ogg opus; + audio/x-realaudio ra; + audio/x-wav wav; + image/apng apng; + image/avif avif avifs; + image/bmp bmp; + image/gif gif; + image/jpeg jpeg jpg; + image/jxl jxl; + image/jxr jxr hdp wdp; + image/png png; + image/svg+xml svg svgz; + image/tiff tif tiff; + image/vnd.wap.wbmp wbmp; + image/webp webp; + image/x-jng jng; + video/3gpp 3gp 3gpp; + video/mp4 f4p f4v m4v mp4; + video/mpeg mpeg mpg; + video/ogg ogv; + video/quicktime mov; + video/webm webm; + video/x-flv flv; + video/x-mng mng; + video/x-ms-asf asf asx; + video/x-msvideo avi; + + # Serving `.ico` image files with a different media type + # prevents Internet Explorer from displaying then as images: + # https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee + + image/x-icon cur ico; + + + # Microsoft Office + + application/msword doc; + application/vnd.ms-excel xls; + application/vnd.ms-powerpoint ppt; + application/vnd.openxmlformats-officedocument.wordprocessingml.document docx; + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx; + application/vnd.openxmlformats-officedocument.presentationml.presentation pptx; + + + # Web fonts + + font/woff woff; + font/woff2 woff2; + application/vnd.ms-fontobject eot; + font/ttf ttf; + font/collection ttc; + font/otf otf; + + + # Other + + application/java-archive ear jar war; + application/mac-binhex40 hqx; + application/octet-stream bin deb dll dmg exe img iso msi msm msp safariextz; + application/pdf pdf; + application/postscript ai eps ps; + application/rtf rtf; + application/vnd.google-earth.kml+xml kml; + application/vnd.google-earth.kmz kmz; + application/vnd.wap.wmlc wmlc; + application/x-7z-compressed 7z; + application/x-bb-appworld bbaw; + application/x-bittorrent torrent; + application/x-chrome-extension crx; + application/x-cocoa cco; + application/x-java-archive-diff jardiff; + application/x-java-jnlp-file jnlp; + application/x-makeself run; + application/x-opera-extension oex; + application/x-perl pl pm; + application/x-pilot pdb prc; + application/x-rar-compressed rar; + application/x-redhat-package-manager rpm; + application/x-sea sea; + application/x-shockwave-flash swf; + application/x-stuffit sit; + application/x-tcl tcl tk; + application/x-x509-ca-cert crt der pem; + application/x-xpinstall xpi; + application/xhtml+xml xhtml; + application/xslt+xml xsl; + application/zip zip; + text/calendar ics; + text/css css; + text/csv csv; + text/html htm html shtml; + text/markdown md markdown; + text/mathml mml; + text/plain txt; + text/vcard vcard vcf; + text/vnd.rim.location.xloc xloc; + text/vnd.sun.j2me.app-descriptor jad; + text/vnd.wap.wml wml; + text/vtt vtt; + text/x-component htc; + +} new file mode 100644 @@ -0,0 +1,198 @@ +# Configuration File - Nginx Server Configs +# https://nginx.org/en/docs/ + +# Run as a unique, less privileged user for security reasons. +# Default: nobody nobody +# https://nginx.org/en/docs/ngx_core_module.html#user +# https://en.wikipedia.org/wiki/Principle_of_least_privilege +# user www-data; +user nginx; + +# Sets the worker threads to the number of CPU cores available in the system for +# best performance. Should be > the number of CPU cores. +# Maximum number of connections = worker_processes * worker_connections +# Default: 1 +# https://nginx.org/en/docs/ngx_core_module.html#worker_processes +worker_processes auto; + +# Maximum number of open files per worker process. +# Should be > worker_connections. +# Default: no limit +# https://nginx.org/en/docs/ngx_core_module.html#worker_rlimit_nofile +worker_rlimit_nofile 8192; + +# Provides the configuration file context in which the directives that affect +# connection processing are specified. +# https://nginx.org/en/docs/ngx_core_module.html#events +events { + + # If you need more connections than this, you start optimizing your OS. + # That's probably the point at which you hire people who are smarter than you + # as this is *a lot* of requests. + # Should be < worker_rlimit_nofile. + # Default: 512 + # https://nginx.org/en/docs/ngx_core_module.html#worker_connections + worker_connections 8000; + +} + +# Log errors and warnings to this file +# This is only used when you don't override it on a `server` level +# Default: logs/error.log error +# https://nginx.org/en/docs/ngx_core_module.html#error_log +# error_log /var/log/nginx/error.log warn; +error_log /dev/null emerg; + +# The file storing the process ID of the main process +# Default: logs/nginx.pid +# https://nginx.org/en/docs/ngx_core_module.html#pid +pid /var/run/nginx.pid; + +# Include files in the custom.d folder. +# Custom configuration and value files should be placed in the custom.d +# folder. +# The configurations should be disabled by prefixing files with a dot. +# include custom.d/*.conf; + +http { + + # Hide Nginx version information. + include custom.d/security/server_software_information.conf; + + # Specify media (MIME) types for files. + include custom.d/media_types/media_types.conf; + + # Set character encodings. + include custom.d/media_types/character_encodings.conf; + + # Include $http_x_forwarded_for within default format used in log files + # https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format + log_format main '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for" "$host"'; + + # Log access to this file + # This is only used when you don't override it on a `server` level + # Default: logs/access.log combined + # https://nginx.org/en/docs/http/ngx_http_log_module.html#access_log + # access_log /var/log/nginx/access.log main; + access_log off; + + # How long to allow each connection to stay idle. + # Longer values are better for each individual client, particularly for SSL, + # but means that worker connections are tied up longer. + # Default: 75s + # https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout + # keepalive_timeout 20s; + keepalive_timeout 75s; + + # Speed up file transfers by using `sendfile()` to copy directly between + # descriptors rather than using `read()`/`write()``. + # For performance reasons, on FreeBSD systems w/ ZFS this option should be + # disabled as ZFS's ARC caches frequently used files in RAM by default. + # Default: off + # https://nginx.org/en/docs/http/ngx_http_core_module.html#sendfile + sendfile on; + + # Don't send out partial frames; this increases throughput since TCP frames + # are filled up before being sent out. + # Default: off + # https://nginx.org/en/docs/http/ngx_http_core_module.html#tcp_nopush + tcp_nopush on; + + # Enable gzip compression. + include custom.d/web_performance/compression.conf; + + # Specify file cache expiration. + include custom.d/web_performance/cache_expiration.conf; + + # Add Cache-Control. + # custom.d/web_performance/cache-control.conf + map $sent_http_content_type $cache_control { + default "public, immutable, stale-while-revalidate"; + + # No content + "" "no-store"; + + # Manifest files + ~*application/manifest\+json "public"; + ~*text/cache-manifest ""; # `no-cache` (*) + + # Assets + ~*image/svg\+xml "public, immutable, stale-while-revalidate"; + + # Data interchange + ~*application/(atom|rdf|rss)\+xml "public, stale-while-revalidate"; + + # Documents + ~*text/html "private, must-revalidate"; + ~*text/markdown "private, must-revalidate"; + ~*text/calendar "private, must-revalidate"; + + # Data + ~*json ""; # `no-cache` (*) + ~*xml ""; # `no-cache` (*) + } + + # Add X-Frame-Options for HTML documents. + # custom.d/security/x-frame-options.conf + map $sent_http_content_type $x_frame_options { + ~*text/html DENY; + } + + # Add Content-Security-Policy for HTML documents. + # custom.d/security/content-security-policy.conf + map $sent_http_content_type $content_security_policy { + ~*text/(html|javascript)|application/pdf|xml "default-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; upgrade-insecure-requests"; + } + + # Add Permissions-Policy for HTML documents. + # custom.d/security/permissions-policy.conf + map $sent_http_content_type $permissions_policy { + ~*text/(html|javascript)|application/pdf|xml "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()"; + } + + # Add Referrer-Policy for HTML documents. + # custom.d/security/referrer-policy.conf + map $sent_http_content_type $referrer_policy { + ~*text/(css|html|javascript)|application\/pdf|xml "strict-origin-when-cross-origin"; + } + + # Add Cross-Origin-Policies for HTML documents. + # custom.d/security/cross-origin-policy.conf + # Cross-Origin-Embedder-Policy + map $sent_http_content_type $coep_policy { + ~*text/(html|javascript)|application/pdf|xml "require-corp"; + } + # Cross-Origin-Opener-Policy + map $sent_http_content_type $coop_policy { + ~*text/(html|javascript)|application/pdf|xml "same-origin"; + } + # Cross-Origin-Resource-Policy + map $sent_http_content_type $corp_policy { + ~*text/(html|javascript)|application/pdf|xml "same-origin"; + } + + # Add Access-Control-Allow-Origin. + # custom.d/cross-origin/requests.conf + map $sent_http_content_type $cors { + # Images + ~*image/ "*"; + + # Web fonts + ~*font/ "*"; + ~*application/vnd.ms-fontobject "*"; + ~*application/x-font-ttf "*"; + ~*application/font-woff "*"; + ~*application/x-font-woff "*"; + ~*application/font-woff2 "*"; + } + + # Fix for onion links + server_names_hash_bucket_size 128; + + # Include files in the conf.d folder. + # `server` configuration files should be placed in the conf.d folder. + # The configurations should be disabled by prefixing files with a dot. + include conf.d/*.conf; +} new file mode 100644 @@ -0,0 +1,17 @@ + +scgi_param REQUEST_METHOD $request_method; +scgi_param REQUEST_URI $request_uri; +scgi_param QUERY_STRING $query_string; +scgi_param CONTENT_TYPE $content_type; + +scgi_param DOCUMENT_URI $document_uri; +scgi_param DOCUMENT_ROOT $document_root; +scgi_param SCGI 1; +scgi_param SERVER_PROTOCOL $server_protocol; +scgi_param REQUEST_SCHEME $scheme; +scgi_param HTTPS $https if_not_empty; + +scgi_param REMOTE_ADDR $remote_addr; +scgi_param REMOTE_PORT $remote_port; +scgi_param SERVER_PORT $server_port; +scgi_param SERVER_NAME $server_name; new file mode 100644 @@ -0,0 +1,17 @@ + +uwsgi_param QUERY_STRING $query_string; +uwsgi_param REQUEST_METHOD $request_method; +uwsgi_param CONTENT_TYPE $content_type; +uwsgi_param CONTENT_LENGTH $content_length; + +uwsgi_param REQUEST_URI $request_uri; +uwsgi_param PATH_INFO $document_uri; +uwsgi_param DOCUMENT_ROOT $document_root; +uwsgi_param SERVER_PROTOCOL $server_protocol; +uwsgi_param REQUEST_SCHEME $scheme; +uwsgi_param HTTPS $https if_not_empty; + +uwsgi_param REMOTE_ADDR $remote_addr; +uwsgi_param REMOTE_PORT $remote_port; +uwsgi_param SERVER_PORT $server_port; +uwsgi_param SERVER_NAME $server_name;