# {{ansible_managed}} user www-data; worker_processes auto; pid /run/nginx.pid; include /etc/nginx/modules-enabled/*.conf; events { worker_connections 768; multi_accept on; } http { sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; server_names_hash_bucket_size 64; include /etc/nginx/mime.types; default_type application/octet-stream; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; gzip on; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-MS-Proxy webgateway.intra.tormakris.dev; proxy_set_header X-MS-Forwarded-Client-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_set_header X-Forwarded-Proto https; proxy_ssl_server_name on; client_body_buffer_size 128k; proxy_connect_timeout 90; proxy_send_timeout 120; proxy_read_timeout 300; proxy_buffer_size 128k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; proxy_buffering off; proxy_request_buffering off; server_tokens off; server { listen 80 default_server; listen [::]:80 default_server; server_name _; return 301 https://$host$request_uri; } {%- for proxysite in proxy -%} server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name {{ proxysite.domain }}; proxy_ssl_name {{ proxysite.domain}}; ssl_certificate /etc/letsencrypt/live/{{ proxysite.domain }}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/{{ proxysite.domain }}/privkey.pem; ssl_stapling on; ssl_stapling_verify on; {%- if proxysite.bigrequests %} client_max_body_size 8G; {%- endif %} location /{ proxy_pass https://{{ proxysite.ip }}; proxy_ssl_verify off; } location /metrics{ proxy_pass https://{{ proxysite.ip }}; allow 192.168.69.0/24; deny all; } } {%- endfor -%} {%- for staticsite in static -%} server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name {{ staticsite.domain }}; ssl_certificate /etc/letsencrypt/live/{{ staticsite.domain }}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/{{ staticsite.domain }}/privkey.pem; root {{ staticsite.directory }}; location /{ try_files $uri $uri/ =404; } } {%- endfor -%} {%- for redirectsite in redirect -%} server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name {{ redirectsite.domain }}; ssl_certificate /etc/letsencrypt/live/{{ redirectsite.domain }}/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/{{ redirectsite.domain }}/privkey.pem; return 301 {{ redirectsite.destination }}; } {%- endfor -%} server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name tormakristof.eu; ssl_certificate /etc/letsencrypt/live/tormakristof.eu/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/tormakristof.eu/privkey.pem; root /var/www/tormakristof.eu; location /{ return 301 https://www.tormakristof.eu; } location /.well-known{ try_files $uri $uri/ =404; } location /.well-known/webfinger { return 301 https://mastodon.tormakristof.eu$request_uri; } } server { listen 8080; location /stub_status { stub_status; allow 127.0.0.1; deny all; } } }