cmc/dotfiles
Using GNU Stow to manage my dotfiles.
clone: git clone https://gitbay.org/cmc/dotfiles.git
e4433473801de1249845fe183d93095652c159ea
verified · cmc
author: Christian Cleberg <hello@cleberg.net> · 2026-04-15T23:52:24Z
linux/nginx/etc/nginx/conf.d/1kb.conf | 4 +- linux/nginx/etc/nginx/conf.d/ao.conf | 5 +- linux/nginx/etc/nginx/conf.d/art.conf | 5 +- linux/nginx/etc/nginx/conf.d/auth.conf | 7 +- linux/nginx/etc/nginx/conf.d/br.conf | 7 +- linux/nginx/etc/nginx/conf.d/bt.conf | 6 +- linux/nginx/etc/nginx/conf.d/bw.conf | 7 +- linux/nginx/etc/nginx/conf.d/cc.conf | 7 +- linux/nginx/etc/nginx/conf.d/cleberg.dev.conf | 8 +- linux/nginx/etc/nginx/conf.d/cleberg.io.conf | 4 +- linux/nginx/etc/nginx/conf.d/cleberg.net.conf | 60 +-------- linux/nginx/etc/nginx/conf.d/cv.conf | 2 +- linux/nginx/etc/nginx/conf.d/ddns.conf | 5 +- linux/nginx/etc/nginx/conf.d/files.conf | 2 +- linux/nginx/etc/nginx/conf.d/gh.conf | 7 +- linux/nginx/etc/nginx/conf.d/gramps.conf | 5 +- linux/nginx/etc/nginx/conf.d/ha.conf | 7 +- linux/nginx/etc/nginx/conf.d/hat.conf | 7 +- linux/nginx/etc/nginx/conf.d/hn.conf | 4 +- linux/nginx/etc/nginx/conf.d/img.conf | 2 +- linux/nginx/etc/nginx/conf.d/irc.conf | 5 +- linux/nginx/etc/nginx/conf.d/ld.conf | 7 +- linux/nginx/etc/nginx/conf.d/lt.conf | 7 +- linux/nginx/etc/nginx/conf.d/mz.conf | 7 +- linux/nginx/etc/nginx/conf.d/office.conf | 4 +- linux/nginx/etc/nginx/conf.d/org.conf | 4 +- linux/nginx/etc/nginx/conf.d/paste.conf | 7 +- linux/nginx/etc/nginx/conf.d/pb.conf | 7 +- linux/nginx/etc/nginx/conf.d/photos.conf | 4 +- linux/nginx/etc/nginx/conf.d/pin.conf | 7 +- linux/nginx/etc/nginx/conf.d/piped.conf | 7 +- linux/nginx/etc/nginx/conf.d/projects.conf | 4 +- linux/nginx/etc/nginx/conf.d/rd.conf | 7 +- .../etc/nginx/conf.d/reminiscecleberg.com.conf | 8 +- linux/nginx/etc/nginx/conf.d/rimgo.conf | 7 +- linux/nginx/etc/nginx/conf.d/rl.conf | 7 +- linux/nginx/etc/nginx/conf.d/rss.conf | 2 +- linux/nginx/etc/nginx/conf.d/search.conf | 7 +- linux/nginx/etc/nginx/conf.d/send.conf | 7 +- linux/nginx/etc/nginx/conf.d/slash.conf | 7 +- linux/nginx/etc/nginx/conf.d/small.conf | 7 +- linux/nginx/etc/nginx/conf.d/ssh.conf | 5 +- linux/nginx/etc/nginx/conf.d/zerolabs.sh.conf | 8 +- .../etc/nginx/custom.d/http/backend_address.conf | 145 +++++++++++++++++++++ .../etc/nginx/custom.d/http/content_type_maps.conf | 83 ++++++++++++ .../sites/cleberg_net_static_locations.conf | 27 ++++ .../etc/nginx/custom.d/tls/certificate_files.conf | 35 +---- .../tls/certificate_files_cleberg_dev.conf | 3 + .../custom.d/tls/certificate_files_cleberg_io.conf | 3 + .../tls/certificate_files_cleberg_net.conf | 16 +++ .../certificate_files_reminiscecleberg_com.conf | 3 + .../tls/certificate_files_zerolabs_sh.conf | 3 + linux/nginx/etc/nginx/nginx.conf | 125 +----------------- 53 files changed, 392 insertions(+), 354 deletions(-) @@ -1,5 +1,5 @@ server { - listen 443; + listen 443 ssl; http2 on; server_name 1kb.zerolabs.sh; @@ -19,7 +19,7 @@ server { charset off; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_zerolabs_sh.conf; location = / { try_files /index.html =404; @@ -9,12 +9,11 @@ server { add_header Onion-Location "http://7lyqrn4ofxdq7lfporviu44zpc42wooh2bqazfhvpscgwby2vcwldzad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:9380; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -9,12 +9,11 @@ server { } include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:3003; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -3,15 +3,14 @@ server { http2 on; server_name auth.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; - set $upstream http://127.0.0.1:9092; location / { - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } - location /api/verify { proxy_pass $upstream; } + location /api/verify { proxy_pass $backend_address; } } server { @@ -4,12 +4,11 @@ server { server_name br.zerolabs.sh pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion; add_header Onion-Location "http://pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:3030; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name br.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://br.zerolabs.sh$request_uri; @@ -4,7 +4,7 @@ server { server_name bt.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; @@ -30,7 +30,7 @@ server { proxy_set_header X-Forwarded-Server $host; proxy_pass_header X-Transmission-Session-Id; - proxy_pass http://127.0.0.1:9091; + proxy_pass $backend_address; } } @@ -52,7 +52,7 @@ server { server_name bt.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://bt.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name bw.zerolabs.sh z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion; add_header Onion-Location "http://z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:10416; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name bw.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://bw.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name cc.zerolabs.sh gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion; add_header Onion-Location "http://gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:8111; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name cc.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://cc.zerolabs.sh$request_uri; @@ -4,9 +4,7 @@ server { server_name www.cleberg.dev; include custom.d/tls/ssl_engine.conf; include custom.d/tls/policy_strict.conf; - ssl_certificate /etc/letsencrypt/live/cleberg.dev/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/cleberg.dev/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem; + include custom.d/tls/certificate_files_cleberg_dev.conf; return 301 $scheme://cleberg.dev$request_uri; } @@ -18,10 +16,8 @@ server { root /var/www/cleberg.dev/; include custom.d/tls/ssl_engine.conf; include custom.d/tls/policy_strict.conf; + include custom.d/tls/certificate_files_cleberg_dev.conf; include custom.d/basic.conf; - ssl_certificate /etc/letsencrypt/live/cleberg.dev/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/cleberg.dev/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem; location / { try_files $uri $uri/ =404; } } @@ -4,10 +4,8 @@ server { server_name cleberg.io; include custom.d/tls/ssl_engine.conf; include custom.d/tls/policy_strict.conf; + include custom.d/tls/certificate_files_cleberg_io.conf; include custom.d/basic.conf; - ssl_certificate /etc/letsencrypt/live/cleberg.io/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/cleberg.io/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem; return 301 https://cleberg.net; } @@ -3,7 +3,7 @@ server { http2 on; server_name cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; include custom.d/security/strict-transport-security.conf; @@ -13,33 +13,7 @@ server { add_header Onion-Location "http://paske4urhs6nttrtlkuwa5cowum3fjkc6yv6kl4ncx3mjxcd77764nqd.onion$request_uri" always; - location /org/ { - internal; - alias /var/www/cleberg.net/org/; - default_type text/plain; - add_header Content-Type "text/plain; charset=utf-8"; - } - - location / { - try_files $uri $uri/ =404; - } - - location /blog/ { - rewrite ^/blog/((?!index)[^/]+)/(.*)$ /blog/$1.html permanent; - if ($http_accept ~* "text/markdown") { - rewrite ^/blog/([^/]+)\.html$ /org/blog/$1.org last; - } - } - - location ~ ^/([^/]+)\.html$ { - if ($http_accept ~* "text/markdown") { - rewrite ^/([^/]+)\.html$ /org/$1.org last; - } - try_files $uri =404; - } - - location /atom.xml { return 301 $scheme://$host/feed.xml; } - location /blog/salary-transparency.html { return 301 $scheme://$host/salary/; } + include custom.d/sites/cleberg_net_static_locations.conf; } server { @@ -47,7 +21,7 @@ server { http2 on; server_name hutch.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; include custom.d/security/strict-transport-security.conf; @@ -69,31 +43,5 @@ server { include custom.d/basic.conf; root /var/www/cleberg.net/; - location /org/ { - internal; - alias /var/www/cleberg.net/org/; - default_type text/plain; - add_header Content-Type "text/plain; charset=utf-8"; - } - - location / { - try_files $uri $uri/ =404; - } - - location /blog/ { - rewrite ^/blog/((?!index)[^/]+)/(.*)$ /blog/$1.html permanent; - if ($http_accept ~* "text/markdown") { - rewrite ^/blog/([^/]+)\.html$ /org/blog/$1.org last; - } - } - - location ~ ^/([^/]+)\.html$ { - if ($http_accept ~* "text/markdown") { - rewrite ^/([^/]+)\.html$ /org/$1.org last; - } - try_files $uri =404; - } - - location /atom.xml { return 301 $scheme://$host/feed.xml; } - location /blog/salary-transparency.html { return 301 $scheme://$host/salary/; } + include custom.d/sites/cleberg_net_static_locations.conf; } @@ -4,7 +4,7 @@ server { server_name cv.cleberg.net; add_header Onion-Location "http://xe43aewwiybmbo5qsstx7t5kmgkd2ei4bkkvqinwd7fxfmkekvnjbbad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; root /var/www/cv/; @@ -3,13 +3,12 @@ server { http2 on; server_name ddns.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location /authelia { include custom.d/reverse_proxy/authelia.conf; } location / { - set $upstream http://127.0.0.1:8097; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/authelia_request.conf; include custom.d/reverse_proxy/basic.conf; } @@ -4,7 +4,7 @@ server { server_name files.cleberg.net; add_header Onion-Location "http://yt2y635dc6zyxziy5ytkfz36bmkgcxuccq3meom6qp44gjdat54wt5id.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; root /var/www/files/; @@ -3,12 +3,11 @@ server { http2 on; server_name gh.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://192.168.0.251:3039; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -32,7 +31,7 @@ server { server_name gh.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://gh.zerolabs.sh$request_uri; @@ -3,13 +3,12 @@ server { http2 on; server_name gramps.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location /authelia { include custom.d/reverse_proxy/authelia.conf; } location / { - set $upstream http://127.0.0.1:5566; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/authelia_request.conf; include custom.d/reverse_proxy/basic.conf; } @@ -3,16 +3,15 @@ server { http2 on; server_name ha.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; - set $upstream http://192.168.0.214:8123; location / { - proxy_pass $upstream; + proxy_pass $backend_address; proxy_set_header X-Forwarded-For $remote_addr; } location /api/websocket { - proxy_pass $upstream; + proxy_pass $backend_address; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; @@ -4,12 +4,11 @@ server { server_name hat.zerolabs.sh jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion; add_header Onion-Location "http://jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://192.168.0.251:3991; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name hat.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://hat.zerolabs.sh$request_uri; @@ -7,7 +7,7 @@ server { autoindex on; add_header Onion-Location "http://r3yfeffyj7ornpikojmw75u3sn2la7tqnmcmwgv2ov7if24sm5czqeid.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { try_files $uri $uri/ /index.html; } @@ -31,7 +31,7 @@ server { server_name hn.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://hn.zerolabs.sh$request_uri; @@ -4,7 +4,7 @@ server { server_name img.cleberg.net; add_header Onion-Location "http://ltf2dfg7tj263ll24lxuq7igejcrhcazjp6whgg6u6vyjir2iahqggad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; root /var/www/img/; @@ -3,13 +3,12 @@ server { http2 on; server_name irc.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location /authelia { include custom.d/reverse_proxy/authelia.conf; } location / { - set $upstream http://127.0.0.1:9900; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/authelia_request.conf; include custom.d/reverse_proxy/basic.conf; } @@ -4,12 +4,11 @@ server { server_name ld.zerolabs.sh u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion; add_header Onion-Location "http://u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:3004; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name ld.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://ld.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name lt.zerolabs.sh nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion; add_header Onion-Location "http://nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:5000; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name lt.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://lt.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name mz.zerolabs.sh ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion; add_header Onion-Location "http://ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:3474; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name mz.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://mz.zerolabs.sh$request_uri; @@ -5,7 +5,7 @@ server { add_header Onion-Location "http://uwtjz6pof52bzdkj242mub77ls2ji3qiznbsuoir235rxynqxadpghid.onion$request_uri" always; root /var/www/office/; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { try_files $uri $uri/ /index.html; } @@ -36,7 +36,7 @@ server { server_name office.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://office.zerolabs.sh$request_uri; @@ -5,7 +5,7 @@ server { add_header Onion-Location "http://7vsifofpucgi3wva52nbwhwglrmbyxgdapbkkmgniqlsskspux5zocyd.onion$request_uri" always; root /var/www/org/; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { try_files $uri $uri/ /index.html; } @@ -36,7 +36,7 @@ server { server_name org.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://org.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name paste.zerolabs.sh ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion; add_header Onion-Location "http://ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:8084; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name paste.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://paste.zerolabs.sh$request_uri; @@ -6,13 +6,12 @@ server { error_log /var/log/nginx/pb.log; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location /authelia { include custom.d/reverse_proxy/authelia.conf; } location / { - set $upstream http://127.0.0.1:8745; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/authelia_request.conf; include custom.d/reverse_proxy/basic.conf; } @@ -37,7 +36,7 @@ server { server_name pb.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://pb.zerolabs.sh$request_uri; @@ -3,7 +3,7 @@ server { http2 on; server_name photos.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; client_max_body_size 50000M; @@ -18,7 +18,7 @@ server { proxy_read_timeout 600s; proxy_send_timeout 600s; send_timeout 600s; - location / { proxy_pass http://127.0.0.1:2283; } + location / { proxy_pass $backend_address; } } server { @@ -4,12 +4,11 @@ server { server_name pin.zerolabs.sh 3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion; add_header Onion-Location "http://3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:8086; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name pin.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://pin.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name piped.zerolabs.sh pipedapi.zerolabs.sh pipedproxy.zerolabs.sh 5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion; add_header Onion-Location "http://5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:8077; - proxy_pass $upstream; + proxy_pass $backend_address; proxy_set_header Host $host; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name piped.cleberg.net pipedapi.cleberg.net pipedproxy.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://pipedapi.zerolabs.sh$request_uri; @@ -6,7 +6,7 @@ server { root /var/www/projects/; autoindex on; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { try_files $uri $uri/ /index.html; } @@ -39,7 +39,7 @@ server { server_name projects.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://projects.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name rd.zerolabs.sh voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion; add_header Onion-Location "http://voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:2944; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name rd.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://rd.zerolabs.sh$request_uri; @@ -4,9 +4,7 @@ server { server_name www.reminiscecleberg.com; include custom.d/tls/ssl_engine.conf; include custom.d/tls/policy_strict.conf; - ssl_certificate /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem; + include custom.d/tls/certificate_files_reminiscecleberg_com.conf; return 301 $scheme://reminiscecleberg.com$request_uri; } @@ -18,10 +16,8 @@ server { root /var/www/reminiscecleberg.com/; include custom.d/tls/ssl_engine.conf; include custom.d/tls/policy_strict.conf; + include custom.d/tls/certificate_files_reminiscecleberg_com.conf; include custom.d/basic.conf; - ssl_certificate /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem; location / { try_files $uri $uri/ =404; } } @@ -4,12 +4,11 @@ server { server_name rimgo.zerolabs.sh hcj62a4s6ok23oaa4xjnnvabj2aunod3464iuufh2wtehg2th3rwn3yd.onion; add_header Onion-Location "http://hcj62a4s6ok23oaa4xjnnvabj2aunod3464iuufh2wtehg2th3rwn3yd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:3869; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name rimgo.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://rimgo.zerolabs.sh$request_uri; @@ -4,13 +4,12 @@ server { server_name rl.zerolabs.sh s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion; add_header Onion-Location "http://s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location /authelia { include custom.d/reverse_proxy/authelia.conf; } location / { - set $upstream http://127.0.0.1:8983; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/authelia_request.conf; include custom.d/reverse_proxy/basic.conf; } @@ -35,7 +34,7 @@ server { server_name rl.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://rl.zerolabs.sh$request_uri; @@ -4,7 +4,7 @@ server { http2 on; server_name rss.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { @@ -4,12 +4,11 @@ server { server_name search.zerolabs.sh txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion; add_header Onion-Location "http://txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:9191; - proxy_pass $upstream; + proxy_pass $backend_address; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; @@ -37,7 +36,7 @@ server { server_name search.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://search.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name send.zerolabs.sh 6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion; add_header Onion-Location "http://6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://192.168.0.251:1443; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name send.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://send.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name slash.zerolabs.sh svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion; add_header Onion-Location "http://svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://192.168.0.251:5231; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name slash.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://slash.zerolabs.sh$request_uri; @@ -4,12 +4,11 @@ server { server_name small.zerolabs.sh w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion; add_header Onion-Location "http://w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion$request_uri" always; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location / { - set $upstream http://127.0.0.1:8002; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/basic.conf; } include custom.d/security/robots_index_only.conf; @@ -33,7 +32,7 @@ server { server_name small.cleberg.net; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; return 301 https://small.zerolabs.sh$request_uri; @@ -3,13 +3,12 @@ server { http2 on; server_name ssh.zerolabs.sh; include custom.d/tls/ssl_engine.conf; - include custom.d/tls/certificate_files.conf; + include custom.d/tls/certificate_files_cleberg_net.conf; include custom.d/tls/policy_strict.conf; include custom.d/basic.conf; location /authelia { include custom.d/reverse_proxy/authelia.conf; } location / { - set $upstream http://127.0.0.1:8169; - proxy_pass $upstream; + proxy_pass $backend_address; include custom.d/reverse_proxy/authelia_request.conf; include custom.d/reverse_proxy/basic.conf; } @@ -4,9 +4,7 @@ server { server_name www.zerolabs.sh; include custom.d/tls/ssl_engine.conf; include custom.d/tls/policy_strict.conf; - ssl_certificate /etc/letsencrypt/live/zerolabs.sh/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/zerolabs.sh/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem; + include custom.d/tls/certificate_files_zerolabs_sh.conf; return 301 $scheme://zerolabs.sh$request_uri; } @@ -18,10 +16,8 @@ server { root /var/www/zerolabs.sh/; include custom.d/tls/ssl_engine.conf; include custom.d/tls/policy_strict.conf; + include custom.d/tls/certificate_files_zerolabs_sh.conf; include custom.d/basic.conf; - ssl_certificate /etc/letsencrypt/live/zerolabs.sh/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/zerolabs.sh/privkey.pem; - ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem; location / { try_files $uri $uri/ =404; } } new file mode 100644 @@ -0,0 +1,145 @@ +# Upstream URL per Host (clearnet and matching .onion listeners). Used as: +# proxy_pass $backend_address; +map $host $backend_address { + hostnames; + + # --- ao + 7lyqrn4ofxdq7lfporviu44zpc42wooh2bqazfhvpscgwby2vcwldzad.onion http://127.0.0.1:9380; + ao.cleberg.net http://127.0.0.1:9380; + ao.zerolabs.sh http://127.0.0.1:9380; + + # --- art + art.cleberg.net http://127.0.0.1:3003; + art.zerolabs.sh http://127.0.0.1:3003; + mplqs2jxkjd5wxak3zjv55oxyadf4vwzx6ksgj4ztftndjl6elgsf4qd.onion http://127.0.0.1:3003; + + # --- auth (cleberg hostname reserved for future use) + auth.cleberg.net http://127.0.0.1:9092; + auth.zerolabs.sh http://127.0.0.1:9092; + + # --- br + br.cleberg.net http://127.0.0.1:3030; + br.zerolabs.sh http://127.0.0.1:3030; + pkft6saqbmn6he5g626fphvlijmkdf4rzckjw6r57zsmuqm4ukd6i5ad.onion http://127.0.0.1:3030; + + # --- bt + bt.cleberg.net http://127.0.0.1:9091; + bt.zerolabs.sh http://127.0.0.1:9091; + + # --- bw + bw.cleberg.net http://127.0.0.1:10416; + bw.zerolabs.sh http://127.0.0.1:10416; + z7kc27ceokwgddrcspxx4eb7b6xqmtjj26nohg3wgt6hsnnlfmk4apqd.onion http://127.0.0.1:10416; + + # --- cc + cc.cleberg.net http://127.0.0.1:8111; + cc.zerolabs.sh http://127.0.0.1:8111; + gipsohqqcehn4n6smyg5j5aap7ln6lwugyjm2lxyx4vfiwayjhpnodyd.onion http://127.0.0.1:8111; + + # --- ddns + ddns.cleberg.net http://127.0.0.1:8097; + ddns.zerolabs.sh http://127.0.0.1:8097; + + # --- gh + gh.cleberg.net http://192.168.0.251:3039; + gh.zerolabs.sh http://192.168.0.251:3039; + + # --- gramps + gramps.cleberg.net http://127.0.0.1:5566; + + # --- ha + ha.cleberg.net http://192.168.0.214:8123; + ha.zerolabs.sh http://192.168.0.214:8123; + + # --- hat + hat.cleberg.net http://192.168.0.251:3991; + hat.zerolabs.sh http://192.168.0.251:3991; + jfrkztgin2ngoj2fnssc2m2j2ycpchmrhzhudaucgvaib5iqwgfxexyd.onion http://192.168.0.251:3991; + + # --- irc + irc.cleberg.net http://127.0.0.1:9900; + irc.zerolabs.sh http://127.0.0.1:9900; + + # --- ld + ld.cleberg.net http://127.0.0.1:3004; + ld.zerolabs.sh http://127.0.0.1:3004; + u3tyzuhs7o4hkizpbcxbm5yqzj74bjqb3phfqfszrx4u75dua7lpf7ad.onion http://127.0.0.1:3004; + + # --- lt + lt.cleberg.net http://127.0.0.1:5000; + lt.zerolabs.sh http://127.0.0.1:5000; + nxw6545qeepw2s2kngowsxbcizjcxyimn7dq2bpvr3sqabsu2juj6gyd.onion http://127.0.0.1:5000; + + # --- mz + mz.cleberg.net http://127.0.0.1:3474; + mz.zerolabs.sh http://127.0.0.1:3474; + ltawlmsk6vhrig2awwshnduiv45anelx3thepkd6xh4n2s4jxu7wyrid.onion http://127.0.0.1:3474; + + # --- paste + paste.cleberg.net http://127.0.0.1:8084; + paste.zerolabs.sh http://127.0.0.1:8084; + ciserod7fbncypo762qcqtowldl3qjhlojfnmguiuvcj3rcyrhqs6ead.onion http://127.0.0.1:8084; + + # --- pb + pb.cleberg.net http://127.0.0.1:8745; + pb.zerolabs.sh http://127.0.0.1:8745; + + # --- photos + photos.cleberg.net http://127.0.0.1:2283; + + # --- pin + pin.cleberg.net http://127.0.0.1:8086; + pin.zerolabs.sh http://127.0.0.1:8086; + 3rtmxu6slammicquf5cpgiptjpzht3n342vh62utoyxchds5r76tadad.onion http://127.0.0.1:8086; + + # --- piped + piped.cleberg.net http://127.0.0.1:8077; + piped.zerolabs.sh http://127.0.0.1:8077; + pipedapi.cleberg.net http://127.0.0.1:8077; + pipedapi.zerolabs.sh http://127.0.0.1:8077; + pipedproxy.cleberg.net http://127.0.0.1:8077; + pipedproxy.zerolabs.sh http://127.0.0.1:8077; + 5ttqjwhhcxh7apxrge5b5cjqceiibrjlqv2hhtmukwfsitbzqk5hh4id.onion http://127.0.0.1:8077; + + # --- rd + rd.cleberg.net http://127.0.0.1:2944; + rd.zerolabs.sh http://127.0.0.1:2944; + voyxxivcoupelvedthpbjqsrdhkn4ty7qjurvsif4qbjejnldisqs5ad.onion http://127.0.0.1:2944; + + # --- rimgo + rimgo.cleberg.net http://127.0.0.1:3869; + rimgo.zerolabs.sh http://127.0.0.1:3869; + hcj62a4s6ok23oaa4xjnnvabj2aunod3464iuufh2wtehg2th3rwn3yd.onion http://127.0.0.1:3869; + + # --- rl + rl.cleberg.net http://127.0.0.1:8983; + rl.zerolabs.sh http://127.0.0.1:8983; + s5wpjol4xe2mszhz4hoqobv4pqmoihb65dz2lbibujjjvhbpjvu45lad.onion http://127.0.0.1:8983; + + # --- search + search.cleberg.net http://127.0.0.1:9191; + search.zerolabs.sh http://127.0.0.1:9191; + txwk667ks3vh76r2mfqiot2wdptentsne64nu6qam63zbpzbmhtkvnid.onion http://127.0.0.1:9191; + + # --- send + send.cleberg.net http://192.168.0.251:1443; + send.zerolabs.sh http://192.168.0.251:1443; + 6jcf5qh2yg4axi42nbbcijglvoag74z7oq7xikqueebeb5vykj22miqd.onion http://192.168.0.251:1443; + + # --- slash + slash.cleberg.net http://192.168.0.251:5231; + slash.zerolabs.sh http://192.168.0.251:5231; + svfj2zs33g572utlou6kx7uamhwen4nxdzvfetnhwjqs4mmdgoayc7qd.onion http://192.168.0.251:5231; + + # --- small + small.cleberg.net http://127.0.0.1:8002; + small.zerolabs.sh http://127.0.0.1:8002; + w2qsrbzjmlikhwvbhno3qfdjod53iyzlvzjamcvgkcmtbclmdkqerbqd.onion http://127.0.0.1:8002; + + # --- ssh + ssh.cleberg.net http://127.0.0.1:8169; + ssh.zerolabs.sh http://127.0.0.1:8169; + + # --- wyl (reserved) + wyl.cleberg.net http://192.168.0.251:8840; +} new file mode 100644 @@ -0,0 +1,83 @@ +# Response header maps (see nginx.conf for context). +# Add Cache-Control. +map $sent_http_content_type $cache_control { + default "public, immutable, stale-while-revalidate"; + + # No content + "" "no-store"; + + # Manifest files + ~*application/manifest\+json "public"; + ~*text/cache-manifest ""; # `no-cache` (*) + + # Assets + ~*image/svg\+xml "public, immutable, stale-while-revalidate"; + + # Data interchange + ~*application/(atom|rdf|rss)\+xml "public, stale-while-revalidate"; + + # Documents + ~*text/html "private, must-revalidate"; + ~*text/markdown "private, must-revalidate"; + ~*text/calendar "private, must-revalidate"; + + # Data + ~*json ""; # `no-cache` (*) + ~*xml ""; # `no-cache` (*) +} + +# Add X-Frame-Options for HTML documents. +map $sent_http_content_type $x_frame_options { + ~*text/html DENY; +} + +# Add Content-Security-Policy for HTML documents. +map $sent_http_content_type $content_security_policy { + ~*text/(html|javascript)|application/pdf|xml " + default-src 'self'; + img-src 'self' https://img.cleberg.net; + base-uri 'none'; + form-action 'self'; + frame-ancestors 'none'; + object-src 'none'; + upgrade-insecure-requests + "; +} + +# Add Permissions-Policy for HTML documents. +map $sent_http_content_type $permissions_policy { + ~*text/(html|javascript)|application/pdf|xml "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()"; +} + +# Add Referrer-Policy for HTML documents. +map $sent_http_content_type $referrer_policy { + ~*text/(css|html|javascript)|application\/pdf|xml "strict-origin-when-cross-origin"; +} + +# Add Cross-Origin-Policies for HTML documents. +# Cross-Origin-Embedder-Policy +map $sent_http_content_type $coep_policy { + ~*text/(html|javascript)|application/pdf|xml "require-corp"; +} +# Cross-Origin-Opener-Policy +map $sent_http_content_type $coop_policy { + ~*text/(html|javascript)|application/pdf|xml "same-origin"; +} +# Cross-Origin-Resource-Policy +map $sent_http_content_type $corp_policy { + ~*text/(html|javascript)|application/pdf|xml "same-origin"; +} + +# Add Access-Control-Allow-Origin. +map $sent_http_content_type $cors { + # Images + ~*image/ "*"; + + # Web fonts + ~*font/ "*"; + ~*application/vnd.ms-fontobject "*"; + ~*application/x-font-ttf "*"; + ~*application/font-woff "*"; + ~*application/x-font-woff "*"; + ~*application/font-woff2 "*"; +} new file mode 100644 @@ -0,0 +1,27 @@ +location /org/ { + internal; + alias /var/www/cleberg.net/org/; + default_type text/plain; + add_header Content-Type "text/plain; charset=utf-8"; +} + +location / { + try_files $uri $uri/ =404; +} + +location /blog/ { + rewrite ^/blog/((?!index)[^/]+)/(.*)$ /blog/$1.html permanent; + if ($http_accept ~* "text/markdown") { + rewrite ^/blog/([^/]+)\.html$ /org/blog/$1.org last; + } +} + +location ~ ^/([^/]+)\.html$ { + if ($http_accept ~* "text/markdown") { + rewrite ^/([^/]+)\.html$ /org/$1.org last; + } + try_files $uri =404; +} + +location /atom.xml { return 301 $scheme://$host/feed.xml; } +location /blog/salary-transparency.html { return 301 $scheme://$host/salary/; } @@ -1,33 +1,2 @@ -# ---------------------------------------------------------------------- -# | Certificate files | -# ---------------------------------------------------------------------- - -# This default SSL certificate will be served whenever the client lacks support -# for SNI (Server Name Indication). -# -# (1) Certificate and key files location -# The certificate file can contain an intermediate certificate. -# -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate -# -# (2) Intermediate certificate location if loaded certificate (1) does not -# contain intermediate certificate when enabling OCSP stapling. -# -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate -# -# (3) CA certificate file location for client certificate authentication. -# -# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_client_certificate - -# (1) -# ssl_certificate /etc/nginx/certs/default.crt; -# ssl_certificate_key /etc/nginx/certs/default.key; -ssl_certificate /etc/letsencrypt/live/cleberg.net/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/cleberg.net/privkey.pem; - -# (2) -# ssl_trusted_certificate /path/to/ca.crt; -ssl_trusted_certificate /etc/letsencrypt/live/cleberg.net/chain.pem; - -# (3) -# ssl_client_certificate /etc/nginx/default_ssl.crt; +# Legacy include name: cleberg.net certificate (most zerolabs/cleberg.net vhosts). +include certificate_files_cleberg_net.conf; new file mode 100644 @@ -0,0 +1,3 @@ +ssl_certificate /etc/letsencrypt/live/cleberg.dev/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/cleberg.dev/privkey.pem; +ssl_trusted_certificate /etc/letsencrypt/live/cleberg.dev/chain.pem; new file mode 100644 @@ -0,0 +1,3 @@ +ssl_certificate /etc/letsencrypt/live/cleberg.io/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/cleberg.io/privkey.pem; +ssl_trusted_certificate /etc/letsencrypt/live/cleberg.io/chain.pem; new file mode 100644 @@ -0,0 +1,16 @@ +# ---------------------------------------------------------------------- +# | Certificate files — cleberg.net | +# ---------------------------------------------------------------------- + +# This default SSL certificate will be served whenever the client lacks support +# for SNI (Server Name Indication). +# +# (1) Certificate and key files location +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate +# +# (2) Intermediate certificate for OCSP stapling +# https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_trusted_certificate + +ssl_certificate /etc/letsencrypt/live/cleberg.net/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/cleberg.net/privkey.pem; +ssl_trusted_certificate /etc/letsencrypt/live/cleberg.net/chain.pem; new file mode 100644 @@ -0,0 +1,3 @@ +ssl_certificate /etc/letsencrypt/live/reminiscecleberg.com/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/reminiscecleberg.com/privkey.pem; +ssl_trusted_certificate /etc/letsencrypt/live/reminiscecleberg.com/chain.pem; new file mode 100644 @@ -0,0 +1,3 @@ +ssl_certificate /etc/letsencrypt/live/zerolabs.sh/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/zerolabs.sh/privkey.pem; +ssl_trusted_certificate /etc/letsencrypt/live/zerolabs.sh/chain.pem; @@ -106,133 +106,12 @@ http { # Specify file cache expiration. include custom.d/web_performance/cache_expiration.conf; - # Add Cache-Control. - # custom.d/web_performance/cache-control.conf - map $sent_http_content_type $cache_control { - default "public, immutable, stale-while-revalidate"; - - # No content - "" "no-store"; - - # Manifest files - ~*application/manifest\+json "public"; - ~*text/cache-manifest ""; # `no-cache` (*) - - # Assets - ~*image/svg\+xml "public, immutable, stale-while-revalidate"; - - # Data interchange - ~*application/(atom|rdf|rss)\+xml "public, stale-while-revalidate"; - - # Documents - ~*text/html "private, must-revalidate"; - ~*text/markdown "private, must-revalidate"; - ~*text/calendar "private, must-revalidate"; - - # Data - ~*json ""; # `no-cache` (*) - ~*xml ""; # `no-cache` (*) - } - - # Add X-Frame-Options for HTML documents. - # custom.d/security/x-frame-options.conf - map $sent_http_content_type $x_frame_options { - ~*text/html DENY; - } - - # Add Content-Security-Policy for HTML documents. - # custom.d/security/content-security-policy.conf - map $sent_http_content_type $content_security_policy { - ~*text/(html|javascript)|application/pdf|xml " - default-src 'self'; - img-src 'self' https://img.cleberg.net; - base-uri 'none'; - form-action 'self'; - frame-ancestors 'none'; - object-src 'none'; - upgrade-insecure-requests - "; - } - - # Add Permissions-Policy for HTML documents. - # custom.d/security/permissions-policy.conf - map $sent_http_content_type $permissions_policy { - ~*text/(html|javascript)|application/pdf|xml "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),display-capture=(),document-domain=(),encrypted-media=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(self),usb=(),web-share=(),xr-spatial-tracking=()"; - } - - # Add Referrer-Policy for HTML documents. - # custom.d/security/referrer-policy.conf - map $sent_http_content_type $referrer_policy { - ~*text/(css|html|javascript)|application\/pdf|xml "strict-origin-when-cross-origin"; - } - - # Add Cross-Origin-Policies for HTML documents. - # custom.d/security/cross-origin-policy.conf - # Cross-Origin-Embedder-Policy - map $sent_http_content_type $coep_policy { - ~*text/(html|javascript)|application/pdf|xml "require-corp"; - } - # Cross-Origin-Opener-Policy - map $sent_http_content_type $coop_policy { - ~*text/(html|javascript)|application/pdf|xml "same-origin"; - } - # Cross-Origin-Resource-Policy - map $sent_http_content_type $corp_policy { - ~*text/(html|javascript)|application/pdf|xml "same-origin"; - } - - # Add Access-Control-Allow-Origin. - # custom.d/cross-origin/requests.conf - map $sent_http_content_type $cors { - # Images - ~*image/ "*"; - - # Web fonts - ~*font/ "*"; - ~*application/vnd.ms-fontobject "*"; - ~*application/x-font-ttf "*"; - ~*application/font-woff "*"; - ~*application/x-font-woff "*"; - ~*application/font-woff2 "*"; - } + include custom.d/http/content_type_maps.conf; # Fix for onion links server_names_hash_bucket_size 128; - map $host $backend_address { - hostnames; - - ao.cleberg.net http://127.0.0.1:9380; - art.cleberg.net http://127.0.0.1:3003; - auth.cleberg.net http://127.0.0.1:9092; - br.cleberg.net http://127.0.0.1:3030; - bt.cleberg.net http://127.0.0.1:9091; - bw.cleberg.net http://127.0.0.1:10416; - cc.cleberg.net http://127.0.0.1:8111; - ddns.cleberg.net http://127.0.0.1:8097; - gh.cleberg.net http://192.168.0.251:3039; - ha.cleberg.net http://192.168.0.214:8123; - hat.cleberg.net http://192.168.0.251:3991; - irc.cleberg.net http://192.168.0.251:9900; - ld.cleberg.net http://127.0.0.1:3004; - lt.cleberg.net http://127.0.0.1:5000; - mz.cleberg.net http://127.0.0.1:3474; - paste.cleberg.net http://127.0.0.1:8084; - pb.cleberg.net http://127.0.0.1:8745; - photos.cleberg.net http://127.0.0.1:2283; - pin.cleberg.net http://127.0.0.1:8086; - piped.cleberg.net http://127.0.0.1:8077; - rd.cleberg.net http://127.0.0.1:5758; - rimgo.cleberg.net http://127.0.0.1:3869; - rl.cleberg.net http://192.168.0.251:8983; - rss.cleberg.net http://192.168.0.251:8081; - search.cleberg.net http://127.0.0.1:9191; - send.cleberg.net http://127.0.0.1:1443; - slash.cleberg.net http://192.168.0.251:5231; - small.cleberg.net http://127.0.0.1:8002; - ssh.cleberg.net http://127.0.0.1:8169; - wyl.cleberg.net http://192.168.0.251:8840; - } + include custom.d/http/backend_address.conf; # Include files in the conf.d folder. # `server` configuration files should be placed in the conf.d folder.