jarianc/certauth
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
certauth/nginx-local.conf

744 lines
22 KiB
Plaintext
Raw Blame History

# ============================================================
# example.com - Main landing page (HTTP only, no cert for bare domain)
# ============================================================
server {
listen 80;
server_name example.com;
root /var/www/example.com;
index index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
}
# ============================================================
# web.example.com - HTTPS landing page
# ============================================================
server {
listen 443 ssl;
server_name web.example.com www.web.example.com;
ssl_certificate /etc/ssl/certs/web.example.com.pem;
ssl_certificate_key /etc/ssl/private/web.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
root /var/www/example.com;
index index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
}
# HTTP -> HTTPS redirect for web.example.com
server {
listen 80;
server_name web.example.com www.web.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# tv.example.com - Jellyfin
# ============================================================
server {
listen 443 ssl;
server_name tv.example.com;
ssl_certificate /etc/ssl/certs/tv.example.com.pem;
ssl_certificate_key /etc/ssl/private/tv.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:8096;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name tv.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# ai.example.com - Open WebUI
# ============================================================
server {
listen 443 ssl;
server_name ai.example.com;
ssl_certificate /etc/ssl/certs/ai.example.com.pem;
ssl_certificate_key /etc/ssl/private/ai.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering off;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
client_max_body_size 20m;
gzip off;
}
}
server {
listen 80;
server_name ai.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# agents.example.com - n8n
# ============================================================
server {
listen 443 ssl;
server_name agents.example.com;
ssl_certificate /etc/ssl/certs/agents.example.com.pem;
ssl_certificate_key /etc/ssl/private/agents.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:5678;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
gzip off;
}
}
server {
listen 80;
server_name agents.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# papers.example.com - Arxiv Sanity Lite
# ============================================================
server {
listen 443 ssl;
server_name papers.example.com;
ssl_certificate /etc/ssl/certs/papers.example.com.pem;
ssl_certificate_key /etc/ssl/private/papers.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:7800;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name papers.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# pin.example.com - Karakeep
# ============================================================
server {
listen 443 ssl;
server_name pin.example.com;
ssl_certificate /etc/ssl/certs/pin.example.com.pem;
ssl_certificate_key /etc/ssl/private/pin.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:4444;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name pin.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# clip.example.com - Jelly Clip
# ============================================================
server {
listen 443 ssl;
server_name clip.example.com;
ssl_certificate /etc/ssl/certs/clip.example.com.pem;
ssl_certificate_key /etc/ssl/private/clip.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:5001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name clip.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# paste.example.com - Pastebin
# ============================================================
server {
listen 443 ssl;
server_name paste.example.com;
ssl_certificate /etc/ssl/certs/paste.example.com.pem;
ssl_certificate_key /etc/ssl/private/paste.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:9780;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name paste.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# llm.example.com - LiteLLM Proxy
# ============================================================
server {
listen 443 ssl;
server_name llm.example.com;
ssl_certificate /etc/ssl/certs/llm.example.com.pem;
ssl_certificate_key /etc/ssl/private/llm.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:4000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name llm.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# monitor.example.com - Grafana
# ============================================================
server {
listen 443 ssl;
server_name monitor.example.com;
ssl_certificate /etc/ssl/certs/monitor.example.com.pem;
ssl_certificate_key /etc/ssl/private/monitor.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:3003;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name monitor.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# stocks.example.com - Stock Docs Article Server
# ============================================================
server {
listen 443 ssl;
server_name stocks.example.com;
ssl_certificate /etc/ssl/certs/stocks.example.com.pem;
ssl_certificate_key /etc/ssl/private/stocks.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:5008;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name stocks.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# stockmcp.example.com - Stock MCP
# ============================================================
server {
listen 443 ssl;
server_name stockmcp.example.com;
ssl_certificate /etc/ssl/certs/stockmcp.example.com.pem;
ssl_certificate_key /etc/ssl/private/stockmcp.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
proxy_pass http://localhost:5005;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name stockmcp.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# play.example.com - (placeholder - specify backend port)
# ============================================================
server {
listen 443 ssl;
server_name play.example.com;
ssl_certificate /etc/ssl/certs/play.example.com.pem;
ssl_certificate_key /etc/ssl/private/play.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
location / {
return 503 "Service not configured - set backend port";
}
}
server {
listen 80;
server_name play.example.com;
return 301 https://$host$request_uri;
}
# ============================================================
# git.example.com - Gitea (HTTPS)
# ============================================================
server {
listen 443 ssl;
server_name git.example.com;
ssl_certificate /etc/ssl/certs/git.example.com.pem;
ssl_certificate_key /etc/ssl/private/git.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
client_max_body_size 50M;
location / {
proxy_pass http://192.168.8.192:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name git.example.com;
return 301 https://$host$request_uri;
}
# books.example.com - Bookworm
server {
listen 80;
server_name books.example.com;
location / {
proxy_pass http://localhost:1333;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# ai-host.example.com - Ollama
server {
listen 80;
server_name ai-host.example.com;
location / {
proxy_pass http://192.168.8.124:11434;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# chat.example.com - Element/Matrix UI
server {
listen 80;
server_name chat.example.com;
location / {
proxy_pass http://localhost:8009;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# conduit.example.com - Matrix Server
server {
listen 80;
server_name conduit.example.com;
location / {
proxy_pass http://localhost:8448;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# tiktok.example.com
server {
listen 80;
server_name tiktok.example.com;
location / {
proxy_pass http://0.0.0.0:4321;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# archive.example.com - ArchiveBox
server {
listen 80;
server_name archive.example.com;
location / {
proxy_pass http://localhost:1234;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# loop.example.com - Karakeep Chrome extension
server {
listen 80;
server_name loop.example.com;
location / {
proxy_pass http://localhost:3010;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# board.example.com - Karakeep board
server {
listen 80;
server_name board.example.com;
location / {
proxy_pass http://localhost:3001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# substack.example.com - Static Substack pages
server {
listen 80;
listen [::]:80;
server_name substack.example.com;
root /mnt/centralstoragemedia/Websites/Substack/substack_html_pages;
index index.html;
location /substack_html_pages/ {
alias /mnt/centralstoragemedia/Websites/Substack/substack_html_pages/;
try_files $uri $uri/ =404;
}
location /economics/ {
alias /mnt/centralstoragemedia/Websites/Substack/substack_html_pages/paulkrugman/;
try_files $uri $uri/ =404;
}
server_tokens off;
autoindex off;
location = /ai {
rewrite ^ /natesnewsletter.html break;
}
location = /economics {
rewrite ^ /paulkrugman.html break;
}
location = /games {
rewrite ^ /theshortcut.html break;
}
error_page 404 /404.html;
location = /404.html {
internal;
root /etc/nginx/html;
}
location ^~ /assets/js/ {
alias /mnt/centralstoragemedia/Websites/Substack/assets/js/;
default_type application/javascript;
expires 30d;
}
location ^~ /assets/css/ {
alias /mnt/centralstoragemedia/Websites/Substack/assets/css/;
default_type text/css;
expires 30d;
}
access_log /var/log/nginx/substack.access.log;
error_log /var/log/nginx/substack.error.log;
}
# kiwix.example.com - Wikipedia/Kiwix
server {
listen 80;
server_name kiwix.example.com;
location / {
proxy_pass http://127.0.0.1:8008;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# archive2.example.com - ArchiveBox snapshots
server {
listen 80;
listen [::]:80;
server_name archive2.example.com;
root /mnt/centralstoragemedia/Websites/ArchiveBox/data/archive;
index singlefile.html;
location / {
try_files $uri/singlefile.html $uri/index.html $uri/output.pdf =404;
}
location ~ ^/([^/]+)/pdf$ {
try_files $uri /$1/output.pdf =404;
}
location ~ ^/([^/]+)/html$ {
try_files $uri /$1/output.html =404;
}
location ~ ^/([^/]+)/singlefile$ {
try_files $uri /$1/singlefile.html =404;
}
server_tokens off;
autoindex off;
error_page 404 /404.html;
location = /404.html {
internal;
root /etc/nginx/html;
}
access_log /var/log/nginx/archive2.access.log;
error_log /var/log/nginx/archive2.error.log;
}
# red.example.com - Reddit
server {
listen 80;
server_name red.example.com;
location / {
proxy_pass http://localhost:6006;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# space.example.com - NASA
server {
listen 80;
server_name space.example.com;
location / {
proxy_pass http://localhost:6008;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# insights.example.com
server {
listen 80;
server_name insights.example.com;
location / {
proxy_pass http://localhost:5010;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
# podcast.example.com - Static podcast files
server {
listen 80;
server_name podcast.example.com;
root /mnt/centralstoragemedia/Podcasts;
location / {
try_files $uri.wav =404;
}
location ~* \.wav$ {
try_files $uri =404;
}
}
Reference in New Issue View Git Blame Copy Permalink