ambroisie/shipyard
ambroisie/shipyard
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

services: migrate letsencrypt to swag

Browse source
This commit is contained in:
Bruno BELANYI 2020-10-18 15:51:54 +02:00
parent 29afe55243
commit 9d49a1eec8
31 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

27
swag/nginx/proxy-confs/authelia.subdomain.conf Normal file
View file

@ -0,0 +1,27 @@
# make sure that your dns has a cname set for authelia
# the default authelia-server and authelia-location confs included with letsencrypt rely on
# subfolder proxy at "/authelia" and enabling of this proxy conf is not necessary.
# But if you'd like to use authelia via subdomain, you can enable this proxy and set up your own
# authelia-server and authelia-location confs as described in authelia docs.
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name auth.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
location / {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app authelia;
set $upstream_port 9091;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

33
swag/nginx/proxy-confs/bazarr.subdomain.conf Normal file
View file

@ -0,0 +1,33 @@
# make sure that your dns has a cname set for bazarr and that your bazarr container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name bazarr.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app bazarr;
set $upstream_port 6767;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

34
swag/nginx/proxy-confs/calibre-cc.subdomain.conf Normal file
View file

@ -0,0 +1,34 @@
# make sure that your dns has a cname set for calibre-cc
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name calibre-cc.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app calibre;
set $upstream_port 8081;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

35
swag/nginx/proxy-confs/calibre-web.subdomain.conf Normal file
View file

@ -0,0 +1,35 @@
# make sure that your dns has a cname set for calibre-web
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name library.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth, also customize and enable ldap.conf in the default conf
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app calibre-web;
set $upstream_port 8083;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
proxy_set_header Host $http_host;
proxy_set_header X-Scheme $scheme;
}
}

35
swag/nginx/proxy-confs/calibre.subdomain.conf Normal file
View file

@ -0,0 +1,35 @@
# make sure that your dns has a cname set for calibre
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name calibre.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
resolver 127.0.0.11 valid=30s;
set $upstream_app calibre;
set $upstream_port 8080;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
proxy_buffering off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
}
}

39
swag/nginx/proxy-confs/chat.subdomain.conf Normal file
View file

@ -0,0 +1,39 @@
# make sure that your dns has a cname set for riot and that your riot container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name chat.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
# enable for Authelia
#include /config/nginx/authelia-server.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /ldaplogin;
# enable for Authelia
#include /config/nginx/authelia-location.conf;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app riot;
set $upstream_port 80;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

71
swag/nginx/proxy-confs/drone.subdomain.conf Normal file
View file

@ -0,0 +1,71 @@
# make sure that your dns has a cname set for drone and that your drone container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name drone.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app drone-server;
set $upstream_port 80;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name drone-runner.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
# enable for Authelia
include /config/nginx/authelia-server.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
# enable for Authelia
include /config/nginx/authelia-location.conf;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app drone-runner;
set $upstream_port 3000;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

39
swag/nginx/proxy-confs/fava.subdomain.conf Normal file
View file

@ -0,0 +1,39 @@
# make sure that your dns has a cname set for fava and that your fava container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name fava.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
# enable for Authelia
include /config/nginx/authelia-server.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
# enable for Authelia
include /config/nginx/authelia-location.conf;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app fava;
set $upstream_port 5000;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

39
swag/nginx/proxy-confs/freshrss.subdomain.conf Normal file
View file

@ -0,0 +1,39 @@
# make sure that your dns has a cname set for freshrss
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name feed.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app freshrss;
set $upstream_port 80;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
proxy_redirect off;
proxy_buffering off;
proxy_set_header X-Forwarded-Port $server_port;
proxy_cookie_path / "/; HTTPOnly; Secure";
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
}
}

37
swag/nginx/proxy-confs/gitea.subdomain.conf Normal file
View file

@ -0,0 +1,37 @@
# make sure that your dns has a cname set for gitea and the following parameters in /data/gitea/conf/app.ini are edited
# [server]
# SSH_DOMAIN = gitea.server.com
# ROOT_URL = https://gitea.server.com/
# DOMAIN = gitea.server.com
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name gitea.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app gitea;
set $upstream_port 3000;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

53
swag/nginx/proxy-confs/jackett.subdomain.conf Normal file
View file

@ -0,0 +1,53 @@
# make sure that your dns has a cname set for jackett and that your jackett container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name jackett.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app jackett;
set $upstream_port 9117;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/jackett)?/api {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app jackett;
set $upstream_port 9117;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/jackett)?/dl {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app jackett;
set $upstream_port 9117;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

41
swag/nginx/proxy-confs/jellyfin.subdomain.conf Normal file
View file

@ -0,0 +1,41 @@
# make sure that your dns has a cname set for jellyfin
# if jellyfin is running in bridge mode and the container is named "jellyfin", the below config should work as is
# if not, replace the line "set $upstream_app jellyfin;" with "set $upstream_app <containername>;"
# or "set $upstream_app <HOSTIP>;" for host mode, HOSTIP being the IP address of jellyfin
# in jellyfin settings, under "Advanced/Networking" change the public https port to 443, leave the local ports as is,
# and set the "Secure connection mode" to "Handled by reverse proxy"
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name jellyfin.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
location / {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app jellyfin;
set $upstream_port 8096;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
proxy_set_header Range $http_range;
proxy_set_header If-Range $http_if_range;
}
location ~ (/jellyfin)?/socket {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app jellyfin;
set $upstream_port 8096;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
}
}

33
swag/nginx/proxy-confs/komga.subdomain.conf Normal file
View file

@ -0,0 +1,33 @@
# make sure that your dns has a cname set for adguard and that your adguard container is named adguard
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name komga.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app komga;
set $upstream_port 8080;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

52
swag/nginx/proxy-confs/lab.subdomain.conf Normal file
View file

@ -0,0 +1,52 @@
# make sure that your dns has a cname set for lab and that your lab container is named jupyter
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name lab.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
# enable for Authelia
include /config/nginx/authelia-server.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /ldaplogin;
# enable for Authelia
include /config/nginx/authelia-location.conf;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app jupyter;
set $upstream_port 8888;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~* /(api/kernels/[^/]+/(channels|iopub|shell|stdin)|terminals/websocket)/? {
# enable for Authelia
include /config/nginx/authelia-location.conf;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app jupyter;
set $upstream_port 8888;
set $upstream_proto http;
proxy_set_header Upgrade "websocket";
proxy_set_header Connection "Upgrade";
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

18
swag/nginx/proxy-confs/mail.subdomain.conf Normal file
View file

@ -0,0 +1,18 @@
# Redirect to Migadu webmail
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name mail.*;
include /config/nginx/ssl.conf;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
# enable for Authelia
#include /config/nginx/authelia-server.conf;
return 301 https://webmail.migadu.com;
}

25
swag/nginx/proxy-confs/matrix.subdomain.conf Normal file
View file

@ -0,0 +1,25 @@
# make sure that your dns has a cname set for matrix and that your matrix container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name matrix.belanyi.fr;
include /config/nginx/ssl.conf;
location /_matrix {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app synapse;
set $upstream_port 8008;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
# Nginx by default only allows file uploads up to 1M in size
# Increase client_max_body_size to match max_upload_size defined in homeserver.yaml
client_max_body_size 10M;
}
}

84
swag/nginx/proxy-confs/nzbhydra.subdomain.conf Normal file
View file

@ -0,0 +1,84 @@
# make sure that your dns has a cname set for nzbhydra and that your nzbhydra container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name nzbhydra.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app nzbhydra2;
set $upstream_port 5076;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/nzbhydra)?/api {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app nzbhydra2;
set $upstream_port 5076;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/nzbhydra)?/getnzb {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app nzbhydra2;
set $upstream_port 5076;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/nzbhydra)?/gettorrent {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app nzbhydra2;
set $upstream_port 5076;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/nzbhydra)?/rss {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app nzbhydra2;
set $upstream_port 5076;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/nzbhydra)?/torznab/api {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app nzbhydra2;
set $upstream_port 5076;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

33
swag/nginx/proxy-confs/photoprism.subdomain.conf Normal file
View file

@ -0,0 +1,33 @@
# make sure that your dns has a cname set for adguard and that your adguard container is named adguard
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name photoprism.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app photoprism;
set $upstream_port 2342;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

33
swag/nginx/proxy-confs/pyload.subdomain.conf Normal file
View file

@ -0,0 +1,33 @@
# make sure that your dns has a cname set for pyload and that your pyload container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name pyload.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app pyload;
set $upstream_port 8000;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

43
swag/nginx/proxy-confs/radarr.subdomain.conf Normal file
View file

@ -0,0 +1,43 @@
# make sure that your dns has a cname set for radarr and that your radarr container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name radarr.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app radarr;
set $upstream_port 7878;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/radarr)?/api {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app radarr;
set $upstream_port 7878;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

33
swag/nginx/proxy-confs/rss-bridge.subdomain.conf Normal file
View file

@ -0,0 +1,33 @@
# make sure that your dns has a cname set for rss-bridge and that your rss-bridge container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name rss-bridge.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app rss-bridge;
set $upstream_port 80;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

45
swag/nginx/proxy-confs/sabnzbd.subdomain.conf Normal file
View file

@ -0,0 +1,45 @@
# make sure that your dns has a cname set for sabnzbd
# edit the sabnzbd.ini host_whitelist to avoid hostname verification issues. This format:
# host_whitelist = sabnzbd.domain.com, www.sabnzbd.domain.com
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name sabnzbd.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app sabnzbd;
set $upstream_port 8080;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/sabnzbd)?/api {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app sabnzbd;
set $upstream_port 8080;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

43
swag/nginx/proxy-confs/sonarr.subdomain.conf Normal file
View file

@ -0,0 +1,43 @@
# make sure that your dns has a cname set for sonarr and that your sonarr container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name sonarr.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app sonarr;
set $upstream_port 8989;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
location ~ (/sonarr)?/api {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app sonarr;
set $upstream_port 8989;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

39
swag/nginx/proxy-confs/syncthing.subdomain.conf Normal file
View file

@ -0,0 +1,39 @@
# make sure that your dns has a cname set for syncthing and that your syncthing container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name syncthing.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
# enable for Authelia
include /config/nginx/authelia-server.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /ldaplogin;
# enable for Authelia
include /config/nginx/authelia-location.conf;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app syncthing;
set $upstream_port 8384;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

44
swag/nginx/proxy-confs/transmission.subdomain.conf Normal file
View file

@ -0,0 +1,44 @@
# make sure that your dns has a cname set for transmission
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name transmission.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app transmission;
set $upstream_port 9091;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
proxy_pass_header X-Transmission-Session-Id;
}
location ~ (/transmission)?/rpc {
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app transmission;
set $upstream_port 9091;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

33
swag/nginx/proxy-confs/wallabag.subdomain.conf Normal file
View file

@ -0,0 +1,33 @@
# make sure that your dns has a cname set for wallabag and that your wallabag container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name wallabag.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /login;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app wallabag;
set $upstream_port 80;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

39
swag/nginx/proxy-confs/wg.subdomain.conf Normal file
View file

@ -0,0 +1,39 @@
# make sure that your dns has a cname set for wg-gen-web and that your wg-gen-web container is not using a base url
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name wg.*;
include /config/nginx/ssl.conf;
client_max_body_size 0;
# enable for ldap auth, fill in ldap details in ldap.conf
#include /config/nginx/ldap.conf;
# enable for Authelia
include /config/nginx/authelia-server.conf;
location / {
# enable the next two lines for http auth
#auth_basic "Restricted";
#auth_basic_user_file /config/nginx/.htpasswd;
# enable the next two lines for ldap auth
#auth_request /auth;
#error_page 401 =200 /ldaplogin;
# enable for Authelia
include /config/nginx/authelia-location.conf;
include /config/nginx/proxy.conf;
resolver 127.0.0.11 valid=30s;
set $upstream_app wg-gen-web;
set $upstream_port 8080;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}
}

85
swag/nginx/site-confs/default Normal file
View file

@ -0,0 +1,85 @@
## Version 2020/03/05 - Changelog: https://github.com/linuxserver/docker-letsencrypt/commits/master/root/defaults/default
# redirect all traffic to https
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 301 https://$host$request_uri;
}
# Default to showing 404 on unknown subdomain or missing host header
server {
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name _;
# all ssl related config moved to ssl.conf
include /config/nginx/ssl.conf;
return 404;
}
# main server block
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
root /config/www/hugo;
index index.html;
server_name belanyi.fr;
# all ssl related config moved to ssl.conf
include /config/nginx/ssl.conf;
client_max_body_size 0;
# Matrix configuration
location /.well-known/matrix/server {
default_type application/json;
return 200 '{"m.server": "matrix.belanyi.fr:443"}';
}
}
# Debug version
server {
listen 443 ssl;
listen [::]:443 ssl;
root /config/www/hugo-dev;
index index.html;
server_name dev.belanyi.fr;
# all ssl related config moved to ssl.conf
include /config/nginx/ssl.conf;
client_max_body_size 0;
location / {
try_files $uri $uri/ =404;
}
}
# CV block
server {
listen 443 ssl;
listen [::]:443 ssl;
root /config/www/cv;
server_name cv.*;
# all ssl related config moved to ssl.conf
include /config/nginx/ssl.conf;
client_max_body_size 0;
}
# enable subdomain method reverse proxy confs
include /config/nginx/proxy-confs/*.subdomain.conf;
# enable proxy cache for auth
proxy_cache_path cache/ keys_zone=auth_cache:10m;

12
swag/swag.env Normal file
View file

@ -0,0 +1,12 @@
PUID=1000
PGID=1000
TZ=Europe/Paris
URL=belanyi.fr
SUBDOMAINS=wildcard
VALIDATION=dns
DNSPLUGIN=gandi
EMAIL=brunobelanyi@gmail.com
DHLEVEL=2048
ONLY_SUBDOMAINS=false
EXTRA_DOMAINS=
STAGING=false