diff options
| -rw-r--r-- | nginx/docker-compose.yaml | 4 | ||||
| -rw-r--r-- | nginx/nginx.conf | 53 | ||||
| -rw-r--r-- | nginx/run_certbot.sh | 3 |
3 files changed, 57 insertions, 3 deletions
diff --git a/nginx/docker-compose.yaml b/nginx/docker-compose.yaml index 12110a6..7917bed 100644 --- a/nginx/docker-compose.yaml +++ b/nginx/docker-compose.yaml @@ -17,6 +17,7 @@ services: git-network: ipv4_address: 172.22.0.254 ghost_network: + jenkins_network: networks: #write each stack network (or connect it manually later) @@ -26,4 +27,7 @@ networks: ghost_network: name: ghost_network external: true + jenkins_network: + name: jenkins_network + external: true diff --git a/nginx/nginx.conf b/nginx/nginx.conf index 9767a66..b62b458 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -4,7 +4,7 @@ server { listen 80; listen [::]:80; - server_name swave.lol blog.swave.lol; + server_name swave.lol blog.swave.lol jenkins.swave.lol; location / { rewrite ^ https://$host$request_uri? permanent; @@ -17,6 +17,7 @@ server { } } +# Ghost — swave.lol and blog.swave.lol server { listen 443 ssl http2; listen [::]:443 ssl http2; @@ -45,9 +46,17 @@ server { ssl_stapling_verify on; resolver 8.8.8.8; - # Define the specified charset to the "Content-Type" response header field charset utf-8; + # Jenkins via path prefix on main domain + location /jenkins { + proxy_pass http://jenkins:8080/jenkins; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + # Reverse proxy to Ghost location / { proxy_pass http://ghost:2368; @@ -57,3 +66,43 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } } + +# Jenkins — jenkins.swave.lol +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name jenkins.swave.lol; + + server_tokens off; + + ssl_certificate /var/letsencrypt/etc/letsencrypt/live/swave.lol/fullchain.pem; + ssl_certificate_key /var/letsencrypt/etc/letsencrypt/live/swave.lol/privkey.pem; + + ssl_buffer_size 8k; + + ssl_dhparam /etc/ssl/certs/dhparam-2048.pem; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers on; + + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + + ssl_ecdh_curve secp384r1; + ssl_session_tickets off; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8; + + charset utf-8; + + location / { + proxy_pass http://jenkins:8080/jenkins; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh index a07c9fc..3859d19 100644 --- a/nginx/run_certbot.sh +++ b/nginx/run_certbot.sh @@ -19,4 +19,5 @@ docker run -it --rm \ --agree-tos --no-eff-email \ --webroot-path=/data/letsencrypt \ -d $domain \ - -d blog.$domain + -d blog.$domain \ + -d jenkins.$domain |