Login Register

meson / pass.meson.kr

Last active 3 weeks ago

Like 0
nginx vaultwarden

Revision b4ed203d6eb270211ea39d8354f5b67d4ab5ca44

pass.meson.kr Raw
1server {
2 listen 80;
3 listen [::]:80;
4 server_name pass.meson.kr;
5 return 301 https://$host$request_uri;
6}
7
8server {
9 # HTTP/2 over TCP
10 listen 443 ssl;
11 listen [::]:443 ssl;
12
13 # HTTP/3 over QUIC/UDP
14 listen 443 quic;
15 listen [::]:443 quic;
16
17 http2 on;
18 http3 on;
19
20 add_header Alt-Svc 'h3=":443"; ma=86400' always;
21
22 server_name pass.meson.kr;
23 root /home/www-data/pass.meson.kr;
24
25 include /etc/letsencrypt/options-ssl-nginx.conf;
26
27 ssl_certificate /etc/letsencrypt/live/pass.meson.kr/fullchain.pem;
28 ssl_certificate_key /etc/letsencrypt/live/pass.meson.kr/privkey.pem;
29
30 access_log /var/log/nginx/pass.meson.kr.log combined if=$loggable;
31 error_log /var/log/nginx/_error_pass.meson.kr.log warn;
32
33 client_max_body_size 525M; # attachments/sends can be large
34
35 # main app
36 location / {
37 proxy_pass http://127.0.0.1:8880;
38 proxy_set_header Host $host;
39 proxy_set_header X-Real-IP $remote_addr;
40 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
41 proxy_set_header X-Forwarded-Proto $scheme;
42 }
43
44 # websocket notifications hub - required for real-time sync between devices
45 location /notifications/hub {
46 proxy_pass http://127.0.0.1:8880;
47 proxy_http_version 1.1;
48 proxy_set_header Upgrade $http_upgrade;
49 proxy_set_header Connection "upgrade";
50 proxy_set_header Host $host;
51 proxy_set_header X-Real-IP $remote_addr;
52 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
53 }
54
55 location /notifications/hub/negotiate {
56 proxy_pass http://127.0.0.1:8880;
57 proxy_set_header Host $host;
58 proxy_set_header X-Real-IP $remote_addr;
59 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
60 }
61
62 # lock down /admin to your Tailscale/LAN range - drop this block entirely
63 # once initial setup is done and you disable ADMIN_TOKEN instead
64 location /admin {
65 allow 100.64.0.0/10; # example: Tailscale CGNAT range
66 allow 127.0.0.1;
67 deny all;
68 proxy_pass http://127.0.0.1:8880;
69 proxy_set_header Host $host;
70 proxy_set_header X-Real-IP $remote_addr;
71 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
72 }
73}