Login Register

meson / pass.meson.kr

Last active 3 weeks ago

Like 0
nginx vaultwarden

meson revised this gist 3 weeks ago · b4ed203

1 file changed, 73 insertions

pass.meson.kr (file created)
@@ -0,0 +1,73 @@
1 + server {
2 + listen 80;
3 + listen [::]:80;
4 + server_name pass.meson.kr;
5 + return 301 https://$host$request_uri;
6 + }
7 +
8 + server {
9 + # HTTP/2 over TCP
10 + listen 443 ssl;
11 + listen [::]:443 ssl;
12 +
13 + # HTTP/3 over QUIC/UDP
14 + listen 443 quic;
15 + listen [::]:443 quic;
16 +
17 + http2 on;
18 + http3 on;
19 +
20 + add_header Alt-Svc 'h3=":443"; ma=86400' always;
21 +
22 + server_name pass.meson.kr;
23 + root /home/www-data/pass.meson.kr;
24 +
25 + include /etc/letsencrypt/options-ssl-nginx.conf;
26 +
27 + ssl_certificate /etc/letsencrypt/live/pass.meson.kr/fullchain.pem;
28 + ssl_certificate_key /etc/letsencrypt/live/pass.meson.kr/privkey.pem;
29 +
30 + access_log /var/log/nginx/pass.meson.kr.log combined if=$loggable;
31 + error_log /var/log/nginx/_error_pass.meson.kr.log warn;
32 +
33 + client_max_body_size 525M; # attachments/sends can be large
34 +
35 + # main app
36 + location / {
37 + proxy_pass http://127.0.0.1:8880;
38 + proxy_set_header Host $host;
39 + proxy_set_header X-Real-IP $remote_addr;
40 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
41 + proxy_set_header X-Forwarded-Proto $scheme;
42 + }
43 +
44 + # websocket notifications hub - required for real-time sync between devices
45 + location /notifications/hub {
46 + proxy_pass http://127.0.0.1:8880;
47 + proxy_http_version 1.1;
48 + proxy_set_header Upgrade $http_upgrade;
49 + proxy_set_header Connection "upgrade";
50 + proxy_set_header Host $host;
51 + proxy_set_header X-Real-IP $remote_addr;
52 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
53 + }
54 +
55 + location /notifications/hub/negotiate {
56 + proxy_pass http://127.0.0.1:8880;
57 + proxy_set_header Host $host;
58 + proxy_set_header X-Real-IP $remote_addr;
59 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
60 + }
61 +
62 + # lock down /admin to your Tailscale/LAN range - drop this block entirely
63 + # once initial setup is done and you disable ADMIN_TOKEN instead
64 + location /admin {
65 + allow 100.64.0.0/10; # example: Tailscale CGNAT range
66 + allow 127.0.0.1;
67 + deny all;
68 + proxy_pass http://127.0.0.1:8880;
69 + proxy_set_header Host $host;
70 + proxy_set_header X-Real-IP $remote_addr;
71 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
72 + }
73 + }