summaryrefslogtreecommitdiff
path: root/nginx/nginx.conf
diff options
context:
space:
mode:
Diffstat (limited to 'nginx/nginx.conf')
-rw-r--r--nginx/nginx.conf189
1 files changed, 188 insertions, 1 deletions
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 063ff2a..382ee62 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -45,7 +45,7 @@ server {
listen 80;
listen [::]:80;
- server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol;
+ server_name swave.lol blog.swave.lol ghost.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol nexus.swave.lol registry.swave.lol auth.swave.lol;
location / {
rewrite ^ https://$host$request_uri? permanent;
@@ -117,15 +117,20 @@ server {
# Gerrit via path prefix on main domain
location /gerrit {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://gerrit:8080/gerrit;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-User $authelia_user;
}
# Jenkins via path prefix on main domain
location /jenkins {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://jenkins:8080/jenkins;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
@@ -133,6 +138,18 @@ server {
proxy_set_header X-Forwarded-Proto $scheme;
}
+ # Nexus via path prefix on main domain
+ location /nexus {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
+ proxy_pass http://nexus:8081/nexus;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ client_max_body_size 1G;
+ }
+
# Reverse proxy to Ghost
location / {
proxy_pass http://ghost:2368;
@@ -141,6 +158,25 @@ server {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
}
# Jenkins — jenkins.swave.lol
@@ -181,12 +217,33 @@ server {
}
location /jenkins {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://jenkins:8080/jenkins;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
}
# Cgit — cgit.swave.lol
@@ -261,10 +318,140 @@ server {
charset utf-8;
location / {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
proxy_pass http://gerrit:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-User $authelia_user;
+ }
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
+}
+
+# Nexus — nexus.swave.lol
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+
+ server_name nexus.swave.lol;
+
+ server_tokens off;
+
+ ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+ ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+ ssl_buffer_size 8k;
+
+ ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_prefer_server_ciphers on;
+
+ ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+ ssl_ecdh_curve secp384r1;
+ ssl_session_tickets off;
+
+ # OCSP stapling
+ ssl_stapling on;
+ ssl_stapling_verify on;
+ resolver 8.8.8.8;
+
+ charset utf-8;
+ client_max_body_size 1G;
+
+ location = / {
+ return 302 https://$host/nexus/;
+ }
+
+ location /nexus {
+ auth_request /_authelia-auth;
+ auth_request_set $authelia_user $upstream_http_remote_user;
+ proxy_pass http://nexus:8081/nexus;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ }
+
+ # Authelia forward-auth subrequest endpoint
+ location = /_authelia-auth {
+ internal;
+ proxy_pass http://authelia:9091/api/verify;
+ proxy_pass_request_body off;
+ proxy_set_header Content-Length "";
+ proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+ proxy_set_header X-Forwarded-Method $request_method;
+ proxy_set_header X-Forwarded-Proto $scheme;
+ proxy_set_header X-Forwarded-Host $http_host;
+ proxy_set_header X-Forwarded-Uri $request_uri;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ }
+
+ error_page 401 = @authelia_login_redirect;
+ location @authelia_login_redirect {
+ return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri;
+ }
+}
+
+# Docker Registry — registry.swave.lol
+server {
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
+
+ server_name registry.swave.lol;
+
+ server_tokens off;
+
+ ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem;
+ ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem;
+
+ ssl_buffer_size 8k;
+
+ ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
+
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_prefer_server_ciphers on;
+
+ ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+
+ ssl_ecdh_curve secp384r1;
+ ssl_session_tickets off;
+
+ # OCSP stapling
+ ssl_stapling on;
+ ssl_stapling_verify on;
+ resolver 8.8.8.8;
+
+ charset utf-8;
+ client_max_body_size 2G;
+ chunked_transfer_encoding on;
+
+ location / {
+ proxy_pass http://nexus:5000;
+ proxy_set_header Host $host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto $scheme;
}
}
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-05 13:09:26 +0000