Deathbybandaid: Created page with " =Reverse Proxy (rough)= Below is a very rough outline of an nginx reverse proxy setup cd /etc/nginx nano nginx.conf ## Global Settings include /etc/nginx/conf/globals.conf; http { ## United States only # requires apt-get install geoip-database # geoip_country /usr/share/GeoIP/GeoIP.dat; # map $geoip_country_code $allowed_country {default yes; US yes;} ## Settings include /etc/nginx/conf/settings.conf; ##..."

2021-12-08T20:12:28Z

Created page with " =Reverse Proxy (rough)= Below is a very rough outline of an nginx reverse proxy setup <nowiki>cd /etc/nginx</nowiki> <nowiki>nano nginx.conf</nowiki> <nowiki> ## Global Settings include /etc/nginx/conf/globals.conf; http { ## United States only # requires apt-get install geoip-database # geoip_country /usr/share/GeoIP/GeoIP.dat; # map $geoip_country_code $allowed_country {default yes; US yes;} ## Settings include /etc/nginx/conf/settings.conf; ##..."

New page

=Reverse Proxy (rough)=
Below is a very rough outline of an nginx reverse proxy setup
<nowiki>cd /etc/nginx</nowiki>

<nowiki>nano nginx.conf</nowiki>

<nowiki>
## Global Settings
include /etc/nginx/conf/globals.conf;

http {

## United States only
# requires apt-get install geoip-database
# geoip_country /usr/share/GeoIP/GeoIP.dat;
# map $geoip_country_code $allowed_country {default yes; US yes;}

## Settings
include /etc/nginx/conf/settings.conf;

## Security stuff
include /etc/nginx/conf/securitystuff.conf;

### Default port 80 when accessed by external IP
server {listen 80 default_server; server_name ""; return 401;}

## local site
include /etc/nginx/conf/localsite.conf;

## domains
include /etc/nginx/conf/my-domains/*;

}

</nowiki>

<nowiki>mkdir conf</nowiki>

<nowiki>cd conf</nowiki>

<nowiki>mkdir my-domains</nowiki>

<nowiki>mkdir htpc</nowiki>

<nowiki>nano settings.conf</nowiki>

<nowiki>
## Basics
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
server_names_hash_bucket_size 64;

include /etc/nginx/mime.types;
default_type application/octet-stream;

## ssl
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;

## Logging
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;

## Gzip
gzip on;
gzip_disable "msie6";

## Perfect Forward Secrecy
# requires openssl dhparam -out dh4096.pem 4096
# include /etc/nginx/perfect-forward-secrecy.conf;
</nowiki>

<nowiki>nano securitystuff.conf</nowiki>

<nowiki>
# don't send the nginx version number in error pages and Server header
server_tokens off;

# config to don't allow the browser to render the page inside an frame or iframe
# and avoid clickjacking http://en.wikipedia.org/wiki/Clickjacking
# if you need to allow [i]frames, you can use SAMEORIGIN or even set an uri with ALLOW-FROM uri
# https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options
add_header X-Frame-Options SAMEORIGIN;

# when serving user-supplied content, include a X-Content-Type-Options: nosniff header along with the Content-Type: header,
# to disable content-type sniffing on some browsers.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
# currently suppoorted in IE > 8 http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx
# http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx
# 'soon' on Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=471020
add_header X-Content-Type-Options nosniff;

# This header enables the Cross-site scripting (XSS) filter built into most recent web browsers.
# It's usually enabled by default anyway, so the role of this header is to re-enable the filter for
# this particular website if it was disabled by the user.
# https://www.owasp.org/index.php/List_of_useful_HTTP_headers
add_header X-XSS-Protection "1; mode=block";

# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
# you can tell the browser that it can only download content from the domains you explicitly allow
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
# https://www.owasp.org/index.php/Content_Security_Policy
# I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
# directives for css and js(if you have inline css or js, you will need to keep it too).
# more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
#add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ssl.google-analytics.com https://assets.zendesk.com https://connect.facebook.net; img-src 'self' https://ssl.google-analyti$

## Refer
add_header Referrer-Policy "no-referrer";
</nowiki>

<nowiki>nano localsite.conf</nowiki>

<nowiki>
server {
listen 85;

# localsite location
root /var/www/deathbybandaid/;
index index.html index.php;

# if you have htpc configs like /radarr
include /etc/nginx/conf/htpc/*.conf;

# custom error pages
# include /etc/nginx/conf/errorpages.conf;

# proxy settings
include /etc/nginx/conf/proxysettings.conf;

# php
include /etc/nginx/include/php;
}
</nowiki>

<nowiki>nano proxysettings.conf</nowiki>

<nowiki>
## Proxy Settings
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_connect_timeout 1;
proxy_next_upstream error timeout http_500 http_502 http_503 http_504 http_404;
proxy_intercept_errors on;
</nowiki>
=Domains stuff=
==letsencrypt==
learn how to use it, and point at your keys
==basic subdomain layout==
This is an example subdomain fie
<nowiki>
## 80
server {listen 80;
server_name chat.spicebot.net;
root /var/www/deathbybandaid/;
location / {alias /var/deathbybandaid/;}
location ~ /.well-known {allow all;}
return 301 https://$server_name$request_uri;
}

## 443
server {listen 443 ssl;
server_name chat.spicebot.net;

## location
root /var/www/deathbybandaid;
index index.php index.html index.htm;

location / {proxy_pass http://192.168.2.219:8065;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forward-Proto http;
proxy_set_header X-Nginx-Proxy true;
proxy_redirect off;}

## error
include /etc/nginx/conf/errorpages.conf;

## htpc configs
# include /etc/nginx/conf/htpc/*.conf;

## ssl
ssl_certificate /etc/letsencrypt/live/deathbybandaid.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/deathbybandaid.net/privkey.pem;
location ~ /.well-known {allow all;}

### End of Subdomain
}

</nowiki>
=HTPC stuff=
Each of these is a file in the htpc folder
==Deluge==
<nowiki>
## deluge
location /deluge {
proxy_pass http://192.168.2.181:8112/;
proxy_set_header X-Deluge-Base "/deluge/";
}
</nowiki>
==Jackett==
<nowiki>
## Jackett
location /jackett {
proxy_pass http://192.168.2.173:9117;
proxy_set_header X-Deluge-Base "/deluge/";
}
</nowiki>
==Sonarr Radarr Lidarr==
<nowiki>
## Lidarr
location /lidarr {
proxy_pass http://192.168.2.192:8686;
}
</nowiki>
==nzbhydra==
<nowiki>
## nzbhydra
location /nzbhydra {
proxy_pass http://192.168.2.170:5075;
</nowiki>
==Ombi==
<nowiki>
## Ombi
#location /ombi {
#proxy_pass http://192.168.2.161:5000;
#include /etc/nginx/conf/proxy.conf;
#}

#OMBIV3 CONTAINER

location /ombi {
return 301 $scheme://$host/ombi/;
}

location /ombi/ {
proxy_pass http://192.168.2.161:5000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Ssl on;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 90;
proxy_redirect http://192.168.1.161:5000 https://$host;
}

#The below is required after version 3.0.2517. This basically rewrites the requests to /dist/1.js to
#/ombi/dist/1.js where the number 1 could be any number

if ($http_referer ~* /ombi/) {rewrite ^/dist/(.*) $scheme://$host/ombi/dist/$1 permanent;}
#If you use a custom URL base remember the change it on the rewrite.

</nowiki>
==nzbhydra==
<nowiki>
## nzbhydra
location /nzbhydra {
proxy_pass http://192.168.2.170:5075;
</nowiki>
=Custom error pages=
<nowiki>nano errorpages.conf</nowiki>

<nowiki>
# Error & Access logs
error_log /var/www/deathbybandaid/logs/error.log error;
access_log /var/www/deathbybandaid/logs/access.log;

## Error Pages
error_page 400 /400.html;
error_page 401 /401.html;
error_page 403 /403.html;
error_page 404 /404.html;
error_page 408 /408.html;
error_page 410 /410.html;
error_page 500 /500.html;
error_page 502 /502.html;
error_page 503 /503.html;
error_page 504 /504.html;
#400
location = /400.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#401
location = /401.html {
root /var/www/deathbybandaid/errorpages/nginx;}
## 403
location = /403.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#404
location = /404.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#408
location = /408.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#410
location = /410.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#500
location = /500.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#502
location = /502.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#503
location = /503.html {
root /var/www/deathbybandaid/errorpages/nginx;}
#504
location = /504.html {
root /var/www/deathbybandaid/errorpages/nginx;}
</nowiki>

Nginx - Revision history