update: add all nginx config for each active services
This commit is contained in:
+139
-72
@@ -1,95 +1,162 @@
|
||||
theme: grey
|
||||
|
||||
log:
|
||||
file_path: /config/authelia.log
|
||||
keep_stdout: true
|
||||
|
||||
# Stockage (fichier SQLite local) – suffisant pour commencer
|
||||
storage:
|
||||
local:
|
||||
path: /config/db.sqlite3
|
||||
local:
|
||||
path: /config/db.sqlite3
|
||||
|
||||
# Base de données des utilisateurs (fichier)
|
||||
authentication_backend:
|
||||
file:
|
||||
path: /config/users.yml
|
||||
file:
|
||||
path: /config/users.yml
|
||||
|
||||
# Accès par défaut (à ajuster selon tes besoins)
|
||||
access_control:
|
||||
default_policy: deny
|
||||
rules:
|
||||
- domain: "paperless.crenam.space"
|
||||
policy: one_factor
|
||||
- domain: "git.crenam.space"
|
||||
policy: one_factor
|
||||
- domain: "task.crenam.space"
|
||||
policy: one_factor
|
||||
- domain: "salon.home"
|
||||
|
||||
default_policy: 'one_factor'
|
||||
rules:
|
||||
- domain:
|
||||
- "paperless.crenam.space"
|
||||
- "git.crenam.space"
|
||||
- "task.crenam.space"
|
||||
- "seafile.crenam.space"
|
||||
policy: one_factor
|
||||
|
||||
# Session et cookie
|
||||
session:
|
||||
cookies:
|
||||
- name: authelia_session
|
||||
domain: crenam.space
|
||||
authelia_url: "https://auth.crenam.space"
|
||||
default_redirection_url: "https://dashboard.crenam.space"
|
||||
expiration: '16h'
|
||||
cookies:
|
||||
- name: authelia_session
|
||||
domain: crenam.space
|
||||
authelia_url: "https://auth.crenam.space"
|
||||
default_redirection_url: "https://dashboard.crenam.space"
|
||||
expiration: "16h"
|
||||
remember_me: "1 month"
|
||||
# sercret
|
||||
|
||||
# Notifications (par mail – on laisse vide pour le moment, pas de SMTP)
|
||||
notifier:
|
||||
filesystem:
|
||||
filename: /config/notifications.yml
|
||||
disable_startup_check: true
|
||||
filesystem:
|
||||
filename: /config/notifications.yml
|
||||
|
||||
# ban regulation if attempt to penetrate the network without authorization
|
||||
regulation:
|
||||
modes:
|
||||
- "user"
|
||||
max_retries: 5
|
||||
ban_time: '10m'
|
||||
find_time: '2m'
|
||||
|
||||
# identity_validation:
|
||||
|
||||
# definitions:
|
||||
# user_attributes:
|
||||
# username
|
||||
# email
|
||||
# nickname
|
||||
|
||||
# if needed, it will be lldap
|
||||
# ldap: http://localhost:111
|
||||
#
|
||||
|
||||
# clients
|
||||
# identity_providers:
|
||||
## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
|
||||
## See: https://www.authelia.com/c/oidc
|
||||
# oidc:
|
||||
# jwks:
|
||||
# - key: {{ secret "/secrets/private.pem" | mindent 10 "|" | msquote }}
|
||||
# certificate_chain: {{ secret "/secrets/public.crt" | mindent 10 "|" | msquote }}
|
||||
# oidc:
|
||||
# # hmac secret is used for OAuth2 tokens
|
||||
# hmac_secret:
|
||||
|
||||
# clients:
|
||||
# # jwks issuer is needed to configure multiple jwk. Must be based on RS256 algorithm
|
||||
# # or on 2048 bit RSA/PA key
|
||||
# jwks:
|
||||
# # recommended not to configure this
|
||||
# - key_id: {{ secret "/secrets/private.pem" | mindent 10 "|" | msquote }}
|
||||
# # key algorithm
|
||||
# algorithm: "RS256"
|
||||
# use: "sig"
|
||||
# key: |
|
||||
# -----BEGIN PRIVATE KEY-----
|
||||
# -----END PRIVATE KEY-----
|
||||
# # Optionnally matchin certificate in PEM DER form
|
||||
# certificate_chain: {{ secret "/secrets/public.crt" | mindent 10 "|" | msquote }}
|
||||
|
||||
# # the signing algorithm used for signing discovery and metdata responses
|
||||
# # most client ignore this so set it to none
|
||||
# discovery_signed_response_alg: 'none'
|
||||
|
||||
# # the signing key used for signing discovery and metdata responses
|
||||
# # most client ignore this so set it to ''
|
||||
# discovery_signed_response_key_id: ''
|
||||
|
||||
# # authorization policies
|
||||
# authorization_policy:
|
||||
# policy_name:
|
||||
# default_policy: 'two_factor'
|
||||
# rules:
|
||||
# - policy: 'one_factor'
|
||||
# subject: 'group:services'
|
||||
|
||||
# clients:
|
||||
#########################################
|
||||
# sso configuration for vikunja #
|
||||
#########################################
|
||||
# - client_id: 'vikunja'
|
||||
# client_name: 'Vikunja'
|
||||
# client_secret: '$pbkdf2-sha512$310000$hPnUYU6BCaRSZYulOiWXwA$5hsAJD494cyoQ/X9JlAbsMF//yGDg009lfDe2WhGQjl5JA>
|
||||
# public: false
|
||||
# authorization_policy: 'one_factor'
|
||||
# require_pkce: false
|
||||
# pkce_challenge_method: ''
|
||||
# redirect_uris:
|
||||
# - 'https://task.crenam.space/auth/openid/authelia'
|
||||
# - 'https://task.crenam.space/login?redirectToProvider=authentik'
|
||||
# scopes:
|
||||
# - 'openid'
|
||||
# - 'profile'
|
||||
# - 'email'
|
||||
# response_types:
|
||||
# - 'code'
|
||||
# grant_types:
|
||||
# - 'authorization_code'
|
||||
# access_token_signed_response_alg: 'none'
|
||||
# userinfo_signed_response_alg: 'none'
|
||||
# token_endpoint_auth_method: 'client_secret_post'
|
||||
# - client_id: 'vikunja'
|
||||
# client_name: 'Vikunja'
|
||||
# # generated with
|
||||
# client_secret: '$pbkdf2-sha512$310000$hPnUYU6BCaRSZYulOiWXwA$5hsAJD494cyoQ/X9JlAbsMF//yGDg009lfDe2WhGQ>
|
||||
# public: false
|
||||
# redirect_uris:
|
||||
# - 'https://task.crenam.space/auth/openid/authelia'
|
||||
# - 'https://task.crenam.space/login?redirectToProvider=authentik'
|
||||
#
|
||||
# # audience this client is allowed to request
|
||||
# audience: []
|
||||
# # scopes this client is allowed to request
|
||||
# scopes:
|
||||
# -
|
||||
#
|
||||
# # list of response modes the client support
|
||||
# response_modes:
|
||||
# - 'form_post'
|
||||
# - 'query'
|
||||
# # the policy required for this client
|
||||
# # can also be the key names fot eh authorization policies section
|
||||
# authorization_policy: 'one_factor'
|
||||
# require_pkce: false
|
||||
# pkce_challenge_method: ''
|
||||
# scopes:
|
||||
# - 'openid'
|
||||
# - 'profile'
|
||||
# - 'email'
|
||||
# response_types:
|
||||
# - 'code'
|
||||
# grant_types:
|
||||
# - 'authorization_code'
|
||||
# access_token_signed_response_alg: 'none'
|
||||
# userinfo_signed_response_alg: 'none'
|
||||
# token_endpoint_auth_method: 'client_secret_post'
|
||||
|
||||
#########################################
|
||||
# config sso for gitea #
|
||||
#########################################
|
||||
# - client_id: 'gitea'
|
||||
# client_name: 'Gitea'
|
||||
# client_secret: '$pbkdf2-sha512$310000$pJR7colZSiWF7SWIfUsoqg$IGGqIZGVqcpXpzVCBgptZ3zBMqpFk4oaIKvOZPa1fn/GIg>
|
||||
# public: false
|
||||
# authorization_policy: 'one_factor'
|
||||
# require_pkce: false
|
||||
# pkce_challenge_method: ''
|
||||
# redirect_uris:
|
||||
# - 'https://git.crenam.space/user/oauth2/authelia/callback'
|
||||
# scopes:
|
||||
# - 'openid'
|
||||
# - 'email'
|
||||
# - 'profile'
|
||||
# response_types:
|
||||
# - 'code'
|
||||
# grant_types:
|
||||
# - 'authorization_code'
|
||||
# access_token_signed_response_alg: 'none'
|
||||
# userinfo_signed_response_alg: 'none'
|
||||
# token_endpoint_auth_method: 'client_secret_basic'
|
||||
|
||||
# - client_id: 'gitea'
|
||||
# client_name: 'Gitea'
|
||||
# client_secret: '$pbkdf2-sha512$310000$pJR7colZSiWF7SWIfUsoqg$IGGqIZGVqcpXpzVCBgptZ3zBMqpFk4oaIKvOZPa1f>
|
||||
# public: false
|
||||
# authorization_policy: 'one_factor'
|
||||
# require_pkce: false
|
||||
# pkce_challenge_method: ''
|
||||
# redirect_uris:
|
||||
# - 'https://git.crenam.space/user/oauth2/authelia/callback'
|
||||
# scopes:
|
||||
# - 'openid'
|
||||
# - 'email'
|
||||
# - 'profile'
|
||||
# response_types:
|
||||
# - 'code'
|
||||
# grant_types:
|
||||
# - 'authorization_code'
|
||||
# access_token_signed_response_alg: 'none'
|
||||
# userinfo_signed_response_alg: 'none'
|
||||
# token_endpoint_auth_method: 'client_secret_basic'
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
server {
|
||||
if ($host = www.affine.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = affine.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name affine.crenam.space www.affine.crenam.space;
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name affine.crenam.space www.affine.crenam.space;
|
||||
ssl_certificate /etc/letsencrypt/live/affine.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/affine.crenam.space/privkey.pem; # managed by Certbot
|
||||
|
||||
# Maximum allowed upload size.
|
||||
client_max_body_size 100m;
|
||||
|
||||
# Set required headers.
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# WebSocket config for the sync system.
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
# to add to configs for sso auth
|
||||
# include /etc/nginx/snippets/authelia-verify.conf;
|
||||
|
||||
location / {
|
||||
# to add to configs for sso auth
|
||||
# include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||
proxy_pass http://localhost:3010;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
server {
|
||||
if ($host = aliasvault.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name aliasvault.crenam.space;
|
||||
return 301 https://$host$request_uri;
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name aliasvault.crenam.space;
|
||||
|
||||
client_max_body_size 100m;
|
||||
|
||||
location / {
|
||||
proxy_pass http://192.168.1.15:8008;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/aliasvault.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/aliasvault.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
server {
|
||||
if ($host = auth.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name auth.crenam.space;
|
||||
|
||||
return 301 https://$server_name$request_uri;
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name auth.crenam.space;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/auth.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/auth.crenam.space/privkey.pem; # managed by Certbot
|
||||
|
||||
set $upstream http://192.168.27.69:9091;
|
||||
|
||||
location / {
|
||||
include /etc/nginx/snippets/proxy.conf;
|
||||
proxy_pass $upstream;
|
||||
proxy_cache_bypass $cookie_session;
|
||||
proxy_no_cache $cookie_session;
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,91 @@
|
||||
##
|
||||
# You should look at the following URL's in order to grasp a solid understanding
|
||||
# of Nginx configuration files in order to fully unleash the power of Nginx.
|
||||
# https://www.nginx.com/resources/wiki/start/
|
||||
# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
|
||||
# https://wiki.debian.org/Nginx/DirectoryStructure
|
||||
#
|
||||
# In most cases, administrators will remove this file from sites-enabled/ and
|
||||
# leave it as reference inside of sites-available where it will continue to be
|
||||
# updated by the nginx packaging team.
|
||||
#
|
||||
# This file will automatically load configuration files provided by other
|
||||
# applications, such as Drupal or Wordpress. These applications will be made
|
||||
# available underneath a path with that package name, such as /drupal8.
|
||||
#
|
||||
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
|
||||
##
|
||||
|
||||
# Default server configuration
|
||||
#
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
|
||||
# SSL configuration
|
||||
#
|
||||
# listen 443 ssl default_server;
|
||||
# listen [::]:443 ssl default_server;
|
||||
#
|
||||
# Note: You should disable gzip for SSL traffic.
|
||||
# See: https://bugs.debian.org/773332
|
||||
#
|
||||
# Read up on ssl_ciphers to ensure a secure configuration.
|
||||
# See: https://bugs.debian.org/765782
|
||||
#
|
||||
# Self signed certs generated by the ssl-cert package
|
||||
# Don't use them in a production server!
|
||||
#
|
||||
# include snippets/snakeoil.conf;
|
||||
|
||||
root /var/www/html;
|
||||
|
||||
# Add index.php to the list if you are using PHP
|
||||
index index.html index.htm index.nginx-debian.html;
|
||||
|
||||
server_name _;
|
||||
|
||||
location / {
|
||||
# First attempt to serve request as file, then
|
||||
# as directory, then fall back to displaying a 404.
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
|
||||
# pass PHP scripts to FastCGI server
|
||||
#
|
||||
#location ~ \.php$ {
|
||||
# include snippets/fastcgi-php.conf;
|
||||
#
|
||||
# # With php-fpm (or other unix sockets):
|
||||
# fastcgi_pass unix:/run/php/php7.4-fpm.sock;
|
||||
# # With php-cgi (or other tcp sockets):
|
||||
# fastcgi_pass 127.0.0.1:9000;
|
||||
#}
|
||||
|
||||
# deny access to .htaccess files, if Apache's document root
|
||||
# concurs with nginx's one
|
||||
#
|
||||
#location ~ /\.ht {
|
||||
# deny all;
|
||||
#}
|
||||
}
|
||||
|
||||
|
||||
# Virtual Host configuration for example.com
|
||||
#
|
||||
# You can move that to a different file under sites-available/ and symlink that
|
||||
# to sites-enabled/ to enable it.
|
||||
#
|
||||
#server {
|
||||
# listen 80;
|
||||
# listen [::]:80;
|
||||
#
|
||||
# server_name example.com;
|
||||
#
|
||||
# root /var/www/example.com;
|
||||
# index index.html;
|
||||
#
|
||||
# location / {
|
||||
# try_files $uri $uri/ =404;
|
||||
# }
|
||||
#}
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
server {
|
||||
if ($host = www.git.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = git.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name git.crenam.space www.git.crenam.space;
|
||||
|
||||
location / {
|
||||
return 301 https://git.crenam.space$request_uri;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name git.crenam.space www.git.crenam.space;
|
||||
|
||||
# ---------- Authelia ----------
|
||||
# include /etc/nginx/snippets/authelia-verify.conf;
|
||||
|
||||
location / {
|
||||
client_max_body_size 512M;
|
||||
|
||||
# include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||
|
||||
# auth_request_set $auth_user $upstream_http_remote_user;
|
||||
# proxy_set_header X-Webauth-user $auth_user;
|
||||
|
||||
proxy_pass http://192.168.1.15:3000;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/git.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/git.crenam.space/privkey.pem; # managed by Certbot
|
||||
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
server {
|
||||
if ($host = www.dashboard.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = dashboard.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name dashboard.crenam.space www.dashboard.crenam.space;
|
||||
return 301 https://dashboard.crenam.space$request_uri;
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name dashboard.crenam.space www.dashboard.crenam.space;
|
||||
|
||||
location / {
|
||||
proxy_pass http://192.168.1.15:7575;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/dashboard.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/dashboard.crenam.space/privkey.pem; # managed by Certbot
|
||||
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
|
||||
access_log /var/log/nginx/ess.log;
|
||||
error_log /var/log/nginx/ess.errors;
|
||||
ssl_certificate /etc/letsencrypt/live/ess/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/ess/privkey.pem; # managed by Certbot
|
||||
|
||||
#TLSv1.2 is required for iOS support for now
|
||||
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||
ssl_session_cache shared:le_nginx_SSL:10m;
|
||||
ssl_session_timeout 1440m;
|
||||
ssl_session_tickets off;
|
||||
ssl_buffer_size 4k;
|
||||
# ssl_stapling on;
|
||||
# ssl_stapling_verify on;
|
||||
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
|
||||
|
||||
server_name admin.element.crenam.space chat.element.crenam.space matrix.element.crenam.space account.element.crenam.space mrtc.element.crenam.space element.crenam.space;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_set_header X-Forwarded-For $remote_addr;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
client_max_body_size 50M;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
|
||||
proxy_read_timeout 86400s;
|
||||
proxy_send_timeout 86400s;
|
||||
proxy_buffering off;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
if ($host = element.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = admin.element.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = chat.element.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = mrtc.element.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = account.element.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = matrix.element.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name admin.element.crenam.space chat.element.crenam.space matrix.element.crenam.space account.element.crenam.space mrtc.element.crenam.space element.crenam.space;
|
||||
return 301 https://$host$request_uri;
|
||||
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
server {
|
||||
listen 80;
|
||||
server_name mealie.crenam.space;
|
||||
|
||||
if ($host = mealie.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name mealie.crenam.space;
|
||||
|
||||
# En-têtes de sécurité
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
|
||||
location / {
|
||||
proxy_pass http://192.168.1.30:9925;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Désactiver le buffering pour WebSocket si besoin (Mealie ne semble pas en avoir besoin)
|
||||
proxy_buffering off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/mealie.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/mealie.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
server {
|
||||
if ($host = n8n.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name n8n.crenam.space;
|
||||
return 301 https://$server_name$request_uri;
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name n8n.crenam.space;
|
||||
|
||||
location / {
|
||||
proxy_pass http://192.168.1.30:5678; # IP de Gaufre sur le réseau local
|
||||
|
||||
client_max_body_size 20M;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Port $server_port;
|
||||
}
|
||||
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/n8n.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/n8n.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
+67
@@ -0,0 +1,67 @@
|
||||
# /etc/nginx/sites-*/ntfy
|
||||
#
|
||||
# This config requires the use of the -L flag in curl to redirect to HTTPS, and it keeps nginx output buffering
|
||||
# enabled. While recommended, I have had issues with that in the past.
|
||||
|
||||
server {
|
||||
if ($host = ntfy.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name ntfy.crenam.space;
|
||||
|
||||
location / {
|
||||
return 302 https://$http_host$request_uri$is_args$query_string;
|
||||
|
||||
proxy_pass http://192.168.1.15:810;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_connect_timeout 3m;
|
||||
proxy_send_timeout 3m;
|
||||
proxy_read_timeout 3m;
|
||||
|
||||
client_max_body_size 0; # Stream request body to backend
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name ntfy.crenam.space;
|
||||
|
||||
# See https://ssl-config.mozilla.org/#server=nginx&version=1.18.0&config=intermediate&openssl=1.1.1k&hsts=false&ocsp=false&guideline=5.6
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
|
||||
ssl_session_tickets off;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
|
||||
location / {
|
||||
proxy_pass http://192.168.1.15:810;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
|
||||
proxy_connect_timeout 3m;
|
||||
proxy_send_timeout 3m;
|
||||
proxy_read_timeout 3m;
|
||||
|
||||
client_max_body_size 0; # Stream request body to backend
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/ntfy.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/ntfy.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
+108
@@ -0,0 +1,108 @@
|
||||
upstream openwebui {
|
||||
# server 10.43.14.141:80;
|
||||
server 51.210.13.240:3000;
|
||||
keepalive 128;
|
||||
keepalive_timeout 1800s;
|
||||
keepalive_requests 10000;
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
if ($host = llm.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name llm.crenam.space; # ou un autre sous-domaine
|
||||
return 301 https://$host$request_uri;
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name llm.crenam.space;
|
||||
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-AES128-GCM-SHA256';
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
gzip on;
|
||||
gzip_types text/plain text/css application/javascript image/svg+xml;
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://openwebui;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
|
||||
|
||||
# CRITICAL: Disable all buffering for streaming
|
||||
gzip off;
|
||||
proxy_buffering off;
|
||||
proxy_request_buffering off;
|
||||
proxy_cache off;
|
||||
tcp_nodelay on;
|
||||
add_header X-Accel-Buffering "no" always;
|
||||
add_header Cache-Control "no-store" always;
|
||||
|
||||
|
||||
# Extended timeouts for LLM completions
|
||||
proxy_connect_timeout 1800;
|
||||
proxy_send_timeout 1800;
|
||||
proxy_read_timeout 1800;
|
||||
}
|
||||
|
||||
|
||||
|
||||
# WebSocket connections need even longer timeouts
|
||||
|
||||
location ~ ^/(ws/|socket\.io/) {
|
||||
proxy_pass http://openwebui;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
gzip off;
|
||||
proxy_buffering off;
|
||||
proxy_cache off;
|
||||
|
||||
# 24-hour timeout for persistent connections
|
||||
proxy_connect_timeout 86400;
|
||||
proxy_send_timeout 86400;
|
||||
proxy_read_timeout 86400;
|
||||
}
|
||||
|
||||
|
||||
# Static assets - CAN buffer and cache
|
||||
location /static/ {
|
||||
proxy_pass http://openwebui;
|
||||
proxy_buffering on;
|
||||
proxy_cache_valid 200 7d;
|
||||
add_header Cache-Control "public, max-age=604800, immutable";
|
||||
}
|
||||
|
||||
|
||||
|
||||
# Default location
|
||||
|
||||
location / {
|
||||
proxy_pass http://openwebui;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/llm.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/llm.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
@@ -0,0 +1,34 @@
|
||||
server {
|
||||
if ($host = paperless.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name paperless.crenam.space;
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name paperless.crenam.space;
|
||||
|
||||
proxy_redirect off;
|
||||
proxy_buffering off;
|
||||
|
||||
# Authelia Remote User
|
||||
include /etc/nginx/snippets/authelia-location.conf;
|
||||
|
||||
location / {
|
||||
include /etc/nginx/snippets/proxy.conf;
|
||||
include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||
proxy_pass http://192.168.1.15:8101;
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/paperless.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/paperless.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
server {
|
||||
if ($host = www.radicale.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
if ($host = radicale.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name radicale.crenam.space www.radicale.crenam.space;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name radicale.crenam.space;
|
||||
client_max_body_size 512M;
|
||||
|
||||
location / {
|
||||
proxy_pass http://192.168.1.20:5232;
|
||||
proxy_set_header X-Script-Name /radicale;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Port $server_port;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_pass_header Authorization;
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/radicale.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/radicale.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
log_format seafileformat '$http_x_forwarded_for $remote_addr [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $upstream_response_time';
|
||||
|
||||
server {
|
||||
if ($host = seafile.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name seafile.crenam.space;
|
||||
location / {
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name seafile.crenam.space;
|
||||
|
||||
include /etc/nginx/snippets/authelia-location.conf;
|
||||
|
||||
location / {
|
||||
include /etc/nginx/snippets/proxy.conf;
|
||||
include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||
|
||||
proxy_pass http://192.168.1.30:80;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Connection "";
|
||||
|
||||
client_max_body_size 0;
|
||||
}
|
||||
|
||||
location /sdoc-server/ {
|
||||
include /etc/nginx/snippets/proxy.conf;
|
||||
|
||||
proxy_pass http://192.168.1.30:8888/;
|
||||
client_max_body_size 100m;
|
||||
}
|
||||
|
||||
location /socket.io {
|
||||
include /etc/nginx/snippets/websocket.conf;
|
||||
|
||||
proxy_pass http://192.168.1.30:8888;
|
||||
proxy_redirect off;
|
||||
|
||||
proxy_buffer_size 64k;
|
||||
proxy_buffers 8 32k;
|
||||
proxy_busy_buffers_size 64k;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-NginX-Proxy true;
|
||||
}
|
||||
|
||||
location /notification/ping {
|
||||
proxy_pass http://192.168.1.30:8083/ping;
|
||||
access_log /var/log/nginx/notification.access.log seafileformat;
|
||||
error_log /var/log/nginx/notification.error.log;
|
||||
}
|
||||
|
||||
location /notification {
|
||||
include /etc/nginx/snippets/proxy.conf;
|
||||
include /etc/nginx/snippets/websocket.conf;
|
||||
|
||||
proxy_pass http://192.168.1.30:8083;
|
||||
access_log /var/log/nginx/notification.access.log seafileformat;
|
||||
error_log /var/log/nginx/notification.error.log;
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/seafile.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/seafile.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
server {
|
||||
if ($host = task.crenam.space) {
|
||||
return 301 https://$host$request_uri;
|
||||
} # managed by Certbot
|
||||
|
||||
|
||||
listen 80;
|
||||
server_name task.crenam.space;
|
||||
return 301 https://$server_name$request_uri;
|
||||
|
||||
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name task.crenam.space;
|
||||
|
||||
# Protection générale avec Authelia
|
||||
# include /etc/nginx/snippets/authelia-verify.conf;
|
||||
|
||||
location / {
|
||||
# include /etc/nginx/snippets/authelia-authrequest.conf;
|
||||
|
||||
proxy_pass http://192.168.1.30:3456; # IP de Gaufre sur le réseau local
|
||||
|
||||
client_max_body_size 20M;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Host $host;
|
||||
proxy_set_header X-Forwarded-Port $server_port;
|
||||
}
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/task.crenam.space/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/task.crenam.space/privkey.pem; # managed by Certbot
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
##############################################################################
|
||||
# Paperless-ngx settings #
|
||||
###############################################################################
|
||||
|
||||
# See http://docs.paperless-ngx.com/configuration/ for all available options.
|
||||
|
||||
# The UID and GID of the user used to run paperless in the container. Set this
|
||||
# to your UID and GID on the host so that you have write access to the
|
||||
# consumption directory.
|
||||
USERMAP_UID=999
|
||||
USERMAP_GID=984
|
||||
|
||||
# See the documentation linked above for all options. A few commonly adjusted settings
|
||||
# are provided below.
|
||||
|
||||
# This is required if you will be exposing Paperless-ngx on a public domain
|
||||
# (if doing so please consider security measures such as reverse proxy)
|
||||
PAPERLESS_URL=https://paperless.crenam.space
|
||||
|
||||
# Adjust this key if you plan to make paperless available publicly. It should
|
||||
# be a very long sequence of random characters. You don't need to remember it.
|
||||
PAPERLESS_SECRET_KEY=1c5e636bb450d4903c335af08cde34262e9cd6fdcb71d983b7f9240f4344b8dd
|
||||
|
||||
# Use this variable to set a timezone for the Paperless Docker containers. Defaults to UTC.
|
||||
PAPERLESS_TIME_ZONE=Europe/Paris
|
||||
|
||||
# The default language to use for OCR. Set this to the language most of your
|
||||
# documents are written in.
|
||||
PAPERLESS_OCR_LANGUAGE=fra
|
||||
|
||||
# Additional languages to install for text recognition, separated by a whitespace.
|
||||
# Note that this is different from PAPERLESS_OCR_LANGUAGE (default=eng), which defines
|
||||
# the language used for OCR.
|
||||
# The container installs English, German, Italian, Spanish and French by default.
|
||||
# See https://packages.debian.org/search?keywords=tesseract-ocr-&searchon=names
|
||||
# for available languages.
|
||||
PAPERLESS_OCR_LANGUAGES=eng
|
||||
|
||||
# Database configurations
|
||||
PAPERLESS_DBHOST=192.168.27.69
|
||||
PAPERLESS_DBPORT=5432
|
||||
PAPERLESS_DBNAME=paperless
|
||||
PAPERLESS_DBUSER=paperless
|
||||
PAPERLESS_DBPASS=9lPYFd04mNFF0XQYzq
|
||||
|
||||
# Authelia SSO configurations
|
||||
PAPERLESS_ENABLE_HTTP_REMOTE_USER=true
|
||||
PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME=HTTP_REMOTE_USER
|
||||
PAPERLESS_LOGOUT_REDIRECT_URL=https://auth.crenam.space/logout
|
||||
@@ -0,0 +1,45 @@
|
||||
#
|
||||
# - Paperless is (re)started on system boot, if it was running before shutdown.
|
||||
# - Docker volumes for storing data are managed by Docker.
|
||||
# - Folders for importing and exporting files are created in the same directory
|
||||
# as this file and mounted to the correct folders inside the container.
|
||||
# - Paperless listens on port 8000.
|
||||
#
|
||||
# In addition to that, this Docker Compose file adds the following optional
|
||||
# configurations:
|
||||
#
|
||||
# - Instead of SQLite (default), PostgreSQL is used as the database server.
|
||||
#
|
||||
# To install and update paperless with this file, do the following:
|
||||
#
|
||||
# - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
|
||||
# and '.env' into a folder.
|
||||
# - Run 'docker compose pull'.
|
||||
# - Run 'docker compose up -d'.
|
||||
#
|
||||
# For more extensive installation and update instructions, refer to the
|
||||
# documentation.
|
||||
services:
|
||||
broker:
|
||||
image: docker.io/library/redis:8
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ./redisdata:/data
|
||||
webserver:
|
||||
image: ghcr.io/paperless-ngx/paperless-ngx:latest
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- broker
|
||||
ports:
|
||||
- "8101:8000"
|
||||
volumes:
|
||||
- ./data:/usr/src/paperless/data
|
||||
- ./media:/usr/src/paperless/media
|
||||
- ./export:/usr/src/paperless/export
|
||||
- /mnt/freebox/data/inbox:/usr/src/paperless/consume
|
||||
env_file: docker-compose.env
|
||||
environment:
|
||||
PAPERLESS_REDIS: redis://broker:6379
|
||||
# AUTHELIA ENV VARIABLES
|
||||
PAPERLESS_ENABLE_HTTP_REMOTE_USER: true
|
||||
PAPERLESS_HTTP_REMOTE_USER_HEADER_NAME: HTTP_REMOTE_USER
|
||||
Reference in New Issue
Block a user