HALF WORK: 2024.1.20 - 4

9 files changed, 144 insertions, 0 deletions

diff --git a/templates/nginx/conf.d/2fa.conf.template b/templates/nginx/conf.d/2fa.conf.template
new file mode 100644
index 0000000..278e4a1
--- /dev/null
+++ b/templates/nginx/conf.d/2fa.conf.template
@@ -0,0 +1,17 @@
+server {
+    server_name 2fa.${CRUPEST_DOMAIN};
+    include common/https-listen;
+    
+    location / {
+        include common/proxy-common;
+        proxy_pass http://2fauth:8000/;
+    }
+}
+
+server {
+    server_name 2fa.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/https-redirect;
+    include common/acme-challenge;
+}
diff --git a/templates/nginx/conf.d/code.conf.template b/templates/nginx/conf.d/code.conf.template
new file mode 100644
index 0000000..205c7ba
--- /dev/null
+++ b/templates/nginx/conf.d/code.conf.template
@@ -0,0 +1,20 @@
+server {
+    server_name code.${CRUPEST_DOMAIN};
+    include common/https-listen;
+    
+    location / {
+        include common/proxy-common;
+        proxy_pass http://debian-dev:8080/;
+    }
+
+    client_max_body_size 5G;
+}
+
+
+server {
+    server_name code.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/https-redirect;
+    include common/acme-challenge;
+}
diff --git a/templates/nginx/conf.d/forbid_unknown_domain.conf b/templates/nginx/conf.d/forbid_unknown_domain.conf
new file mode 100644
index 0000000..515942b
--- /dev/null
+++ b/templates/nginx/conf.d/forbid_unknown_domain.conf
@@ -0,0 +1,9 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
+
+    return 444;
+}
diff --git a/templates/nginx/conf.d/git.conf.template b/templates/nginx/conf.d/git.conf.template
new file mode 100644
index 0000000..3a2948c
--- /dev/null
+++ b/templates/nginx/conf.d/git.conf.template
@@ -0,0 +1,20 @@
+server {
+    server_name git.${CRUPEST_DOMAIN};
+    include common/https-listen;
+    
+    location / {
+        include common/proxy-common;
+        proxy_pass http://forgejo:3000/;
+    }
+
+    client_max_body_size 5G;
+}
+
+
+server {
+    server_name git.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/https-redirect;
+    include common/acme-challenge;
+}
diff --git a/templates/nginx/conf.d/mail.conf.template b/templates/nginx/conf.d/mail.conf.template
new file mode 100644
index 0000000..40adf28
--- /dev/null
+++ b/templates/nginx/conf.d/mail.conf.template
@@ -0,0 +1,25 @@
+server {
+    server_name mail.${CRUPEST_DOMAIN};
+    include common/https-listen;
+    
+    location / {
+        include common/proxy-common;
+        proxy_pass http://roundcubemail:80/;
+    }
+
+    location /rspamd/ {
+        include common/proxy-common;
+        proxy_pass http://mailserver:11334/;
+    }
+
+    client_max_body_size 5G;
+}
+
+
+server {
+    server_name mail.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/https-redirect;
+    include common/acme-challenge;
+}
diff --git a/templates/nginx/conf.d/root.conf.template b/templates/nginx/conf.d/root.conf.template
new file mode 100644
index 0000000..a0b08f8
--- /dev/null
+++ b/templates/nginx/conf.d/root.conf.template
@@ -0,0 +1,26 @@
+server {
+    server_name ${CRUPEST_DOMAIN};
+    include common/https-listen;
+
+    location / {
+        root /srv/www;
+    }
+
+    location /_$CRUPEST_V2RAY_PATH {
+        if ($http_upgrade != "websocket") {
+            return 404;
+        }
+
+        proxy_redirect off;
+        include common/proxy-common;
+        proxy_pass http://v2ray:10000;
+    }
+}
+
+server {
+    server_name ${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/https-redirect;
+    include common/acme-challenge;
+}
diff --git a/templates/nginx/conf.d/ssl.conf.template b/templates/nginx/conf.d/ssl.conf.template
new file mode 100644
index 0000000..54205f1
--- /dev/null
+++ b/templates/nginx/conf.d/ssl.conf.template
@@ -0,0 +1,17 @@
+# This file contains important security parameters. If you modify this file
+# manually, Certbot will be unable to automatically provide future security
+# updates. Instead, Certbot will print and log an error message with a path to
+# the up-to-date file that you will need to refer to when manually updating
+# this file. Contents are based on https://ssl-config.mozilla.org
+
+ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem;
+
+ssl_session_cache shared:le_nginx_SSL:10m;
+ssl_session_timeout 1440m;
+ssl_session_tickets off;
+
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+
+ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
diff --git a/templates/nginx/conf.d/timeline.conf.template b/templates/nginx/conf.d/timeline.conf.template
new file mode 100644
index 0000000..a467594
--- /dev/null
+++ b/templates/nginx/conf.d/timeline.conf.template
@@ -0,0 +1,6 @@
+server {
+    server_name timeline.${CRUPEST_DOMAIN};
+    include common/http-listen;
+
+    include common/acme-challenge;
+}
diff --git a/templates/nginx/conf.d/websocket.conf b/templates/nginx/conf.d/websocket.conf
new file mode 100644
index 0000000..32af4c3
--- /dev/null
+++ b/templates/nginx/conf.d/websocket.conf
@@ -0,0 +1,4 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}