{%- from 'map.jinja' import nginx_crtkeypair -%} {%- set resolver = '[2a01:4f8:11e:2200::2]' -%} {#- to-do: move other service hosts to backend dict #} {%- set backend = {'takahe': 'http://takahe.rigel.lysergic.dev:8000'} %} {#- generic macros #} {%- macro proxyheaders(ForRemAdd=False) -%} - proxy_set_header: - 'Host $host' - 'X-Real-IP $remote_addr' - 'X-Forwarded-For {{ '$remote_addr' if ForRemAdd else '$proxy_add_x_forwarded_for' }}' - 'X-Forwarded-Proto $scheme' {%- endmacro -%} {%- macro proxyheaders2(ForRemAdd=False) -%} {{ proxyheaders(ForRemAdd) | indent(16) }} {%- endmacro -%} {%- macro jf_proxyheaders() -%} {{ proxyheaders() | indent(16) }} - 'X-Forwarded-Protocol $scheme' - 'X-Forwarded-Host $http_host' {%- endmacro -%} {%- macro proxyheaders_upgrade() -%} - proxy_set_header: Upgrade $http_upgrade - proxy_set_header: Connection $connection_upgrade {%- endmacro -%} {%- macro proxyheaders2_upgrade() -%} {{ proxyheaders_upgrade() | indent(16) }} {%- endmacro -%} {#- application specific macros #} {%- macro lcwebirc(port, indentinner) -%} - location /webirc: - proxy_pass: https://[2a01:4f8:11e:2200::cafe]:{{ port }} - proxy_http_version: 1.1 {{ proxyheaders_upgrade() | indent(16) }} - proxy_set_header: X-Forwarded-For $remote_addr - proxy_set_header: X-Forwarded-Proto $scheme - proxy_read_timeout: 600s {%- endmacro -%} {%- macro lcactivitypub(wkpath) -%} - location /.well-known/{{ wkpath }}: - proxy_pass: {{ backend.takahe }} - proxy_set_header: Host $http_host - resolver: '{{ resolver }} ipv4=off valid=24h' {%- endmacro -%} {%- macro matterbridge_media(domain, name) -%} - server: - include: - snippets/listen - snippets/tls_load - snippets/tls - server_name: {{ domain }} - location /: - proxy_pass: http://{{ name }}.matterbridge.dericom02.rigel.lysergic.dev {%- endmacro -%} nginx: snippets: tls: - resolver: '{{ resolver }}' {#- certificate snippets #} {{ nginx_crtkeypair('exhaustedlife', 'exhausted.life') | indent }} {{ nginx_crtkeypair('georg', 'georg.systems') | indent }} {{ nginx_crtkeypair('libertacasa', 'liberta.casa') | indent }} {{ nginx_crtkeypair('libertacasa2', 'libertacasa.net') | indent }} {{ nginx_crtkeypair('load', 'load.casa') | indent }} {{ nginx_crtkeypair('lysergic', 'lysergic.dev') | indent }} {{ nginx_crtkeypair('lysergic_media', 'lysergic.media') | indent }} {{ nginx_crtkeypair('meet', 'meet.com.de') | indent }} {{ nginx_crtkeypair('takahe', 'social.liberta.casa') | indent }} {{ nginx_crtkeypair('pub_sectigo', 'pub') | indent }} {#- locations shared between clearnet and Tor LibertaCasa servers #} libertacasa: - location /: - root: /srv/www/liberta.casa/static/website - index: index.html - location /register: - proxy_pass: http://[2a01:4f8:11e:2200::11]:8965 - location /kiwi: - root: /srv/www/liberta.casa - index: index.html - try_files: $uri $uri/ =404 - location /gamja: - root: /srv/www/liberta.casa - index: index.html servers: managed: general.conf: available_dir: /etc/nginx/conf.d config: - server_names_hash_bucket_size: 128 - port_in_redirect: 'off' - server_tokens: 'off' - limit_conn_zone: $binary_remote_addr zone=georg_conn:15m - limit_req_zone: $binary_remote_addr zone=georg_req:15m rate=30r/s default-http.conf: config: - server: - server_name: localhost - listen: - '80' - location /: - root: /srv/www/htdocs - index: index.html cytube.conf: config: - server: - include: - snippets/listen - snippets/tls_lysergic - snippets/tls - server_name: party.lysergic.dev - location /: - proxy_pass: https://[2a01:4f8:11e:2200::11]:8250 - proxy_set_header: - X-Forwarded-For $proxy_add_x_forwarded_for - X-Forwarded-Proto $scheme - Host $http_host default-https.conf: config: - server: - listen: - '[2a01:4f8:11e:2200::dead]:443 ssl http2 default_server' - 10.0.10.7:443 ssl http2 default_server - include: snippets/tls_lysergic - root: /srv/www/htdocs georg.conf: config: {%- macro georg_includes() %} - include: - snippets/listen - snippets/tls_georg - snippets/tls {%- endmacro %} - server: {{ georg_includes() }} - server_name: www.georg-pfuetzenreuter.net www.georg-pfuetzenreuter.de www.georg-pfuetzenreuter.at 240600.xyz - return: 302 https://georg-pfuetzenreuter.net - server: {{ georg_includes() }} - server_name: gippy.at - return: 302 https://georg-pfuetzenreuter.net - server: {{ georg_includes() }} - snippets/robots - server_name: georg.systems georg-pfuetzenreuter.de - location /: - proxy_pass: https://georg-public01.rigel.lysergic.dev:8989 {{ proxyheaders_upgrade() | indent(18) }} - limit_conn: georg_conn 10 - limit_req: zone=georg_req burst=5 delay=3 - client_body_buffer_size: 2M - resolver: '{{ resolver }} ipv6=on valid=60m' - server: {{ georg_includes() }} - server_name: georg-pfuetzenreuter.net pfuetzenreuter.at - location /: - proxy_pass: https://georg-public01.rigel.lysergic.dev:8989 {{ proxyheaders_upgrade() | indent(18) }} - limit_conn: georg_conn 10 - limit_req: zone=georg_req burst=10 delay=5 - client_body_buffer_size: 2M - resolver: '{{ resolver }} ipv6=on valid=60m' - location /plain: - root: /srv/www/georg - autoindex: 'on' hedgedoc.conf: config: {%- macro lysergic_includes() %} - include: - snippets/listen - snippets/tls_lysergic - snippets/tls {%- endmacro %} - map $http_upgrade $connection_upgrade: - default: upgrade - "''": close - server: {{ lysergic_includes() }} - server_name: hd.lysergic.dev hedge.lysergic.dev - return: 302 https://hedgedoc.lysergic.dev - server: {{ lysergic_includes() }} - server_name: hedgedoc.lysergic.dev - location /: - proxy_pass: 'http://[2a01:4f8:11e:2200::11]:3000' {{ proxyheaders2() }} - location /socket.io/: - proxy_pass: 'http://[2a01:4f8:11e:2200::11]:3000' {{ proxyheaders2() }} {{ proxyheaders2_upgrade() }} - location /build: - root: /srv/www/hedgedoc hidden.conf: config: - server: - listen: '[2a01:4f8:11e:2200::dead]:8085' - server_name: qzzf2qcfbhievvs5nzkccuwddroipy62qjocqtmgcgh75vd6w57m7yad.onion {#- source the same LibertaCasa locations used on the clearnet #} - include: snippets/libertacasa {#- this proxies to an ergo tor=true + websocket=true listener #} {{ lcwebirc(6663) }} {#- we rewrite the Kiwi configuration with one using our onion websocket #} - location /kiwi/static/config.json: - root: /srv/www/liberta.casa - rewrite: ^/kiwi/static/config.json$ /kiwi/static/config_onion.json {#- we rewrite Gamja configuration with one using our onion websocket #} - location /gamja/config.json: - root: /srv/www/liberta.casa - rewrite: ^/gamja/config.json$ /gamja/config_onion.json - server: - listen: '[2a01:4f8:11e:2200::dead]:8085' - server_name: gitea.qzzf2qcfbhievvs5nzkccuwddroipy62qjocqtmgcgh75vd6w57m7yad.onion - location /: - proxy_pass: https://git.com.de - proxy_ssl_trusted_certificate: /etc/ssl/ca-bundle.pem - server: - listen: '[2a01:4f8:11e:2200::dead]:8085' - server_name: cgit.qzzf2qcfbhievvs5nzkccuwddroipy62qjocqtmgcgh75vd6w57m7yad.onion - location /: - proxy_pass: https://git.casa - proxy_ssl_trusted_certificate: /etc/ssl/ca-bundle.pem http.conf: config: - server: - listen: - 10.0.10.7:80 default_server - '[2a01:4f8:11e:2200::dead]:80 default_server' - include: snippets/robots - location /: - return: 301 https://$host$request_uri jellyfin.conf: config: - server: - include: - snippets/listen - snippets/tls_lysergic_media - snippets/tls - server_name: lysergic.media www.lysergic.media - set: '$jellyfin [2a01:4f8:11e:2200::abc]:8096' - client_max_body_size: 20M - add_header: X-Frame-Options "SAMEORIGIN" - add_header: X-XSS-Protection "1; mode=block" - add_header: X-Content-Type-Options "nosniff" - location /: - proxy_pass: http://$jellyfin {{ jf_proxyheaders() }} - proxy_buffering: 'off' - location = /web/: - proxy_pass: http://$jellyfin/web/index.html {{ jf_proxyheaders() }} - location /socket: - proxy_pass: http://$jellyfin - proxy_http_version: 1.1 {{ proxyheaders_upgrade() | indent(16) }} {{ jf_proxyheaders() }} - location @force_get: - proxy_method: GET - proxy_pass: http://$jellyfin {{ jf_proxyheaders() }} - proxy_buffering: 'off' - location /Items: - proxy_pass: http://$jellyfin {{ jf_proxyheaders() }} - proxy_buffering: 'off' - error_page: 550 = @force_get - if ($request_method = HEAD): - return: 550 - access_log: /var/log/nginx/jellyfin.access.log - error_log: /var/log/nginx/jellyfin.error.log libertacasa.conf: config: {%- macro lc_includes() %} - include: - snippets/listen - snippets/tls - snippets/robots {%- endmacro %} - server: {{ lc_includes() }} - snippets/tls_libertacasa2 - server_name: libertacasa.net libsh.net libsh.com libsso.net libsso.com - return: 302 https://liberta.casa - server: {{ lc_includes() }} - snippets/tls_libertacasa - snippets/error - snippets/libertacasa - server_name: liberta.casa lib.casa www.liberta.casa www.lib.casa - add_header: Onion-Location http://qzzf2qcfbhievvs5nzkccuwddroipy62qjocqtmgcgh75vd6w57m7yad.onion$request_uri {#- this proxies to an ergo websocket=true listener #} {{ lcwebirc(6661) }} {#- we still receive a lot of attempted requests to this, let's reject it properly #} - location /.well-known/matrix: - return: 410 {#- IRC channel statistics/graphs #} - location /stats: - proxy_pass: https://stats.theia.psyched.dev/ {#- ActivityPub for @liberta.casa domain #} {{ lcactivitypub('webfinger') }} {{ lcactivitypub('host-meta') }} {{ lcactivitypub('nodeinfo') }} matterbridge.conf: config: {{ matterbridge_media('load.casa', 'libertacasa-general') }} {{ matterbridge_media('irc.load.casa', 'libertacasa-irc') }} {{ matterbridge_media('uploads.chillnet.org', 'chillnet') }} meet.conf: config: - server: {{ lysergic_includes() }} - server_name: meet.lysergic.dev meet.liberta.casa - location /: - proxy_pass: https://[2a01:4f8:11e:2200::c3]:5443/ - proxy_http_version: 1.1 {{ proxyheaders2(True) }} {{ proxyheaders2_upgrade() }} - tcp_nodelay: 'on' - modsecurity_rules: "'SecRuleRemoveById 949110'" openmeetings.conf: config: - server: - include: - snippets/listen - snippets/tls_meet - snippets/tls - server_name: meet.com.de www.meet.com.de - location /: - proxy_pass: https://[2a01:4f8:11e:2200::c3]:5443 - proxy_buffering: 'off' - proxy_pass_header: Server {{ proxyheaders2(True) }} - location /openmeetings/wicket/websocket: - proxy_pass: https://[2a01:4f8:11e:2200::c3]:5443/openmeetings/wicket/websocket - proxy_buffering: 'off' - proxy_pass_header: Server {{ proxyheaders2(True) }} {{ proxyheaders2_upgrade() }} plantuml.conf: config: - server: {{ lysergic_includes() }} - server_name: pu.lysergic.dev uml.lysergic.dev - return: 302 https://plantuml.lysergic.dev - server: {{ lysergic_includes() }} - server_name: plantuml.lysergic.dev - location /: - proxy_pass: http://[2a01:4f8:11e:2200::11]:8086 {#- PlantUML needs a very specific proxy configuration, hence not using the macros #} - proxy_set_header: HOST $host - proxy_set_header: X-Forwarded-Host $host - proxy_set_header: X-Forwarded-Proto $scheme - proxy_redirect: http://$host/ https://$host/ pub.conf: config: - server: - include: - snippets/listen - snippets/tls_pub_sectigo - snippets/tls - server_name: pub.syscid.com - root: /srv/www/pub - autoindex: 'on' takahe.conf: config: {%- macro takahe_includes() %} - include: - snippets/listen - snippets/tls_takahe - snippets/tls - snippets/robots - snippets/error {%- endmacro %} {%- macro takahe_gohome() %} - location = /: - return: 302 https://social.liberta.casa {%- endmacro %} {%- set takaheresolver = '- resolver: ' ~ '\'' ~ resolver ~ ' ipv4=off ipv6=on valid=24h\'' -%} {#- Main #} - server: {{ takahe_includes() }} - server_name: social.liberta.casa - location /: - proxy_pass: {{ backend.takahe }} {#- does not need X-Real-IP, to-do: add conditional to macro #} {{ proxyheaders2() }} {{ takaheresolver }} {#- Media #} - server: {{ takahe_includes() }} - server_name: social.load.casa {{ takahe_gohome() }} - location /: - proxy_pass: http://media.takahe.rigel.lysergic.dev:8001 {{ takaheresolver }} {#- despair.life is a second entry-point to social.liberta.casa instead of only a secondary domain in Takahe #} - server: {{ takahe_includes() }} - server_name: despair.life {{ takahe_gohome() }} {#- if someone clicks "Log in" on despair.life, the SAML IDP (Keycloak) would redirect back to despair.life, which breaks the session cookie originating from social.liberta.casa (Django only allows a single "cookie domain" - hence we rewrite the login endpoints to handle sessions exclusively via social.liberta.casa #} {%- for talopath in ['auth', 'saml2'] %} - location /{{ talopath }}: - rewrite: ^/(.*) https://social.liberta.casa/$1 redirect {%- endfor %} - location /: - proxy_pass: {{ backend.takahe }} {{ proxyheaders2() }} {{ takaheresolver }} {#- exhausted.life (secondary domain in Takahe) #} - server: - include: - snippets/listen - snippets/tls_exhaustedlife - snippets/tls - snippets/robots - snippets/error - server_name: exhausted.life {{ takahe_gohome() }} - location /.well-known/: - proxy_pass: {{ backend.takahe }} - sub_filter_types: application/xml - sub_filter: takahe.rigel.lysergic.dev:8000 exhausted.life