diff options
Diffstat (limited to 'nginx')
| -rw-r--r-- | nginx/nginx.conf | 51 | ||||
| -rw-r--r-- | nginx/run_certbot.sh | 3 |
2 files changed, 52 insertions, 2 deletions
diff --git a/nginx/nginx.conf b/nginx/nginx.conf index b110783..9afed4f 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -4,7 +4,7 @@ server { listen 80; listen [::]:80; - server_name swave.lol blog.swave.lol jenkins.swave.lol cgit.swave.lol; + server_name swave.lol blog.swave.lol jenkins.swave.lol cgit.swave.lol gerrit.swave.lol; location / { rewrite ^ https://$host$request_uri? permanent; @@ -62,6 +62,15 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } + # Gerrit via path prefix on main domain + location /gerrit { + proxy_pass http://gerrit:8080/gerrit; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + # Jenkins via path prefix on main domain location /jenkins { proxy_pass http://jenkins:8080/jenkins; @@ -160,3 +169,43 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } } + +# Gerrit — gerrit.swave.lol +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name gerrit.swave.lol; + + server_tokens off; + + ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem; + ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem; + + ssl_buffer_size 8k; + + ssl_dhparam /etc/ssl/certs/dhparam-2048.pem; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers on; + + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + + ssl_ecdh_curve secp384r1; + ssl_session_tickets off; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8; + + charset utf-8; + + location / { + proxy_pass http://gerrit:8080; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} diff --git a/nginx/run_certbot.sh b/nginx/run_certbot.sh index d265cce..79cc681 100644 --- a/nginx/run_certbot.sh +++ b/nginx/run_certbot.sh @@ -21,4 +21,5 @@ docker run -it --rm \ -d $domain \ -d blog.$domain \ -d jenkins.$domain \ - -d cgit.$domain + -d cgit.$domain \ + -d gerrit.$domain |