diff options
Diffstat (limited to 'nginx/nginx.conf')
| -rw-r--r-- | nginx/nginx.conf | 51 |
1 files changed, 50 insertions, 1 deletions
diff --git a/nginx/nginx.conf b/nginx/nginx.conf index b62b458..dd852d2 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -4,7 +4,7 @@ server { listen 80; listen [::]:80; - server_name swave.lol blog.swave.lol jenkins.swave.lol; + server_name swave.lol blog.swave.lol jenkins.swave.lol cgit.swave.lol; location / { rewrite ^ https://$host$request_uri? permanent; @@ -48,6 +48,15 @@ server { charset utf-8; + # Cgit via path prefix on main domain + location /cgit { + proxy_pass http://cgit:80/; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + # Jenkins via path prefix on main domain location /jenkins { proxy_pass http://jenkins:8080/jenkins; @@ -106,3 +115,43 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } } + +# Cgit — cgit.swave.lol +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name cgit.swave.lol; + + server_tokens off; + + ssl_certificate /var/letsencrypt/etc/letsencrypt/live/swave.lol/fullchain.pem; + ssl_certificate_key /var/letsencrypt/etc/letsencrypt/live/swave.lol/privkey.pem; + + ssl_buffer_size 8k; + + ssl_dhparam /etc/ssl/certs/dhparam-2048.pem; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers on; + + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + + ssl_ecdh_curve secp384r1; + ssl_session_tickets off; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8; + + charset utf-8; + + location / { + proxy_pass http://cgit:80; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} |