From 62e5f815084c978783f9a1789da9a7506d96d6f5 Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Sat, 2 May 2020 18:37:45 -0500 Subject: Added pleroma web root. --- .../pleroma.cloudflare.index.nginx.conf.j2 | 79 ++++++++++++++++++++++ .../templates/pleroma.cloudflare.nginx.conf.j2 | 15 ++-- .../templates/pleroma.letsencrypt.nginx.conf.j2 | 74 ++++++++++++++++++++ pleroma-otp/templates/pleroma.nginx.conf.j2 | 74 -------------------- 4 files changed, 163 insertions(+), 79 deletions(-) create mode 100644 pleroma-otp/templates/pleroma.cloudflare.index.nginx.conf.j2 create mode 100644 pleroma-otp/templates/pleroma.letsencrypt.nginx.conf.j2 delete mode 100644 pleroma-otp/templates/pleroma.nginx.conf.j2 (limited to 'pleroma-otp/templates') diff --git a/pleroma-otp/templates/pleroma.cloudflare.index.nginx.conf.j2 b/pleroma-otp/templates/pleroma.cloudflare.index.nginx.conf.j2 new file mode 100644 index 0000000..dd32eae --- /dev/null +++ b/pleroma-otp/templates/pleroma.cloudflare.index.nginx.conf.j2 @@ -0,0 +1,79 @@ +# default nginx site config for Pleroma +# +# Simple installation instructions: +# 1. Install your TLS certificate, possibly using Let's Encrypt. +# 2. Replace 'example.tld' with your instance's domain wherever it appears. +# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it +# in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx. + +proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g + inactive=720m use_temp_path=off; + +server { + listen {{nginx_port}}; + # listen [::]:{{nginx_port}}; + server_name {{nginx_server_name}}; + return 301 https://$host$request_uri; +} + +# Enable SSL session caching for improved performance +ssl_session_cache shared:ssl_session_cache:10m; + +server { + listen {{nginx_ssl_port}} ssl http2; + # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; + server_name {{nginx_server_name}}; + + ssl_certificate {{nginx_ssl_cert}}; + ssl_certificate_key {{nginx_ssl_privkey}}; + ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; + + add_header Strict-Transport-Security "max-age=31536000" always; + + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; + + # the nginx default is 1m, not enough for large media uploads + client_max_body_size 16m; + + root {{nginx_html_root}}; + + location = / { + index index.html; + } + + location / { + try_files $uri @pleroma; + } + + location @pleroma { + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + + proxy_pass {{pleroma_proxy_pass}}; + + client_max_body_size 16m; + } + + location /proxy { + proxy_cache {{pleroma_instance}}-pleroma_media_cache; + proxy_cache_lock on; + proxy_ignore_client_abort on; + proxy_pass {{pleroma_proxy_pass}}; + } +} diff --git a/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 b/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 index d8f538d..dd32eae 100644 --- a/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 +++ b/pleroma-otp/templates/pleroma.cloudflare.nginx.conf.j2 @@ -26,12 +26,7 @@ server { ssl_certificate {{nginx_ssl_cert}}; ssl_certificate_key {{nginx_ssl_privkey}}; - # include /etc/letsencrypt/options-ssl-nginx.conf; - # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; - ssl_stapling on; - ssl_stapling_verify on; add_header Strict-Transport-Security "max-age=31536000" always; @@ -45,7 +40,17 @@ server { # the nginx default is 1m, not enough for large media uploads client_max_body_size 16m; + root {{nginx_html_root}}; + + location = / { + index index.html; + } + location / { + try_files $uri @pleroma; + } + + location @pleroma { add_header X-XSS-Protection "1; mode=block"; add_header X-Permitted-Cross-Domain-Policies none; add_header X-Frame-Options DENY; diff --git a/pleroma-otp/templates/pleroma.letsencrypt.nginx.conf.j2 b/pleroma-otp/templates/pleroma.letsencrypt.nginx.conf.j2 new file mode 100644 index 0000000..af066ea --- /dev/null +++ b/pleroma-otp/templates/pleroma.letsencrypt.nginx.conf.j2 @@ -0,0 +1,74 @@ +# default nginx site config for Pleroma +# +# Simple installation instructions: +# 1. Install your TLS certificate, possibly using Let's Encrypt. +# 2. Replace 'example.tld' with your instance's domain wherever it appears. +# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it +# in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx. + +proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g + inactive=720m use_temp_path=off; + +server { + listen {{nginx_port}}; + # listen [::]:{{nginx_port}}; + server_name {{nginx_server_name}}; + return 301 https://$host$request_uri; +} + +# Enable SSL session caching for improved performance +ssl_session_cache shared:ssl_session_cache:10m; + +server { + listen {{nginx_ssl_port}} ssl http2; + # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; + server_name {{nginx_server_name}}; + + ssl_certificate {{nginx_ssl_cert}}; + ssl_certificate_key {{nginx_ssl_privkey}}; + include /etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; + ssl_stapling on; + ssl_stapling_verify on; + + add_header Strict-Transport-Security "max-age=31536000" always; + + gzip_vary on; + gzip_proxied any; + gzip_comp_level 6; + gzip_buffers 16 8k; + gzip_http_version 1.1; + gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; + + # the nginx default is 1m, not enough for large media uploads + client_max_body_size 16m; + + location / { + add_header X-XSS-Protection "1; mode=block"; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options DENY; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy same-origin; + add_header X-Download-Options noopen; + + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $http_host; + + proxy_pass {{pleroma_proxy_pass}}; + + client_max_body_size 16m; + } + + location /proxy { + proxy_cache {{pleroma_instance}}-pleroma_media_cache; + proxy_cache_lock on; + proxy_ignore_client_abort on; + proxy_pass {{pleroma_proxy_pass}}; + } +} diff --git a/pleroma-otp/templates/pleroma.nginx.conf.j2 b/pleroma-otp/templates/pleroma.nginx.conf.j2 deleted file mode 100644 index af066ea..0000000 --- a/pleroma-otp/templates/pleroma.nginx.conf.j2 +++ /dev/null @@ -1,74 +0,0 @@ -# default nginx site config for Pleroma -# -# Simple installation instructions: -# 1. Install your TLS certificate, possibly using Let's Encrypt. -# 2. Replace 'example.tld' with your instance's domain wherever it appears. -# 3. Copy this file to /etc/nginx/sites-available/ and then add a symlink to it -# in /etc/nginx/sites-enabled/ and run 'nginx -s reload' or restart nginx. - -proxy_cache_path /tmp/{{pleroma_instance}}-pleroma-media-cache levels=1:2 keys_zone={{pleroma_instance}}-pleroma_media_cache:10m max_size=10g - inactive=720m use_temp_path=off; - -server { - listen {{nginx_port}}; - # listen [::]:{{nginx_port}}; - server_name {{nginx_server_name}}; - return 301 https://$host$request_uri; -} - -# Enable SSL session caching for improved performance -ssl_session_cache shared:ssl_session_cache:10m; - -server { - listen {{nginx_ssl_port}} ssl http2; - # listen [::]:{{nginx_ssl_port}} ssl ipv6only=on; - server_name {{nginx_server_name}}; - - ssl_certificate {{nginx_ssl_cert}}; - ssl_certificate_key {{nginx_ssl_privkey}}; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - - ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1; - ssl_stapling on; - ssl_stapling_verify on; - - add_header Strict-Transport-Security "max-age=31536000" always; - - gzip_vary on; - gzip_proxied any; - gzip_comp_level 6; - gzip_buffers 16 8k; - gzip_http_version 1.1; - gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript application/activity+json application/atom+xml; - - # the nginx default is 1m, not enough for large media uploads - client_max_body_size 16m; - - location / { - add_header X-XSS-Protection "1; mode=block"; - add_header X-Permitted-Cross-Domain-Policies none; - add_header X-Frame-Options DENY; - add_header X-Content-Type-Options nosniff; - add_header Referrer-Policy same-origin; - add_header X-Download-Options noopen; - - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; - - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - proxy_set_header Host $http_host; - - proxy_pass {{pleroma_proxy_pass}}; - - client_max_body_size 16m; - } - - location /proxy { - proxy_cache {{pleroma_instance}}-pleroma_media_cache; - proxy_cache_lock on; - proxy_ignore_client_abort on; - proxy_pass {{pleroma_proxy_pass}}; - } -} -- cgit v1.2.3