Skip to content

Instantly share code, notes, and snippets.

@AnrDaemon

AnrDaemon/cloud.rootdir.org-proxy.conf

Last active June 17, 2022 08:46
Show Gist options
  • Save AnrDaemon/f063cc2f699d9f6161f75584e854bcf5 to your computer and use it in GitHub Desktop.
Save AnrDaemon/f063cc2f699d9f6161f75584e854bcf5 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Andrey Repin revised this gist Jun 17, 2022. 2 changed files with 46 additions and 0 deletions.
    40 changes: 40 additions & 0 deletions extras_forward_x_map
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,40 @@
    # Define default protocols' ports
    map $scheme $def_port {
    "http" ":80";
    "https" ":443";
    default "";
    }

    # Assert trusted remote address.
    geo $realip_remote_addr $x_trusted {
    127.0.0.0/8 1;
    192.168.1.6 1;
    default 0;
    }

    map $x_trusted $x_tmp_proto {
    1 $http_x_forwarded_proto;
    default $scheme;
    }
    map $x_tmp_proto $x_forwarded_proto {
    "" $scheme;
    default $x_tmp_proto;
    }

    map $x_trusted $x_tmp_host {
    1 $http_x_forwarded_host;
    default $host:$server_port;
    }
    map $x_tmp_host $x_forwarded_host {
    "" $host:$server_port;
    default $x_tmp_host;
    }

    map $x_trusted $x_tmp_port {
    1 $http_x_forwarded_port;
    default $server_port;
    }
    map $x_tmp_port $x_forwarded_port {
    "" $server_port;
    default $x_tmp_port;
    }
    6 changes: 6 additions & 0 deletions extras_proxy_upstream
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,6 @@
    # Trust this upstream.
    set_real_ip_from 127.0.0.0/8;
    set_real_ip_from 192.168.1.5;
    set_real_ip_from 192.168.1.6;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;
  2. AnrDaemon revised this gist Jun 16, 2022. 2 changed files with 27 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions extras_fix-http-destination
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,5 @@
    set $fixed_destination $http_destination;
    if ( $http_destination ~* ^https(.*)$ ) {
    set $fixed_destination http$1;
    }
    proxy_set_header Destination $fixed_destination;
    22 changes: 22 additions & 0 deletions extras_proxy_pass
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,22 @@
    # Force proxy keepalives.
    proxy_http_version 1.1;

    set $use_port ":$server_port";
    if ( "$use_port" = "$def_port" ) {
    set $use_port "";
    }

    # Force rewrite of common mislocations.
    proxy_redirect default;
    proxy_redirect "//$host:$proxy_port/" "$scheme://$host$use_port/";
    proxy_redirect "http://$host:$proxy_port/" "$scheme://$host$use_port/";
    proxy_redirect "https://$host:$proxy_port/" "$scheme://$host$use_port/";

    # Set origin headers for proxied server.
    proxy_set_header Host $host;
    proxy_set_header Connection "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_set_header X-Forwarded-Host $x_forwarded_host;
    proxy_set_header X-Forwarded-Port $x_forwarded_port;
    proxy_set_header X-Forwarded-Proto $x_forwarded_proto;
  3. AnrDaemon created this gist Jun 16, 2022.
    39 changes: 39 additions & 0 deletions cloud.rootdir.org-proxy.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,39 @@
    server {
    server_name
    cloud.rootdir.org
    cloud.darkdragon.lan
    ;

    error_log syslog error;
    access_log off;

    listen 80;
    return 301 https://$host$request_uri;
    }

    server {
    server_name
    cloud.rootdir.org
    ;

    listen 443 ssl http2;
    ssl_certificate "/etc/ssl/cloud.rootdir.org.crt";
    ssl_certificate_key "/etc/ssl/private/cloud.rootdir.org.key";

    error_log syslog error;
    access_log off;

    # Local filter block.
    #include extras/access_local;

    location / {
    proxy_pass http://cloud.darkdragon.lan/;

    include extras/proxy_pass;
    include extras/fix-http-destination;

    client_max_body_size 512M;

    proxy_read_timeout 60s;
    }
    }