kazu634
/
nginx-config
mirror of https://github.com/kazu634/nginx-config.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

initial commit

This commit is contained in:
Kazuhiro MUSASHI 2023-01-28 19:46:57 +09:00
commit f7949783ea
16 changed files with 697 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
consul-template.d/conf/faktory.conf Normal file
View File

@ -0,0 +1,15 @@
consul {
address = "localhost:8500"
retry {
enabled = true
attempts = 12
backoff = "250ms"
}
}
template {
source = "/etc/consul-template.d/templates/faktory.tmpl"
destination = "/etc/nginx/sites-enabled/faktory"
perms = 0660
command = "systemctl reload nginx"
}

15
consul-template.d/conf/gitea.conf Normal file
View File

@ -0,0 +1,15 @@
consul {
address = "localhost:8500"
retry {
enabled = true
attempts = 12
backoff = "250ms"
}
}
template {
source = "/etc/consul-template.d/templates/gitea.tmpl"
destination = "/etc/nginx/sites-enabled/gitea"
perms = 0660
command = "systemctl reload nginx"
}

15
consul-template.d/conf/grafana.conf Normal file
View File

@ -0,0 +1,15 @@
consul {
address = "localhost:8500"
retry {
enabled = true
attempts = 12
backoff = "250ms"
}
}
template {
source = "/etc/consul-template.d/templates/grafana.tmpl"
destination = "/etc/nginx/sites-enabled/grafana"
perms = 0660
command = "systemctl reload nginx"
}

15
consul-template.d/conf/guacamole.conf Normal file
View File

@ -0,0 +1,15 @@
consul {
address = "localhost:8500"
retry {
enabled = true
attempts = 12
backoff = "250ms"
}
}
template {
source = "/etc/consul-template.d/templates/guacamole.tmpl"
destination = "/etc/nginx/sites-enabled/guacamole"
perms = 0660
command = "systemctl reload nginx"
}

15
consul-template.d/conf/pocket.conf Normal file
View File

@ -0,0 +1,15 @@
consul {
address = "localhost:8500"
retry {
enabled = true
attempts = 12
backoff = "250ms"
}
}
template {
source = "/etc/consul-template.d/templates/pocket.tmpl"
destination = "/etc/nginx/sites-enabled/pocket"
perms = 0660
command = "systemctl reload nginx"
}

46
consul-template.d/templates/faktory.tmpl Normal file
View File

@ -0,0 +1,46 @@
server {
listen 443 ssl http2;
server_name faktory.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
access_log /var/log/nginx/faktory.access.log ltsv;
error_log /var/log/nginx/faktory.error.log;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location / {
proxy_pass http://faktory/;
}
}
upstream faktory {
{{ range service "faktory-front" }}
server {{ .Address }}:{{ .Port }};
{{else}}
server 127.0.0.1:60000;
{{ end }}
}

54
consul-template.d/templates/gitea.tmpl Normal file
View File

@ -0,0 +1,54 @@
server {
listen 443 ssl http2;
server_name gitea.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
access_log /var/log/nginx/gitea.access.log ltsv;
error_log /var/log/nginx/gitea.error.log;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
send_timeout 180;
proxy_connect_timeout 600;
proxy_read_timeout 600;
proxy_send_timeout 600;
client_max_body_size 1024m;
location / {
proxy_pass http://gitea/;
}
}
upstream gitea {
{{ range service "gitea" }}
server {{ .Address }}:{{ .Port }};
{{else}}
server 127.0.0.1:60000;
{{ end }}
}

46
consul-template.d/templates/grafana.tmpl Normal file
View File

@ -0,0 +1,46 @@
server {
listen 443 ssl http2;
server_name grafana.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
access_log /var/log/nginx/grafana.access.log ltsv;
error_log /var/log/nginx/grafana.error.log;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location / {
proxy_pass http://grafana/;
}
}
upstream grafana {
{{ range service "grafana" }}
server {{ .Address }}:{{ .Port }};
{{else}}
server 127.0.0.1:60000;
{{ end }}
}

103
consul-template.d/templates/guacamole.tmpl Normal file
View File

@ -0,0 +1,103 @@
server {
listen 443 ssl http2;
server_name g.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
access_log /var/log/nginx/guacamole.access.log ltsv;
error_log /var/log/nginx/guacamole.error.log;
send_timeout 180;
proxy_connect_timeout 600;
proxy_read_timeout 600;
proxy_send_timeout 600;
client_max_body_size 1024m;
http2_max_field_size 256k;
http2_max_header_size 256k;
location / {
# oauth2-proxy here:
auth_request /oauth2/auth;
error_page 401 = /oauth2/sign_in;
auth_request_set $user $upstream_http_x_auth_request_user;
auth_request_set $email $upstream_http_x_auth_request_email;
proxy_set_header X-User $user;
proxy_set_header X-Email $email;
# if you enabled --pass-access-token, this will pass the token to the backend
auth_request_set $token $upstream_http_x_auth_request_access_token;
proxy_set_header X-Access-Token $token;
# guacamole here:
proxy_pass http://g/guacamole/;
proxy_buffering off;
proxy_http_version 1.1;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_cookie_path /guacamole/ /;
}
location /oauth2/ {
proxy_pass http://127.0.0.1:4181;
# Configure proxying to auth
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri;
proxy_buffering on;
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}
location = /oauth2/auth {
proxy_pass http://127.0.0.1:4181;
# Configure proxying to auth
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
client_max_body_size "1m";
proxy_buffering on;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}
}
upstream g {
{{ range service "guacamole-guacamole" }}
server {{ .Address }}:{{ .Port }};
{{else}}
server 127.0.0.1:60000;
{{ end }}
}

46
consul-template.d/templates/pocket.tmpl Normal file
View File

@ -0,0 +1,46 @@
server {
listen 443 ssl http2;
server_name pocket.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
access_log /var/log/nginx/pocket.access.log ltsv;
error_log /var/log/nginx/pocket.error.log;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location / {
proxy_pass http://pocket;
}
}
upstream pocket {
{{ range service "archive-article" }}
server {{ .Address }}:{{ .Port }};
{{else}}
server 127.0.0.1:60000;
{{ end }}
}

23
deploy.sh Executable file
View File

@ -0,0 +1,23 @@
#!/bin/bash
set -e
CUR=`pwd`
for CONF in `find ${CUR}/sites-available/ -type f` ; do
ln -f -s ${CONF} /etc/nginx/sites-enabled/
done
for CONF in `find ${CUR}/stream-available/ -type f` ; do
ln -f -s ${CONF} /etc/nginx/sites-enabled/
done
for CONF in `find ${CUR}/consul-template.d/conf/ -type f -name "*.conf"` ; do
ln -f -s ${CONF} /etc/consul-template.d/conf/
done
for TMPL in `find ${CUR}/consul-template.d/templates/ -type f -name "*.tmpl"` ; do
ln -f -s ${TMPL} /etc/consul-template.d/templates/
done
exit 0

98
sites-available/blog Normal file
View File

@ -0,0 +1,98 @@
server {
# allow access from localhost
listen 80 reuseport backlog=1024;
listen 443 ssl http2 backlog=1024;
server_name blog.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
root /var/www/blog;
index index.html index.htm;
access_log /var/log/nginx/blog.access.log ltsv;
error_log /var/log/nginx/blog.error.log;
location / {
# http2 server push:
http2_push_preload on;
http2_push /apple-touch-icon.png;
http2_push /lib/normalize/normalize.min.css;
http2_push /css/style.min.css;
http2_push /lib/lightgallery/lightgallery.min.css;
http2_push /lib/katex/katex.min.css;
http2_push /lib/katex/copy-tex.min.css;
http2_push /lib/mapbox-gl/mapbox-gl.min.css;
http2_push /lib/smooth-scroll/smooth-scroll.min.js;
http2_push /lib/lazysizes/lazysizes.min.js;
http2_push /lib/twemoji/twemoji.min.js;
http2_push /lib/lightgallery/lightgallery.min.js;
http2_push /lib/lightgallery/lg-zoom.min.js;
http2_push /lib/clipboard/clipboard.min.js;
http2_push /lib/sharer/sharer.min.js;
http2_push /lib/katex/katex.min.js;
http2_push /lib/katex/auto-render.min.js;
http2_push /lib/katex/copy-tex.min.js;
http2_push /lib/katex/mhchem.min.js;
http2_push /js/theme.min.js;
http2_push https://embedr.flickr.com/assets/client-code.js;
http2_push https://platform.twitter.com/widgets.js;
if (-e "/tmp/maintenance") {
return 503;
}
location /feed {
return 301 http://blog.kazu634.com/index.xml;
}
location /wp-content {
return 404;
}
location ~* \.css {
gzip_static always;
expires max;
}
location ~* \.js {
gzip_static always;
expires max;
}
location /images {
gzip_static always;
expires max;
}
location = /favicon.ico {
access_log off;
empty_gif;
expires max;
}
try_files $uri $uri/ /index.html;
}
}

117
sites-available/blog-staging Normal file
View File

@ -0,0 +1,117 @@
server {
# allow access from localhost
listen 443 ssl http2;
server_name test.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
root /var/www/test;
index index.html index.htm;
access_log /var/log/nginx/stag.access.log ltsv;
error_log /var/log/nginx/stag.error.log;
http2_max_field_size 256k;
http2_max_header_size 256k;
location /oauth2/ {
proxy_pass http://127.0.0.1:4180;
# Configure proxying to auth
# proxy_pass_request_body off;
# proxy_set_header Content-Length "";
proxy_set_header Host $host;
# proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
# proxy_set_header X-Original-Method $request_method;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri;
# proxy_http_version 1.1;
# proxy_ssl_server_name on;
# proxy_pass_request_headers on;
# client_max_body_size "1m";
proxy_buffering on;
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}
location = /oauth2/auth {
proxy_pass http://127.0.0.1:4180;
# Configure proxying to auth
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header Host $host;
# proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
# proxy_set_header X-Original-Method $request_method;
# proxy_set_header X-Auth-Request-Redirect $request_uri;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
client_max_body_size "1m";
proxy_buffering on;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
}
location / {
auth_request /oauth2/auth;
error_page 401 = /oauth2/sign_in;
try_files $uri $uri/ /index.html;
auth_request_set $user $upstream_http_x_auth_request_user;
auth_request_set $email $upstream_http_x_auth_request_email;
proxy_set_header X-User $user;
proxy_set_header X-Email $email;
# if you enabled --pass-access-token, this will pass the token to the backend
auth_request_set $token $upstream_http_x_auth_request_access_token;
proxy_set_header X-Access-Token $token;
# if you enabled --cookie-refresh, this is needed for it to work with auth_request
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;
# When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
# limit and so the OAuth2 Proxy splits these into multiple parts.
# Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
# so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
# Extract the Cookie attributes from the first Set-Cookie header and append them
# to the second part ($upstream_cookie_* variables only contain the raw cookie content)
if ($auth_cookie ~* "(; .*)") {
set $auth_cookie_name_0 $auth_cookie;
set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
}
# Send both Set-Cookie headers now if there was a second part
if ($auth_cookie_name_upstream_1) {
add_header Set-Cookie $auth_cookie_name_0;
add_header Set-Cookie $auth_cookie_name_1;
}
}
}

9
sites-available/default Normal file
View File

@ -0,0 +1,9 @@
# Denies the access without the pre-defined virtual host.
server {
listen 80 default_server;
server_name _;
location / {
return 444;
}
}

38
sites-available/drone Normal file
View File

@ -0,0 +1,38 @@
server {
listen 443 ssl http2;
server_name drone.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
access_log /var/log/nginx/drone.access.log ltsv;
error_log /var/log/nginx/drone.error.log;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
location / {
proxy_pass http://192.168.10.245/;
}
}

42
sites-available/minio Normal file
View File

@ -0,0 +1,42 @@
server {
listen 443 ssl http2;
server_name minio.kazu634.com;
ssl_certificate /etc/lego/.lego/certificates/_.kazu634.com.crt;
ssl_certificate_key /etc/lego/.lego/certificates/_.kazu634.com.key;
ssl_dhparam /etc/lego/dhparams_4096.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:3m;
ssl_buffer_size 4k;
ssl_session_tickets off;
ssl_protocols TLSv1.3 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.4.4 8.8.8.8 valid=300s;
resolver_timeout 10s;
# Enable HSTS (HTTP Strict Transport Security)
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
access_log /var/log/nginx/minio.access.log ltsv;
error_log /var/log/nginx/minio.error.log;
proxy_buffering off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
ignore_invalid_headers off;
client_max_body_size 0;
location / {
proxy_pass http://192.168.10.200:9000/;
}
}