meson/mov.onni.me

mov.onni.me · 2.2 KiB · Text Raw

# For reverse proxy vhosts (Transmission)
log_format transmission '$remote_addr - $remote_user [$time_local] '
                        '"$request" $status $body_bytes_sent '
                        '"$http_referer" "$http_user_agent" '
                        '$request_time $upstream_response_time';
server {
    listen      80;
    listen      [::]:80;
    server_name mov.onni.me;
    server_tokens off;
    access_log  off;
    return 301  https://$host$request_uri;
}

server {
    # HTTP/2 over TCP
    listen 443      ssl;
    listen [::]:443 ssl;

# HTTP/3 over QUIC/UDP
    listen 443      quic;
    listen [::]:443 quic;

http2 on;
    http3 on;

add_header Alt-Svc 'h3=":443"; ma=86400' always;
    
    server_name mov.onni.me;

server_tokens off;

root        /home/www-data/mov.onni.me;
    index       index.html;

access_log  /var/log/nginx/mov.onni.me.log      transmission buffer=32k flush=5m if=$loggable;
    error_log   /var/log/nginx/_error_mov.onni.me.log warn;

include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_certificate         /etc/letsencrypt/live/mov.onni.me/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/mov.onni.me/privkey.pem;
    ssl_dhparam             /etc/letsencrypt/dh/tau.pem;

# Security headers
    add_header Strict-Transport-Security    "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options       "nosniff"       always;
    add_header X-Frame-Options              "SAMEORIGIN"    always;
    add_header X-XSS-Protection             "1; mode=block" always;
    add_header X-Robots-Tag                 "none"          always;
    add_header X-Download-Options           "noopen"        always;
    add_header X-Permitted-Cross-Domain-Policies "none"     always;
    add_header Referrer-Policy              "strict-origin"  always;
    add_header Permissions-Policy           "interest-cohort=()" always;

# Transmission web UI
    location / {
        proxy_pass http://127.0.0.1:9091;
        #        include /etc/nginx/proxy-common.conf;
    }

# Block hidden files
    location ~ /\. {
        deny all;
        access_log  off;
        log_not_found off;
    }
}

1	# For reverse proxy vhosts (Transmission)
2	log_format transmission '$remote_addr - $remote_user [$time_local] '
3	'"$request" $status $body_bytes_sent '
4	'"$http_referer" "$http_user_agent" '
5	'$request_time $upstream_response_time';
6	server {
7	listen 80;
8	listen [::]:80;
9	server_name mov.onni.me;
10	server_tokens off;
11	access_log off;
12	return 301 https://$host$request_uri;
13	}
14
15	server {
16	# HTTP/2 over TCP
17	listen 443 ssl;
18	listen [::]:443 ssl;
19
20	# HTTP/3 over QUIC/UDP
21	listen 443 quic;
22	listen [::]:443 quic;
23
24	http2 on;
25	http3 on;
26
27	add_header Alt-Svc 'h3=":443"; ma=86400' always;
28
29	server_name mov.onni.me;
30
31	server_tokens off;
32
33	root /home/www-data/mov.onni.me;
34	index index.html;
35
36	access_log /var/log/nginx/mov.onni.me.log transmission buffer=32k flush=5m if=$loggable;
37	error_log /var/log/nginx/_error_mov.onni.me.log warn;
38
39	include /etc/letsencrypt/options-ssl-nginx.conf;
40	ssl_certificate /etc/letsencrypt/live/mov.onni.me/fullchain.pem;
41	ssl_certificate_key /etc/letsencrypt/live/mov.onni.me/privkey.pem;
42	ssl_dhparam /etc/letsencrypt/dh/tau.pem;
43
44	# Security headers
45	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
46	add_header X-Content-Type-Options "nosniff" always;
47	add_header X-Frame-Options "SAMEORIGIN" always;
48	add_header X-XSS-Protection "1; mode=block" always;
49	add_header X-Robots-Tag "none" always;
50	add_header X-Download-Options "noopen" always;
51	add_header X-Permitted-Cross-Domain-Policies "none" always;
52	add_header Referrer-Policy "strict-origin" always;
53	add_header Permissions-Policy "interest-cohort=()" always;
54
55	# Transmission web UI
56	location / {
57	proxy_pass http://127.0.0.1:9091;
58	# include /etc/nginx/proxy-common.conf;
59	}
60
61	# Block hidden files
62	location ~ /\. {
63	deny all;
64	access_log off;
65	log_not_found off;
66	}
67	}